[Announce] GPGME 1.1.6 released

[Alon Bar-Lev]

On 1/11/08, Werner Koch <wk@...> wrote:
> If you have a specific problem please describe it at the list and we can
> discuss a solution.

All I ask is to stop breaking the interface.
Find some way to pass the passphrase from gnupg to the pinentry program.
You can even have a new configuration option in gpg-agent.conf to
ignore this by default.
But please don't break the interface.

BTW: Waiting for new release of gpgme with all fixed.

Alon.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[Werner Koch]

On Sat, 12 Jan 2008 10:21, alon.barlev@... said:

> All I ask is to stop breaking the interface.

As Marcus already explained, there is no interface break.  gpg2 is an
entirely different program and we have always declared that it is only
_mostly identical_ to the standalone gpg.

This is one of the reasons why we promised to maintain both programs.
(The other reason is that GnuPG-1 is easier to build and more portable
to older and pre-POSIX systems).


Shalom-Salam,

   Werner


--
Die Gedanken sind frei.  Auschnahme regelt ein Bundeschgesetz.


_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[Alon Bar-Lev]

On 1/12/08, Werner Koch <wk@...> wrote:

> On Sat, 12 Jan 2008 10:21, alon.barlev@... said:
>
> > All I ask is to stop breaking the interface.
>
> As Marcus already explained, there is no interface break.  gpg2 is an
> entirely different program and we have always declared that it is only
> _mostly identical_ to the standalone gpg.
>
> This is one of the reasons why we promised to maintain both programs.
> (The other reason is that GnuPG-1 is easier to build and more portable
> to older and pre-POSIX systems).

I don't understand what you are talking about, from gpg2 man page:
       --passphrase-fd n
              Read  the passphrase from file descriptor n. Only the
first line will be read from file
              descriptor n. If you use 0 for n, the passphrase will be
read from stdin. This can only
              be  used if only one passphrase is supplied.  Note that
this passphrase is only used if
              the option --batch has also been given.  This is
different from gpg.


       --passphrase-file file
              Read the passphrase from file file. Only the first line
will be read  from  file  file.
              This  can  only  be  used  if  only one passphrase is
supplied. Obviously, a passphrase
              stored in a file is of questionable security if other
users can read this  file.  Don't
              use  this  option  if  you can avoid it.  Note that this
passphrase is only used if the
              option --batch has also been given.  This is different from gpg.


       --passphrase string
              Use string as the passphrase. This can only be used if
only one passphrase is supplied.
              Obviously, this is of very questionable security on a
multi-user system. Don't use this
              option if you can avoid it.  Note that this passphrase
is  only  used  if  the  option
              --batch has also been given.  This is different from gpg.

So unless you release gpg3, removing these parameters breaks your interface.

Alon.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[Marcus Brinkmann]

At Sat, 12 Jan 2008 11:21:48 +0200,
"Alon Bar-Lev" <alon.barlev@...> wrote:
> BTW: Waiting for new release of gpgme with all fixed.

There will not be a release just for fixing the test suite with gpg2.

Thanks,
Marcus


_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[Alon Bar-Lev]

On 1/13/08, Marcus Brinkmann <marcus.brinkmann@...> wrote:
> At Sat, 12 Jan 2008 11:21:48 +0200,
> "Alon Bar-Lev" <alon.barlev@...> wrote:
> > BTW: Waiting for new release of gpgme with all fixed.
>
> There will not be a release just for fixing the test suite with gpg2.

How do you expect we push this to users this way?
We will get a lot of bugs opened by users who find this, wasting our time.
Please release a new version or official patch (it is the same thing).

Alon.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[Igor Belyi-3]

Just my couple cents.

Alon Bar-Lev wrote:
> How do you expect we push this to users this way?
> We will get a lot of bugs opened by users who find this, wasting our time.
> Please release a new version or official patch (it is the same thing).
>
> Alon.
>  

The beauty of GPL is that if you as a maintainer of Gentoo package think
that Gentoo will be better of with the behavior changed you are free to
do that. Debian package maintainers do that all the time - they get
upstream source and then keep bunch of patches to make it Debian
friendly or to have fixes for their user faster. Yes, if number of those
patches grows too much - you have a problem and may need to take care of
pushing them back to the mainstream or in extreme cases fork out the
whole product. You basically, need to decide where's your efforts are
better spend - trying to convince upstream maintainer or maintain this
patch compatible with next releases.

In short, there's no point in getting personal (even if a person is a
distro). You have an editor and a compiler, right? That's all you need!

