Kunal Mehta

@zenmonkeykstop [said](https://github.com/freedomofpress/securedrop/issues/6399#issuecomment-1190193835): > The downside of both options is that we can't really define a cutoff for removal of the old gpg code - it will be hard to verify...

The private key format is documented at https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob_plain;f=agent/keyformat.txt I looked around a bit and didn't find any independent parsers for it (aside from gpg itself). There's an open ticket for...

Oooh, reproducible builds is a good point. Mostly agreed with your priority list, except for the Documentation point, I think that should be towards the top. It already does mostly...

I spent a while looking into the various post-update hooks apt and dpkg provide (https://unix.stackexchange.com/questions/226993/whats-the-difference-between-dpkgpost-invoke-and-dpkgpost-invoke-success has a good explanation) and I don't think there's a great point for us to...

> This would also not catch if the SD instance is booted into an older kernel, but has the new one installed. I take this part back, Python knows the...

* cross-linking #972

re, mypy, the biggest cause of warnings is save_session types session as a SessionMixin rather than RedisSession. Switching that gets rid of most of the errors. There are also (at...

> I am not sure how to resolve this one. Flask docs specifically says that `open_session()` should return a session object or None if impossible. https://tedboy.github.io/flask/interface_api.session_interface.html The correct docs link...

Did a quick skim through, I think we're mostly ready to move this forward? * There are still a few unaddressed comments from @nabla-c0d3 that we should get to. *...

We should remove the "Rebase:" prefix from the commit messages, otherwise I have no other comments!