To gnupg or not to gnupg ... (was Re: Assertion while pui-list-packages)
Speaking of PGP signatures, we're at a crossroads. Future builds for
distribution will be occurring on a server that is owned by a Japanese
company but operated on United States soil. This might make usage of
US domestic PGP problematic. Any encryption that is US exportable is
unacceptable.
It is possible to use gnupg instead, which at least bypasses the
rsaref licensing issue, however the signatures generated by gnupg are
incompatible with PGP 2.6 (which is what we're using now).
I know what John Martin thinks about this. Any other comments? At
this time I'm strongly in favor of moving forward to gnupg.
Norbert Koch <n.koch(a)delta-ii.de> writes in xemacs-beta(a)xemacs.org:
...
Signaling: (error "Package-get PGP signature failed to
verify")