Please remove MacGPG from due to serious security concerns

Ville Määttä mailing-lists at
Thu Feb 19 19:41:23 CET 2015

On 18.02.15 07:21, Werner Koch wrote:
>> > command line tools. *I think there is no more reason to develop
>> > MacGPG*, i.e. a port, anymore. Let the port die.
> Can you briefly explain how Patrick's new installer [1] is related to that?
> Would it be an option to use that as the core for gpgtools?
> [1]

I haven't tried Patrick's installer but it should be a fine option as
the core. The Mail plug-in should work just fine with 2.1 like it works
with upstream 2.0.* builds. I'm not aware of any specific need for
MacGPG in that regard. Same goes for the other little helpers.

The things that would require a little changing are the launchd
templates that are used to start gpg-agent et al. I've been using my own
templates already before and with 2.1 it's even simpler as per the
changes to related gpg-agent. This sort of a script is not even
necessary unless one needs SSH support which I do. I've attached my new
template here.

I know, that's a lot of /shoulds/ :). There is an existing ticket [1]
for MacGPG upgrade to 2.1 and it links to a couple of their support
request [2] [3], one of them mentions the need to /"first have to adapt
our library which is responsible for communicating with the gnupg
binary"/. Lukas, maybe you could comment on the other tools'
dependencies with MacGPG, if any.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: com.ruriat.gpgagent.plist
Type: text/xml
Size: 659 bytes
Desc: not available
URL: </pipermail/attachments/20150219/b2fddd2e/attachment-0001.xml>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 648 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20150219/b2fddd2e/attachment-0001.sig>

More information about the Gnupg-users mailing list