[PR PATCH] gnupg: update to 2.4.4

[PR PATCH] gnupg: update to 2.4.4

[filiprojek]

[-- Attachment #1: Type: text/plain, Size: 546 bytes --]

There is a new pull request by filiprojek against master on the void-packages repository

https://github.com/filiprojek/void-packages gnupg
https://github.com/void-linux/void-packages/pull/48419

gnupg: update to 2.4.4
just a version bump
tagging the maintainer @jcgruenhage 

#### Testing the changes
- I tested the changes in this PR: **briefly**

#### Local build testing
- I built this PR locally for my native architecture, (x86_64-glibc)



A patch file from https://github.com/void-linux/void-packages/pull/48419.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-gnupg-48419.patch --]
[-- Type: text/x-diff, Size: 1216 bytes --]

From 4f8e5d95d2f532313ae68ec5e95c10a054ea98db Mon Sep 17 00:00:00 2001
From: Filip Rojek <filip@filiprojek.cz>
Date: Mon, 29 Jan 2024 15:55:23 +0100
Subject: [PATCH] gnupg: update to 2.4.4

---
 srcpkgs/gnupg/template | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/srcpkgs/gnupg/template b/srcpkgs/gnupg/template
index d18025c9de2bb..9966e3e23c722 100644
--- a/srcpkgs/gnupg/template
+++ b/srcpkgs/gnupg/template
@@ -1,7 +1,7 @@
 # Template file for 'gnupg'
 # minor version updates (2.3-> 2.4) often need a fix in reverse dependencies
 pkgname=gnupg
-version=2.4.3
+version=2.4.4
 revision=2
 # We're building outside of the source tree, because upstream told us to:
 # https://dev.gnupg.org/T6313#166339
@@ -24,7 +24,7 @@ maintainer="Jan Christian Grünhage <jan.christian@gruenhage.xyz>"
 license="GPL-3.0-or-later"
 homepage="https://www.gnupg.org/"
 distfiles="https://gnupg.org/ftp/gcrypt/gnupg/gnupg-${version}.tar.bz2"
-checksum=a271ae6d732f6f4d80c258ad9ee88dd9c94c8fdc33c3e45328c4d7c126bd219d
+checksum=67ebe016ca90fa7688ce67a387ebd82c6261e95897db7b23df24ff335be85bc6
 make_check_pre='env TESTFLAGS="--parallel=${XBPS_MAKEJOBS}"'
 build_options="ldap"
 build_options_default="ldap"

Re: [PR PATCH] [Updated] gnupg: update to 2.4.4

[filiprojek]

[-- Attachment #1: Type: text/plain, Size: 551 bytes --]

There is an updated pull request by filiprojek against master on the void-packages repository

https://github.com/filiprojek/void-packages gnupg
https://github.com/void-linux/void-packages/pull/48419

gnupg: update to 2.4.4
just a version bump
tagging the maintainer @jcgruenhage 

#### Testing the changes
- I tested the changes in this PR: **briefly**

#### Local build testing
- I built this PR locally for my native architecture, (x86_64-glibc)



A patch file from https://github.com/void-linux/void-packages/pull/48419.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-gnupg-48419.patch --]
[-- Type: text/x-diff, Size: 1250 bytes --]

From e1ca9a7f14ec82902fb577a76542c997505bd638 Mon Sep 17 00:00:00 2001
From: Filip Rojek <filip@filiprojek.cz>
Date: Mon, 29 Jan 2024 15:55:23 +0100
Subject: [PATCH] gnupg: update to 2.4.4

