Hi Thomas, [good reasons skipped]
> For all of these reasons, I'm lowering the severity of this bug to > "important". Sure. > Once all of Fuel is uploaded to Debian *and* fully usable, I will very > much welcome security audit of the whole thing. Until then, I don't > think it's very valuable to report issues just yet. It would still be good to fix it, as I've found only two examples of using PGPASSFILE in a shell script when I searched using codesearch.debian.net. It now sits there as a bad example... Probably the effort to fix it is less than to write an answer to this :-) I'd have sent a note to upstream, but didn't find an email address. Yours, Carsten
