Bug 22958

Summary:	Replace gnupg with gnupg2
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	RPM Packages	Assignee:	All Packagers <pkg-bugs>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	release_blocker	CC:	andrewsfarm, mageia, smelror
Version:	Cauldron
Target Milestone:	Mageia 7
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	gnupg-1.4.22-2.mga7.src.rpm, gnupg2-2.2.6-2.mga7.src.rpm	CVE:
Status comment:
Attachments:	gnupg2-reqs-list gnupg-reqs-list Proposed changes to gnupg2.spec

Description David Walser 2018-04-27 17:39:58 CEST

GnuPG version 1.4.x is basically unsupported upstream now.  All of the other major distros are removing or already have removed GnuPG 1.4.x.  The gnupg2 package should provide the /usr/bin/gpg binary and any remaining software that doesn't work with GnuPG 2 should be fixed or dropped for Mageia 7.

David Walser 2018-04-27 17:40:13 CEST

Priority: Normal => release_blocker
Target Milestone: --- => Mageia 7
Assignee: bugsquad => pkg-bugs

Comment 1 Stig-Ørjan Smelror 2018-12-27 22:41:18 CET

I've been running my system with gnupg2 installed as gnupg. No issues so far.

The only package that needed to be changed, that I compile locally, was Libreoffice. It uses gnupg2 to generate keys.

Is it still time to do this switch or should we wait for mga8?

CC: (none) => smelror

Comment 2 David Walser 2018-12-27 22:42:36 CET

Yeah this needs to be done ASAP.

Comment 3 Stig-Ørjan Smelror 2018-12-27 22:47:05 CET

Created attachment 10614 [details]
gnupg2-reqs-list

This is a list that I made with

urpmq --whatrequires-recursive gnupg2 | sort -u

It's quite extensive and this needs to be coordinated correctly and efficiently so we don't break too much in one go.

Comment 4 David Walser 2018-12-27 22:48:34 CET

Packages that currently require gnupg2 wouldn't be an issue.  It's packages that require gnupg that need to be looked at.

Comment 5 Stig-Ørjan Smelror 2018-12-27 22:51:50 CET

Well, yes and no.

If gnupg2 provides /usr/bin/gnupg and some spec file needs gnupg2, this will break the build.

The same goes for packages the requires /usr/bin/gnupg2 to run.

Comment 6 David Walser 2018-12-27 22:57:51 CET

No, that shouldn't break anything.  gnupg2 would provide /usr/bin/gpg and /usr/bin/gpg2.

Comment 7 Stig-Ørjan Smelror 2018-12-27 23:13:51 CET

Created attachment 10615 [details]
gnupg-reqs-list

Yeah, this list is much shorter and manageable.

If gnupg2 Provides gnupg, there should be no probles building these packages. The issue might be when it comes to running them.

I don't use any of them personally and have no experience so this needs to be done by more knowledgeable folks.

Comment 8 Stig-Ørjan Smelror 2018-12-27 23:48:14 CET

Created attachment 10616 [details]
Proposed changes to gnupg2.spec

Here is my proposition for gnupg2.

This enables packages that requires gnupg to install gnupg2. It also obsoletes gnupg 1.4.23.

It also provides
- /usr/bin/gpg
- /usr/bin/gpg2
- /usr/bin/gpgv
- /usr/bin/gpgv2

and the respective man pages via symlinks.

Like I mentioned, I don't know if the syntax is different and that the packages requiring gnupg will work properly after this switch.

Comment 9 Stig-Ørjan Smelror 2018-12-28 23:48:35 CET

gnupg2 has been submitted with the proposed changes.

Now we need to look out for programs that could break.

Cheers,
Stig

Comment 10 Martin Whitaker 2019-01-13 00:37:58 CET

gnupg is still listed in rpmsrate.

CC: (none) => mageia

Comment 11 David Walser 2019-01-13 19:45:38 CET

rpmsrate fixed.  Thanks.

Comment 12 Thomas Andrews 2019-02-22 15:42:53 CET

Has this bug been resolved? It pops up as a release blocker.

CC: (none) => andrewsfarm

Comment 13 David Walser 2019-02-22 17:08:23 CET

Yeah I guess so.

Resolution: (none) => FIXED
Status: NEW => RESOLVED