---
 srcpkgs/gnupg/template | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/srcpkgs/gnupg/template b/srcpkgs/gnupg/template
index d18025c9de2bb..f9f7ddee58860 100644
--- a/srcpkgs/gnupg/template
+++ b/srcpkgs/gnupg/template
@@ -1,8 +1,8 @@
 # Template file for 'gnupg'
 # minor version updates (2.3-> 2.4) often need a fix in reverse dependencies
 pkgname=gnupg
-version=2.4.3
-revision=2
+version=2.4.4
+revision=1
 # We're building outside of the source tree, because upstream told us to:
 # https://dev.gnupg.org/T6313#166339
 build_wrksrc=build
@@ -24,7 +24,7 @@ maintainer="Jan Christian Grünhage <jan.christian@gruenhage.xyz>"
 license="GPL-3.0-or-later"
 homepage="https://www.gnupg.org/"
 distfiles="https://gnupg.org/ftp/gcrypt/gnupg/gnupg-${version}.tar.bz2"
-checksum=a271ae6d732f6f4d80c258ad9ee88dd9c94c8fdc33c3e45328c4d7c126bd219d
+checksum=67ebe016ca90fa7688ce67a387ebd82c6261e95897db7b23df24ff335be85bc6
 make_check_pre='env TESTFLAGS="--parallel=${XBPS_MAKEJOBS}"'
 build_options="ldap"
 build_options_default="ldap"

Re: gnupg: update to 2.4.4

[jcgruenhage]

[-- Attachment #1: Type: text/plain, Size: 1085 bytes --]

New comment by jcgruenhage on void-packages repository

https://github.com/void-linux/void-packages/pull/48419#issuecomment-1915216796

Comment:
Even if it's just a version bump, don't merge this without checking extensively what they changed upstream.

```
-----BEGIN ALLEGATIONS-----
```
GnuPG has allegedly made changes in the past that were inconsistent with the OpenPGP standard in a way that deliberately breaks interoperability with other OpenPGP implementations with the alleged goal of weaponizing they userbase against other implementations to get their way with how the standard is supposed to develop in the future.
```
-----END ALLEGATIONS-----
```

We're patching out changes like that already, and we need to be careful with updates to make sure we don't accidentally include updates like that without patching out the unwanted stuff. This is done consistently with other distros as well, with at least Alpine, Arch, Fedora and NixOS shipping a patched version like this. I'm not sure who else also patches GnuPG, but there's going to be a few more I suspect.

Re: gnupg: update to 2.4.4

[filiprojek]

[-- Attachment #1: Type: text/plain, Size: 316 bytes --]

New comment by filiprojek on void-packages repository

https://github.com/void-linux/void-packages/pull/48419#issuecomment-1916598628

Comment:
I've added some regression tests to the original PR description. I'm not sure what else to test. The changelog does not have to appear to have any breaking changes listed.

Re: gnupg: update to 2.4.4

[realcharmer]

[-- Attachment #1: Type: text/plain, Size: 253 bytes --]

New comment by realcharmer on void-packages repository

https://github.com/void-linux/void-packages/pull/48419#issuecomment-1920669970

Comment:
We also do quite a bit of patching in SUSE: https://build.opensuse.org/package/show/openSUSE%3AFactory/gpg2

Re: gnupg: update to 2.4.4

[github-actions]

[-- Attachment #1: Type: text/plain, Size: 305 bytes --]

New comment by github-actions[bot] on void-packages repository

https://github.com/void-linux/void-packages/pull/48419#issuecomment-2089392387

Comment:
Pull Requests become stale 90 days after last activity and are closed 14 days after that.  If this pull request is still relevant bump it or assign it.

Re: [PR PATCH] [Closed]: gnupg: update to 2.4.4

[github-actions]

[-- Attachment #1: Type: text/plain, Size: 540 bytes --]

There's a closed pull request on the void-packages repository

gnupg: update to 2.4.4
https://github.com/void-linux/void-packages/pull/48419

Description:
just a version bump
tagging the maintainer @jcgruenhage 

#### Testing the changes
I've done the following regression testing:
- encrypt/decrypt
- key import/export
- keyserver sync
- symmetric encryption/decryption
- non-resident key (yubikey gen5)

No regresions found.

#### Local build testing
- I built this PR locally for my native architecture, (x86_64-glibc)