I'm getting quite annoyed with the state of #GnuPG as a packager.

[dvzrv@chaos.social]

I'm getting quite annoyed with the state of #GnuPG as a packager.

Upstream silently keeps releasing 2.2 versions to this day(!) and at the same time claims 2.4 will soon be EOL (also refuses to backport security fixes for it).

Meanwhile, there are no good reasons to upgrade to 2.5, unless one wants incompatibility with the entire rest of the ecosystem (see https://wiki.archlinux.org/index.php?title=GnuPG&oldid=860217#OpenPGP_compatibility).

The move to #OpenPGP #RFC9580 compliant solutions can't happen early enough!
Also, I'm glad we have @freepg

[mklovenotcyber@infosec.exchange]

@dvzrv what a mess. Thank you so much for your hard work!

[letoams@defcon.social]

@dvzrv @freepg @hko gnupg is dead

[hko@floss.social]

@letoams @dvzrv @freepg It's certainly not in a good place.

But it does seem determined to drag the rest of OpenPGP down, with its weird antics.

[andrewg@mastodon.ie]

@letoams @dvzrv @freepg @hko on linux maybe, but not on windows...

[serebit@floss.social]

@dvzrv @freepg Time to switch to SSH signing!

[dvzrv@chaos.social]

@serebit well, not necessarily.

We luckily have options for #OpenPGP outside of #GnuPG