Re: Why Do Developers Continue to Sign with GNUPG

--Q/0uQaGPcHyO1sls
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 2025-08-10 14:35:20 +0000 (+0000), [email protected] wrote:
> Since Debian is a major Linux distribution I want to ask why=20
> software developers continue to digitally sign their code an=20
> software packages with GNUPG when there are simpler alternatives=20
> such as minisign (https://jedisct1.github.io/minisign/), signify,=20
> or age (https://github.com/FiloSottile/age).
[...]

While I can't speak authoritatively on the matter, you hint at the=20
reason already when you use the word "continue." The other solutions=20
you cite are mere infants compared to the ages of Debian (1993) and=20
PGP (1991). Change takes time, and supplanting things that are=20
already working well enough requires that the benefit and interest=20
needed to overcome the inertia of the status quo must exceed any=20
related effort and disruption that implies. In short, the=20
alternatives have to be way, way, way superior for an existing=20
system to get replaced.

Newer communities and ecosystems are more likely to use the things=20
you mentioned primarily because they too are new enough that they=20
can adopt them from the start, without incurring replacement costs.
--=20
Jeremy Stanley

--Q/0uQaGPcHyO1sls
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQKTBAABCgB9FiEEl65Jb8At7J/DU7LnSPmWEUNJWCkFAmiY27NfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDk3
QUU0OTZGQzAyREVDOUZDMzUzQjJFNzQ4Rjk5NjExNDM0OTU4MjkACgkQSPmWEUNJ
WClDehAArzJ1/vHa9A/Vuo94oONd4AO87lWvFP10+6+2Pohtu7xZgKBX2OvS5ARY
JyXydSWtx15xMqg4ATThHRolzfIlo7MrdcjlcbAyf+Z61PoCIWUxxFnLwRJrrnP3
NAxraA8lJEEFPL1anClAFOCtHftDxbiiHQMDbCtHlVbiLFeIBlHOriX0vH0YfifS
Ky+9++hKVn7u3KDAV3qdx7g+rj6CjNs0z506oChGKdntfXJOFUS09jQ3AR02lVHk
LjIzWvVR00slD9u+3REQfN864Y+MnjzhYRX8NH5ox5zx7PQku2yaSuTUv0lkiV/X
7YHT2pf+Xj8atYgwz0VqycafJoytyZAigs8o7rOOoNplwPQV/nke1QPb68itVbYw
krcGswmoxKXxogPiLFkFmuAbVH++nEhMJkC7vxq+8AZ85Zoev/k3NbPpk1UavQHV
37zpV39g/84wDlnFmbqIOrYtw1PopTAGXYwaI+xnTg8qsy7MGtYVxqx3X0buMC+P
kqFSLFtYEBlh9T7wcqhnoBgAHIa7f7PTqctL9YNRffG7vYEan16xwzaKZ13XfHGH
Rjyk9yIwCUgNKyH/bsiqQ+5H38wF20n4HHoaz3Cjr2dk7ahu5KWIrl770Mb3WnQY
GJbBAvBapTjAf96j5wH21S5zfTEwR7Ie3jLkoEbSqJ1hH9G5W2k=
=HiYx
-----END PGP SIGNATURE-----

--Q/0uQaGPcHyO1sls--