Cheers,
Igor


_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[Alon Bar-Lev]

On 1/13/08, Igor Belyi <gpgme@...> wrote:

> The beauty of GPL is that if you as a maintainer of Gentoo package think
> that Gentoo will be better of with the behavior changed you are free to
> do that. Debian package maintainers do that all the time - they get
> upstream source and then keep bunch of patches to make it Debian
> friendly or to have fixes for their user faster. Yes, if number of those
> patches grows too much - you have a problem and may need to take care of
> pushing them back to the mainstream or in extreme cases fork out the
> whole product. You basically, need to decide where's your efforts are
> better spend - trying to convince upstream maintainer or maintain this
> patch compatible with next releases.
>
> In short, there's no point in getting personal (even if a person is a
> distro). You have an editor and a compiler, right? That's all you need!

Gee.... Thanks for clearing this!

But if upstream releases product without proper QA (this case with
its own products!!!), I see no reason why the work should be delegated
downstream.

I work with many types of people and upstreams, g10 is the hardest
to work with, this also effect the service its users get.

gnupg-2.0.8 already not provided to our users, gpgme-1.6 the same.
If other downstream will create patch for these, I will gladly add,
I just don't understand why upstream which aware of an issue does not
release a fix.

BTW: Look at the changelog of last couple of version, you will notice how
many patches from Gentoo were accepted... And still we left with some
patches/tweecks.

Alon.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[Igor Belyi-3]

Alon Bar-Lev wrote:
> On 1/13/08, Igor Belyi <gpgme@...> wrote:
>  
>> In short, there's no point in getting personal (even if a person is a
>> distro). You have an editor and a compiler, right? That's all you need!
>>    
>
> Gee.... Thanks for clearing this!
>  
You are welcome. ;)

> But if upstream releases product without proper QA (this case with
> its own products!!!), I see no reason why the work should be delegated
> downstream.
>  
There could be any number of reasons - for example, they don't have
enough people for this. A missed test failing usually does not effect
end user and thus do not justifies a new release.

> I work with many types of people and upstreams, g10 is the hardest
> to work with, this also effect the service its users get.
>  
That's the beauty of life - people are different. Some are hard, some
are easy. Even users are different - I don't hear much complains about
g10 from users. Plus, the "hard" part could also come from the lack of
resources they have - I don't believe anyone hard on you on purpose.

> gnupg-2.0.8 already not provided to our users, gpgme-1.6 the same.
> If other downstream will create patch for these, I will gladly add,
> I just don't understand why upstream which aware of an issue does not
> release a fix.
>  
Are we still talking about a fix in a test? The easiest solution is not
to run this failing one, do you want somebody else to create a patch for
you for that?! I suspect I missed something - I thought you were pushing
a change in the main code.

> BTW: Look at the changelog of last couple of version, you will notice how
> many patches from Gentoo were accepted... And still we left with some
> patches/tweecks.
>  
I'm very happy to hear that. That's the way to make the world a happier
place! Some patches/tweaks left is not a problem on a grand scale. The
life will be such a waste without some exciting patches made by brave
disto maintainers. :)

Cheers,
Igor


_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

[Marcus Brinkmann]

At Sun, 13 Jan 2008 19:59:17 +0200,
"Alon Bar-Lev" <alon.barlev@...> wrote:
> But if upstream releases product without proper QA (this case with
> its own products!!!), I see no reason why the work should be delegated
> downstream.

The GPGME release was tested with gpg, not gpg2.  gpg is what GPGME
configure searches for and uses by default.  But now that gpg2 starts
to get used more frequently, I think it makes sense to add a
compilation against gpg2 to the pre-release test procedure.

> I work with many types of people and upstreams, g10 is the hardest
> to work with, this also effect the service its users get.
>
> gnupg-2.0.8 already not provided to our users, gpgme-1.6 the same.
> If other downstream will create patch for these, I will gladly add,
> I just don't understand why upstream which aware of an issue does not
> release a fix.

Because making a release costs time and money.  Not only for g10 Code,
but also for all distributions etc. who want to stay up to date.  By
requesting a release one is effectively saying that the changes since
the last release are worth these costs, and in this case I don't think so.

> BTW: Look at the changelog of last couple of version, you will notice how
> many patches from Gentoo were accepted... And still we left with some
> patches/tweecks.

Sometimes things fall off the table.  If you send me a list with open
issues I can respond to them specifically and individually.

Thanks,
Marcus Brinkmann

--
g10 Code GmbH       http://g10code.com      AmtsGer. Wuppertal HRB 14459
Hüttenstr. 61                               Geschäftsführung Werner Koch
D-40699 Erkrath  -=- The GnuPG Experts -=-  USt-Id DE215605608



_______________________________________________
Gnupg-devel mailing list
Gnupg-devel@...
http://lists.gnupg.org/mailman/listinfo/gnupg-devel