Post #1700609

2026-04-24 15:17 UTC

I&#39;m getting quite annoyed with the state of #GnuPG as a packager. Upstream silently keeps releasing 2.2 versions to this day(!) and at the same time claims 2.4 will soon be EOL (also refuses to backport security fixes for it). Meanwhile, there are no good reasons to upgrade to 2.5, unless one wants incompatibility with the entire rest of the ecosystem (see https://wiki.archlinux.org/index.php?title=GnuPG&amp;oldid=860217#OpenPGP_compatibility). The move to #OpenPGP #RFC9580 compliant solutions can&#39;t happen early enough! Also, I&#39;m glad we have @freepg

Replies (5)

@dvzrv@chaos.social 2026-04-24 20:25

Everything gets even more wild once you notice that upstream itself appears to flag the package out of date and is trying to upsell the new features. Apart from the incompatibility madness: Without the #FreePG patches, there no longer would be #systemd support (which we require!) in 2.5, because upstream removed it (what seems to me, out of spite).

Open ##2152913
@mklovenotcyber@infosec.exchange 2026-04-24 15:20

@dvzrv what a mess. Thank you so much for your hard work!

Open ##2152914
@letoams@defcon.social 2026-04-24 15:58

@dvzrv @freepg @hko gnupg is dead

Open ##2152915
@serebit@floss.social 2026-04-24 16:12

@dvzrv @freepg Time to switch to SSH signing! (this is mostly a joke)

Open ##2152919
@gregsie@floss.social 2026-04-24 22:36

@dvzrv @freepg *sigh* this isn't good. I recall days in the late 90s when i had to exchange e-mails with pgp users and had to faff about with forced v3 signatures in my .gnupg.conf file now it looks like gnupg wants me to go through more pain..... On a point of order, I really don't like the use of the term 'propriety formats' when the code is GPL The devs need to give their heads a wobble.

Open ##2152936