[pkg-gnupg-maint] Bug#911189: Bug#911189: gpgme-json packaging

[Sébastien Noel]

Le 2024-08-01 08:56, Daniel Kahn Gillmor a écrit :
> Hi Sébastian--
> 
> I understand your frustration -- it's a frustrating situation.
> 
> I've been the only one stepping up to make policy-style changes in the
> past several years, and i'm overwhelmed by several things related to 
> the
> json interface:

Hi Daniel,

Thank you very much for taking the time to respond to my rant.

I acknowledge that the last 5 years have been "bumpy" in the gnupg 
community (omg the certificates flooding incident was that long ago ?? 
time flies)
and that working with an increasingly hostile upstream must be 
difficult.

But I i'm still "full of questions" about this particular issue. 
Especially:

>  - the security implications of connecting GnuPG to your web browser, 
> to
>    your overall session, and possibly to the network generally; and

I don't understand why you, with your "downstream packager hat", have to 
rethink about that.
- If the "security implications of connecting GnuPG to your web browser" 
where so severe, don't you think that "upstream" wouldn't have developed 
this if it was insecure ? If you had any concern, that should be raised 
to another level with your "upstream developer hat". But certainly not 
by doing obstruction here in Debian.
- Half of the world is already doing it anyway (via ubuntu & fedora) and 
nothing bad happened. I know it's not an excuse, as they said "billions 
of flies likes shit", but come on...

>> What are my options to improve things ?
> 
> If you'd like to join the team packaging GnuPG-related tooling for
> Debian, that would be great!
> 
> The first step is probably to update the packaging of gpgme to 1.23.2,
> which Andreas has prepared in salsa (currently on the branch
> tmp-ametz-debian/experimental).  Thank you Andreas!  That work looks
> solid to me, and i'd recommend moving it to the debian/experimental
> branch.

This is bullshit.
You are still not addressing the problem, and burying your head in the 
sand.
Patches have been posted. The work is done.
WE ARE WAITING FOR REVIEW.

Once reviews are done & comments posted, corrections will comes.
But right now all you are doing is playing for time.

Sorry for not being nicer, but once again i fell that those with an 
@debian.org email address are just shitting on the others.

Sébastien

> Regards,
> 
>         --dkg