Please remove MacGPG from gnupg.org due to serious security concerns

[Ville Määttä]

On 18.02.15 07:21, Werner Koch wrote:
>> wrappers or fixes upstream. Case in point: Has the fix for gpg-agent /
>> > scdaemon hang been discussed upstream at all [4], [5]? In MacGPG there
>> > is still ../libexec/gnupg-pcsc-wrapper which has been modified in
>> > commit f4c3e1bb to fix the issues of scdaemon hanging in Yosemite
>> > [6]. GnuPG proper has removed it in bc6b45 [7]. How would one go about
> I just tried to figure out what this is about.  The problem description
> is pretty clear but I can't easliy find a description of the solution.
> I don't think this has been discussed upstream. 
> 
> Right, in 2.1 there is no more need for the pcsc-wrapper because we
> switched from Pth to native threads (wrapped by the ntph library).
> 

Yep, unfortunately it would appear the same or identical issue does
occur with a speedo build of 2.1.2. The issue is essentially that
smartcard works for the first time but once some-indeterminate-time has
passed, gpg just hangs. No pinentry, nothing just happens. /Will need to
troubleshoot this further on 2.1.2 to try to find out more./

>> fixing this issue for upstream? Has GPGTools contributed anything
>> regarding this other than the initial discussion[8] about the issue?
> 
> There was no followup on my answer.  As we all now mailing lists are a
> primary source to evaluate problems and thus it is usually a good idea
> to post the found or not-found solution.

I think we might want to move some of this discussion to gnupg-devel
side at some point.

-- 
Ville

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 648 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20150219/16eee564/attachment.sig>