[pkg-gnupg-maint] GnuPG Perl bindings in Debian [Re: Bug#873753: O: libcrypt-gpg-perl -- An Object Oriented Interface to GnuPG]

[Daniel Kahn Gillmor]

Over on https://bugs.debian.org/873753, Ricardo Mones wrote:

> The current maintainer of libcrypt-gpg-perl, Roberto Jimeno <robertojimenoca at terra.es>,
> is apparently not active anymore.  Therefore, I orphan this package now.

fwiw, this package has not been updated for many years (nearly a
decade), and is several versions behind upstream (1.52, in unstable
today, was released upstream in 2005!).  I strongly doubt whether it
even works with modern versions of GnuPG.  It also has no reverse
dependencies.

As one of the members of the debian GnuPG packaging team, i recommend
that we let libcrypt-gpg-perl be removed from debian.

There are too many bindings for GnuPG in different languages, and
keeping them all up-to-date and clean is a pain.  we should focus on one
or at most two per language.

In debian, we have at least:

  libmail-gnupg-perl
  libgnupg-perl
  libcrypt-gpg-perl
  libgnupg-interface-perl
  libpgp-sign-perl
  
GnuPG upstream doesn't directly support any of these, unfortunately.

We do *not* currently ship Crypt::GpgME.  I know that upstream prefers
bindings to use gpgme instead of shelling out to gpg, but Crypt::GpgME
hasn't been updated since 2009.

When i last looked in-depth, i thought that GnuPG::Interface was the
best of the lot.  But I have had to do a bunch of work to make
libgnupg-interface-perl work with modern GnuPG recently, and it hasn't
been accepted upstream :(

I don't know what shape the rest of these packages are really in,
either.

So i'm afraid that i currently think there are *no* good interfaces to
GnuPG in perl at the moment :( We should be culling the ones that we can
cull from debian, so that we can focus on a single good implementation.

I welcome help from either GnuPG or Perl maintainers in figuring out
what is the best approach here.

Regards,

      --dkg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 832 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-gnupg-maint/attachments/20170907/9f991e4b/attachment.sig>