1

I'm now using Debian for developing a C++ application with GPGME. Currently I read that a new version of GnuPG (2.1.10) is available which supports ECC. I would really like to use this feature in my application. But as I checked the currently installed version in my system I noticed that I only have GnuPG 1.4.18 available. That raised two questions:

  1. How can I replace the stable with the modern version of GnuPG?
  2. Will Gpgme automatically use this new version or is there something I have to consider first?
0

2 Answers 2

Reset to default
3

GnuPG Branches

There are different release branches of GnuPG, modern, stable and classic.

Three different versions of GnuPG are actively maintained:

  • GnuPG "modern" (2.1) is the latest development with a lot of new features. This announcement is about the first release of this version.

  • GnuPG "stable" (2.0) is the current stable version for general use. This is what most users are currently using.

  • GnuPG "classic" (1.4) is the old standalone version which is most suitable for older or embedded platforms.

GnuPG Classic and Stable

GnuPG 1.4, Classic is based on the old monolithic core and will still be patched for some time, but will not receive new features and algorithms. In Debian (and derivatives), it's available as the gnupg package and gpg binary. GnuPG 2.0 is the current stable release. The Debian package name for it is gnupg2, the binary is installed as gpg2.

GnuPG Modern

GnuPG 2.1 called modern is more the "experimental" release, with features to be tested in practice, and other applications relying on GnuPG do be fitted to it. It is available for Debian, but as of 2016-01-07 not in the stable repositories, only in Debian Sid (unstable). See "How to install some packages from "unstable" Debian on a computer running "stable" Debian?" on how to install packages from a different release branch, but be aware of the caveats. I'm successfully running GnuPG 2.1 for quite some time now from Unstable/Sid, while having the Debian testing branch installed.

Be aware ECC cryptography in OpenPGP is not yet widely spread and supported, so you might have compatibility issues when communicating with others. If you want to use ECC curves, anyway, remember to use the --expert flag to be able to create ECC keys.

Roadmap

In a lecture at 32C3, GnuPG maintainer Werner Koch announced GnuPG 2.2 will probably be released (rather soon) this year and inherit GnuPG 2.0's stable status, which will probably also result in being included in Debian Testing rather soon, maybe already for Debian 9. Sadly, there's nothing I can cite, the lecture was neither recorded nor are the slides available.

GPGME

The Debian package libgpgme11 requires GnuPG 2 which is also fulfilled when using GnuPG 2.1. Applications using GPGME should automatically pick up GnuPG 2.1 when available instead of GnuPG 2.0 (and you can't have both through Debian's package manager, anyway).

1
  • I would upvote that, but I'm currently not allowed to. So I will just thank you for your detailed and helpfull answer :)
    – little_planet
    Jan 8, 2016 at 7:50
1

On Debian systems, often both versions of GnuPG are installed. You can call the 2.x version with gpg2.

2
  • You are right. gpg2 --version tells me gpg 2.0.26 is avaiable. Do you know by chance how to advice gpgme to use gpg modern? Oh, and how can I update gpg2? It seems a newer release is available by the developers.
    – little_planet
    Jan 7, 2016 at 10:26
  • You can try to backport a newer version of gnupg2 (the most recent is in Debian unstable). I do not know gpgme deeply, but you can change the backend engine which it uses with gpgme_set_engine_info if needed. It seems to use gpgconf to get the gpg version which returns gpg2 by default, so there is probably nothing to do.
    – jofel
    Jan 7, 2016 at 10:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .