Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 591530 - New package: app-crypt/parcimonie to mitigate an information leak
Summary: New package: app-crypt/parcimonie to mitigate an information leak
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: New packages (show other bugs)
Hardware: All Linux
: Normal enhancement (vote)
Assignee: Default Assignee for New Packages
URL: https://gaffer.ptitcanardnoir.org/int...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-17 17:10 UTC by Chicago
Modified: 2018-09-08 21:41 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chicago 2016-08-17 17:10:12 UTC
Hello,

    Please develop an ebuild for Parcimonie and add it into the tree.

    OpenPGP Best Practices as suggested at riseup.net, https://riseup.net/en/security/message-security/openpgp/best-practices/#refresh-your-keys-slowly-and-one-at-a-time indicate there is an information leak when using "/usr/bin/gpg --refresh-keys" which many users implement via cron.

    A secure alternative to request updates from a keyserver for keys that already exist on the local keyring would be nice to have.

Best Regards,
-Chicago
Comment 1 Jack 2018-09-08 21:41:37 UTC
There are some oddities about this package.  The web site listed has not been updated since 2011, although there is plenty of activity in the git repository.  

I cannot find any tarballs, but an ebuild can easily enough pull from the appropriate git tag for a released version.  However, installing requires the Perl CPAN module Dist::Zilla, which has only a (~) version in the tree, and, for me (with a fairly up to date Perl) that would require installing over 100 new packages, mostly perl modules, and also requires updating perl to a (~) version and accepting dozens of (~) perl modules.  Would enough people find this acceptable, that it's worth proceeding?

Another approach would be writing an ebuild to use a Debian package - would that count as a "binary" ebuild, even though all the code is Perl?