Debian package is old

[balazser]

Hi,
I've installed gocryptfs from Debian repository and noticed the package version is 1.6.1.
I'm wondering at some point should the package be updated?

apt info gocryptfs

Package: gocryptfs
Version: 1.6.1-1+b20

I'm using Debian Buster right now. After building the package manually I could achieve a recent version.
gocryptfs v2.0.1-40-gc6b0c77

[lechner]

@balazser The bullseye release will ship version 1.8.0. Meanwhile, the freeze disallows uploads with new features until bullseye is finalized. Do you need features that are available only in more recent versions?

[rfjakob]

Only notable new features in v2.0 are fido2 and acl support. Unless you need these, v1.8 is fine.

v1.6.1 on the other hand has known bugs, highest impact is this (from the v1.7.1 changelog):

Fix a race condition related to inode number reuse (#363). It could be triggered by concurrently creating and deleting files and can lead to data loss in the affected file. This bug was found by the automated tests on Travis and was very hard to trigger locally.

[rfjakob]

In any case, you can also build yourself or download a static binary from https://github.com/rfjakob/gocryptfs/releases/tag/v2.0.1