GNU bug report logs - #22883
Trustable "guix pull"

Previous Next

Package: guix;

Reported by: Christopher Allan Webber <cwebber <at> dustycloud.org>

Date: Wed, 2 Mar 2016 18:05:02 UTC

Severity: serious

Tags: security

Done: Ludovic Courtès <ludo <at> gnu.org>

Bug is archived. No further changes may be made.

Full log


Message #94 received at 22883 <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Leo Famulari <leo <at> famulari.name>
Cc: 22883 <at> debbugs.gnu.org, Werner Koch <wk <at> gnupg.org>, neal <at> walfield.org,
 Justus Winter <justus <at> gnupg.org>
Subject: gpg2 vs. gpg
Date: Tue, 07 Jun 2016 10:08:54 +0200
Leo Famulari <leo <at> famulari.name> skribis:

> On Sun, Jun 05, 2016 at 09:51:45AM +0200, Werner Koch wrote:
>> Given that Guix is a new distro you should really try to get rid of 1.4
>> and only use 2.1.  For Windows we use the name "gpg" for a long time now
>> and there is a configure option --enable-gpg2-is-gpg to make it easier.
>
> If a Guix user installs GnuPG without specifying the version, which I
> think is the typical behavior, they will get the latest version that we
> package (currently 2.1.12). That's not exactly what you are requesting,
> but it should steer some users towards the modern branch :)
>
> For your reference, we package the classic, stable, and modern branches.

Nevertheless, we could configure GPG 2.x with --enable-gpg2-is-gpg, if
that’s what Werner recommends.

Thanks,
Ludo’.




This bug report was last modified 5 years and 53 days ago.

Previous Next


GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.