Re: gpgme replacement

[Laurent Cheylus <foxy free fr>]

Hi,

Quoting Jacob Perkins <jap1@users.sourceforge.net>:

> I am the lead developer of seahorse and am currently considering the
> idea of a library for integrating gpg support into gnome apps.  This
> could replace balsa's gpgme dependence and make developer's lives much
> easier by providing API consistency, common components, and easy to
> use operations.

I disagree your point of view about GPGME :

- first, GPGME is developped by the same authors than GnuPG. It's for me the
best guarantee of quality and security. I read a lot of code (GPA, Sylpheed,
E-Gaim, all version without GPGME use) before using GPGME with Balsa and all of
these used insecure mechanisms (pipe, system exec) to use GnuPG.

- develop an new library (libseahorse) for using GnuPG is a new point of failure
in a critical environnement (all crypto features around GPG).

- moreover, with libseahorse, you want add a new layer in library dependances.
You want mix GPG calls and Gnome/GTK calls in libseahorse. I think it's better
for Balsa to use directly GPGME calls and be independant of another library.

- I consider that GPGME is still in beta stage and is not API stable but it's
not a great problem to fix compliant version with 'autoconf' and to indicate it
in release docs. At the present time, my work and Albrecht's work is only
compliant with 0.3.x GPGME version.

- maybe, it's a good idea to develop a common library for GPG support in Gnome
apps but for Balsa, it's not more complex to use GPGME directly.
 
> Basically, I want to know if balsa would consider using libseahorse
> and if so what would be required for adoption.

I don't know Albrecht opinion but for me, I prefer to continue to use GPGME
directly.

A++ Foxy.

-- 
Laurent Cheylus <foxy@free.fr> OpenPGP ID 0x5B766EC2