https://bugs.kde.org/show_bug.cgi?id=419656
Bug ID: 419656
Summary: KMyMoney embedded GPG version out of date, does not
support non-embedded version
Product: kmymoney
Version: 5.0.6
Platform: MS Windows
OS: MS Windows
Status: REPORTED
Severity: major
Priority: NOR
Component: file
Assignee: kmymoney-devel@kde.org
Reporter: veperr-kde...@yahoo.com
Target Milestone: ---
SUMMARY
Two related issues (can split into separate bug reports if desired):
1) The version of GPG (2.0.22) included with KMyMoney (current release 5.0.6)
was deemed End of Life on December 31, 2017, per:
https://www.gnupg.org/download/index.html
2) KMyMoney will not work with current versions of Gpg4win (the official
supported full version of GPG for Windows), instead it only works with the out
of date embedded version of GPG.
STEPS TO REPRODUCE
1. Install KMyMoney (kmymoney5-mingw64-5.0.6-8.1-setup.exe) on Windows 10
2. Install Gpg4win (Gpg4win 3.1.11) on Windows 10
3. Try to use Kleopatra (a component of Gpg4win) to manage Key Pairs per the
Gpg4win instructions.
OBSERVED RESULT
KMyMoney will not recognize keypairs generated via Kleopatra (and thus
generated by the underlying gpg.exe version 2.2.19.7300 installed by Gpg4win).
Using the embedded (but out of date) version of gpg that came with KMyMoney
works, but this is really bad to have to use security software that is over two
years beyond end of life.
EXPECTED RESULT
1) Version of gpg embedded in KMyMoney should be a currently supported version
2) KMyMoney should also (and preferentially) support using a non-embedded
version of GPG, namely the version recommended on the GPG website
(https://www.gnupg.org/index.html), in those cases where people have installed
the current version of GPG (Gpg4Win) separately.
SOFTWARE/OS VERSIONS
Windows: Windows 10, x64, 10.0.18362 Build 18362
macOS:
Linux/KDE Plasma:
(available in About System)
KDE Plasma Version:
KDE Frameworks Version:
Qt Version:
ADDITIONAL INFORMATION
Both the homepage of the GPG website: https://www.gnupg.org/index.html
and the download page: https://www.gnupg.org/download/index.html
Reference Gpg4Win as the "Full featured Windows version of GnuPG".
This is why I believe KMyMoney should preferentially work with that version
when installed, and when it is not, then fall back to the version embedded with
KMyMoney (but that version to should be a version that is officially
supported).
I ranked the severity as major as it's an out of date security component.
Thank you,
veperr
--
You are receiving this mail because:
You are the assignee for the bug.
