Re: [openpgp] To bind or not to bind

[Justus Winter <[e-mail]>]

Hi Falko :)

Falko Strenzke <[e-mail]> writes:

> Am 23.03.24 um 07:10 schrieb Daniel Kahn Gillmor:
>>> pgpy is fairly niche.
>> pgpy upstream has also been unresponsive for nearly a year, sadly.  the
>> branch i worked on for the crypto-refresh probably has the most active
>> maintenance, and i haven't even tried to release it :( I should probably
>> consider releasing it myself (maybe under another python module name) at
>> some point if upstream remains unresponsive.  I don't really want to
>> shoulder the full maintainer burden though.
>
> Based on what you write and what I can see in PGPy's GitHub repository, 
> it seems PGPy has to be considered as unmaintained. In that case it 
> should not be considered in the interop tests.

We're trying to understand how the existing v4 ecosystem will react to
introducing an as-of-yet unknown algorithms with as-of-yet unseen
artifact encodings to v4 certificates.

Whether or not an implementation is actively maintained seems to be
irrelevant to that question.

Or, one could even argue that not inadvertently breaking unmaintained
implementations is more important.  Along those lines, Aron has been
arguing that gopenpgp reacting badly to unknown algorithms isn't that
bad because gopenpgp is actively maintained.

Best,
Justus