gnupg vs gnupg2

MindOfMercury · 12-03-2007, 12:28 PM

What are the differences between the `gnupg` and `gnupg2` in etch/main?

Along those lines, why is most every package in the standard install dependent on the `gnupg` package, but not `gnupg2`? I thought that they would provide the same capabilities. I know why you need ONE of them - signature checking on packages, etc. But why not `gnupg2`?

farslayer · 12-03-2007, 02:45 PM

I think the answer probably lies in the following statement..

http://packages.debian.org/etch/gnupg
http://packages.debian.org/etch/gnupg2

Quote:

GnuPG does not use any patented algorithms so it cannot be compatible with PGP2 because it uses IDEA (which is patented worldwide).

MindOfMercury · 12-04-2007, 01:50 AM

Not quite.

GnuPG2 != PGP2. PGP2 is a different implementation of the OpenPGP standard, nothing to do with GnuPG OR GnuPG2.

As such, neither gnupg nor gnupg2 supports the IDEA cipher due to patent restrictions, and neither ever has. So, I'm still not sure what the difference is.

farslayer · 12-04-2007, 09:19 AM

the only other info I see is:

http://lists.gnupg.org/pipermail/gnu...q2/000254.html

Quote:

"GnuPG-2 has a different architecture than GnuPG-1 (e.g. 1.4.7) in that
it splits up functionality into several modules. However, both
versions may be installed alongside without any conflict. In fact,
the gpg version from GnuPG-1 is able to make use of the gpg-agent as
included in GnuPG-2 and allows for seamless passphrase caching. The
advantage of GnuPG-1 is its smaller size and the lack of dependency on
other modules at run and build time. We will keep maintaining GnuPG-1
versions because they are very useful for small systems and for server
based applications requiring only OpenPGP support."

not real informative..

MindOfMercury · 12-04-2007, 10:48 AM

Yeah, I saw that too.

All I gather from that is this:

"They do the same thing, and offer the same capabilities, but one's built differently."

Still doesn't explain why packages in Debian are dependent on one, and not the other.

farslayer · 12-04-2007, 11:01 AM

That would probably depend on the package maintainer that wrote/assembled the package as to which one it depends on..

there was a thread in the gentoo-dev list that referred to this..

http://www.archivum.info/gentoo-dev@.../msg00622.html

Quote:

For the record I fully support those in their efforts to go gnupg-2 only
on Gentoo. However it's not been practical for some time, and likely
will continue to be such. There is a bit of upstream chaos going on, and
till they rein in the problems. Not much we can do downstream.

there are links to some bug reports and other threads in that post which seem relevant.

MindOfMercury · 12-04-2007, 04:45 PM

Gotcha! Thank you much.

I'm not very good at thread-diving. You're awesome.