{"action":"created","issue":{"url":"https://api.github.com/repos/sobolevn/git-secret/issues/228","repository_url":"https://api.github.com/repos/sobolevn/git-secret","labels_url":"https://api.github.com/repos/sobolevn/git-secret/issues/228/labels{/name}","comments_url":"https://api.github.com/repos/sobolevn/git-secret/issues/228/comments","events_url":"https://api.github.com/repos/sobolevn/git-secret/issues/228/events","html_url":"https://github.com/sobolevn/git-secret/issues/228","id":340620427,"node_id":"MDU6SXNzdWUzNDA2MjA0Mjc=","number":228,"title":"Wrong dependencies in documentation?","user":{"login":"brontolinux","id":6696962,"node_id":"MDQ6VXNlcjY2OTY5NjI=","avatar_url":"https://avatars1.githubusercontent.com/u/6696962?v=4","gravatar_id":"","url":"https://api.github.com/users/brontolinux","html_url":"https://github.com/brontolinux","followers_url":"https://api.github.com/users/brontolinux/followers","following_url":"https://api.github.com/users/brontolinux/following{/other_user}","gists_url":"https://api.github.com/users/brontolinux/gists{/gist_id}","starred_url":"https://api.github.com/users/brontolinux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brontolinux/subscriptions","organizations_url":"https://api.github.com/users/brontolinux/orgs","repos_url":"https://api.github.com/users/brontolinux/repos","events_url":"https://api.github.com/users/brontolinux/events{/privacy}","received_events_url":"https://api.github.com/users/brontolinux/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-07-12T12:40:00Z","updated_at":"2018-07-13T14:01:09Z","closed_at":null,"author_association":"NONE","body":"<!-- Thanks for reporting an issue! Please make sure you click the link above to view the issue guidelines, then fill out the blanks below. -->\r\n\r\nWhat are the steps to reproduce this issue?\r\n-------------------------------------------\r\n1. try using git-secret with a gpg version earlier than 2.1\r\n\r\n\r\nWhat happens?\r\n-------------\r\nIt doesn't work. It appears that the regexps in the script are designed to match the output of gpg v2.1 or later.\r\n\r\nWhat were you expecting to happen?\r\n----------------------------------\r\nEither git-secret to work with gpg 1.4.20 or later, or the docs be updated to state that v2.1 or later is necessary (Docs here say gpg 1.4.20: http://git-secret.io/installation)\r\n\r\nAny logs, error output, etc?\r\n----------------------------\r\nNope\r\n\r\nAny other comments?\r\n-------------------\r\nNope\r\n\r\nWhat versions of software are you using?\r\n----------------------------------------\r\n**Operating system:** (`uname -a`) \r\nLinux nelson 4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux\r\n\r\n**`git-secret` path:** (`which git-secret`) \r\n/usr/bin/git-secret\r\n\r\n**`git-secret` version:** (`git secret --version`) \r\n0.2.4\r\n\r\n**`git` version:** (`git --version`) \r\ngit version 2.11.0\r\n\r\n**Shell type and version:** (`$SHELL --version`) \r\nGNU bash, version 4.4.12(1)-release (x86_64-pc-linux-gnu)\r\nCopyright (C) 2016 Free Software Foundation, Inc.\r\nLicense GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>\r\n\r\nThis is free software; you are free to change and redistribute it.\r\nThere is NO WARRANTY, to the extent permitted by law.\r\n\r\n\r\n**`gpg` version:** (`gpg --version`) \r\ngpg (GnuPG) 2.1.18\r\nlibgcrypt 1.7.6-beta\r\nCopyright (C) 2017 Free Software Foundation, Inc.\r\nLicense GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>\r\nThis is free software: you are free to change and redistribute it.\r\nThere is NO WARRANTY, to the extent permitted by law.\r\n\r\nHome: /home/bronto/.gnupg\r\nSupported algorithms:\r\nPubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA\r\nCipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,\r\n        CAMELLIA128, CAMELLIA192, CAMELLIA256\r\nHash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224\r\nCompression: Uncompressed, ZIP, ZLIB, BZIP2\r\n\r\n\r\n<!-- Love git-secret? Please consider supporting our collective:\r\n👉  https://opencollective.com/git-secret/donate -->\r\n"},"comment":{"url":"https://api.github.com/repos/sobolevn/git-secret/issues/comments/404842257","html_url":"https://github.com/sobolevn/git-secret/issues/228#issuecomment-404842257","issue_url":"https://api.github.com/repos/sobolevn/git-secret/issues/228","id":404842257,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNDg0MjI1Nw==","user":{"login":"joshrabinowitz","id":699993,"node_id":"MDQ6VXNlcjY5OTk5Mw==","avatar_url":"https://avatars3.githubusercontent.com/u/699993?v=4","gravatar_id":"","url":"https://api.github.com/users/joshrabinowitz","html_url":"https://github.com/joshrabinowitz","followers_url":"https://api.github.com/users/joshrabinowitz/followers","following_url":"https://api.github.com/users/joshrabinowitz/following{/other_user}","gists_url":"https://api.github.com/users/joshrabinowitz/gists{/gist_id}","starred_url":"https://api.github.com/users/joshrabinowitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshrabinowitz/subscriptions","organizations_url":"https://api.github.com/users/joshrabinowitz/orgs","repos_url":"https://api.github.com/users/joshrabinowitz/repos","events_url":"https://api.github.com/users/joshrabinowitz/events{/privacy}","received_events_url":"https://api.github.com/users/joshrabinowitz/received_events","type":"User","site_admin":false},"created_at":"2018-07-13T14:01:09Z","updated_at":"2018-07-13T14:01:09Z","author_association":"COLLABORATOR","body":"> Running on the same major (gpg) version should definitely be possible, but running on the same major.minor is already problematic.\r\n\r\nIn the medium term, git-secret has a plan (from @simbo1905) to largely remove dependence on the particular version of gpg installed. A solution like this one is definitely the way forward for this problem.  See: https://github.com/sobolevn/git-secret/blob/master/RFC/RFC001.md\r\nThe summary: \"git-secret will move away from using the keyring format as shared storage of public keys. Instead, it will store public keys as exported keys in ASCII armor format.\"  \r\n\r\n> what if an OS upgrade wants to install a version of gpg that results in interoperability issues?\r\n\r\nTypically OS packagers arrange that updates to packages on a particular distribution (say, centos7 or ubuntu 16) are (mostly) backward compatible with the previous version on that distribution. \r\n\r\nSo for the case of centos7, which currently packages `gnupg2-2.0.22`, I wouldn't expect a centos7 to upgrade to `gnupg2-2.1.xx` (unless I go to centos8, in which case who knows).  On the other hand if you do a major OS upgrade (say ubuntu 14 to 16 or centos 6 to 7), you could expect more significant changes between gnupg versions.\r\n\r\n> what happens when one upgrades the OS and steps from, say, 2.0 to 2.2? \r\n\r\nThis brings the issue full circle: git-secret currently has no mechanism for detecting/working around incompatibilities between particular gpg versions; you bring up valid points. [It may make sense to add some provisions for git-secret to detect incompatibilities, but with so many versions of gpg available in the wild, this could get a little hairy and might not be easy or effective in all situations.] https://github.com/sobolevn/git-secret/blob/master/RFC/RFC001.md is definitely the best looking way forward for this issue. \r\n\r\nWe definitely welcome PR submissions or suggestions for git-secret.\r\n"}}
{"actor":{"display_login":"joshrabinowitz"}}