stable" status, with 2.4.9 now labeled "oldstable" on the download page (https://gnupg.org/download/index.html). Werner Koch's release announcement for 2.5.19 explicitly states that "the old 2.4 series reaches end-of-life in just two months" and urges users to update (https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html). The EOL date for 2.4 is 2026-06-30 per the GnuPG EOL table. This is a departure from Arch Linux, which still ships 2.4.9 as of this writing. Arch's gnupg maintainer has historically waited for upstream to fully stabilize major branches before upgrading, and GnuPG is particularly sensitive because pacman depends on it for package signature verification. However, with upstream now unambiguously designating 2.5.19 as the stable release and 2.4's EOL imminent, there is no reason to wait. Note that GnuPG 2.5 was initially considered a development branch. In March 2025, an earlier attempt to upgrade to 2.5.5 was abandoned for exactly this reason (git-for-windows/git#5471, msys2#5244). The promotion to stable happened around the 2.5.16 release in late December 2025. The main new features in the 2.5 series compared to 2.4 are support for Kyber (ML-KEM / FIPS-203) post-quantum cryptography encryption and improvements for 64-bit Windows. Beyond PQC, the differences from 2.4 are mostly internal, leveraging newer features from supporting libraries. Full compatibility with previous versions is maintained. The freepg patch set (https://gitlab.com/freepg/gnupg/-/tree/main) has been switched from the STABLE-BRANCH-2-4 series to the master-freepg series, which tracks the 2.5/master branch. This changes the patch numbering and composition: Patches dropped (no longer needed for 2.5): - "tests: add test cases for import without uid" (test files, test script, and Makefile.am reference are all present in 2.5.19 upstream) - "Sync compliance mode cleanup with master" (was a backport from master to 2.4; unnecessary when building master directly) - "Do not use a default when asking for another output filename" (upstreamed in GnuPG 2.5.14, see https://dev.gnupg.org/T7908) New patches added for the master series: - 0028: Revert the removal of the default keyserver - 0040: Add missing test files to EXTRA_DIST - 0041: Skip trust packets during import/restore (gpg.fail mitigation) - 0042: Compat flag to downgrade truncated-line errors to warnings - 0043: Fail on unprintable armor headers (gpg.fail mitigation) The freepg 0042 patch as distributed has a bug: it defines COMPAT_IGNORE_TRUNCATED_LINE as 32, which collides with the upstream COMPAT_ALLOW_NOT_DASH_ESCAPED flag (also 32, added in 2.5.15). This has been fixed locally by changing the value to 64. The avoid_beta_warning patch has been refreshed against the 2.5.19 autogen.sh, which has new context (a $matchexcl variable and a cid field in the non-git code path) compared to 2.4. The patch was renamed from gnupg-2.4-avoid_beta_warning.patch to gnupg-2.5-avoid_beta_warning.patch to reflect the new target version. The MSYS2-specific patch (0001-gnupg-2.2.8-msys2.patch) applies cleanly; the permission check it relaxes (S_IRWXG|S_IRWXO to S_IWGRP|S_IWOTH in the homedir validation) is unchanged in 2.5.19. The --enable-maintainer-mode configure flag has been dropped. It caused make to re-run autotools when timestamps did not match, which fails when the installed automake version differs from the one used to generate the tarball. The autogen.sh --force call in prepare() already regenerates everything needed after patches are applied, so maintainer mode is not needed. Assisted-by: Claude Opus 4.6 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Commits

Commits on Apr 26, 2026

gnupg: Update to v2.5.19