Petr Menšík wrote: > When did it change from Requires: gnupg2 to Requires: gpgverify by the way?
When I pushed for a new version of GPGverify that removed some limitations of the original script, and Fesco liked the change better when I agreed to move the script to a separate package: https://pagure.io/fesco/issue/3373#comment-963746 To avoid breaking all the packages that followed the previous policy, a dependency hack was arranged so that "BuildRequires: gnupg2" results in the gpgverify package being pulled in. You can still use that for now, but contorted dependencies shouldn't be allowed to accumulate and petrify. At some point all the BuildRequires tags should be updated to remove the need for dependency hacks. > The issue I have with that is we do not have that tiny thing in RHEL. Not in RHEL but in EPEL, which is the best I can do as a Fedora contributor. > This creates a regression compared to previous state. The previous state was "BuildRequires: gnupg2", and that still works. That's not a regression. But we should migrate away from that in an orderly way without breaking anything. > I read it like MUST used in RFCs, > https://datatracker.ietf.org/doc/html/rfc2119#section-1. Not optional. SHOULD > would have to be used there instead. Strictly speaking, the policy doesn't say "MUST" about BuildRequires. It says you MUST use the macro, and then it tells you what dependency makes the macro available in Fedora and EPEL. > What I do not understand is, why is not gpgverify in normal > /usr/bin/gpgverify? Because it's designed primarily for scripting. It prevents various mistakes that packagers who are unfamiliar with GnuPG would make, that would make scripts insecure. I figured crypto nerds using GnuPG manually would continue to run gpg --verify or possibly gpgv. Programs meant to be invoked by other programs belong under /usr/libexec (although RPM uses /usr/lib/rpm). If many people want to use GPGverify interactively, then it can be moved to /usr/bin. Björn Persson
pgpJ0hE8dEpfn.pgp
Description: OpenPGP digital signatur
-- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
