Your message dated Wed, 22 Jul 2026 23:49:24 +0000
with message-id <[email protected]>
and subject line Bug#1141576: fixed in haskell-hopenpgp-tools 0.25-1
has caused the Debian Bug report #1141576,
regarding /usr/bin/hokey: hokey canonicalize output depends on version of
libghc-hashable-dev
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141576: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141576
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: hopenpgp-tools
Version: 0.23.11-1
Severity: normal
File: /usr/bin/hokey
X-Debbugs-Cc: [email protected], [email protected]
Hello,
I maintain a company-internal keyring with the certificates of my colleagues to
populate our WKD.
The certificates are tracked in git in their canonical order as defined
by `hokey canonicalize`.
Now I have with hokey 0.23.11-1 (and thus libghc-hashable-dev
1.4.4.0-1+b1):
hokey canonicalize < 7E845B82AD0A1E93 > 7E845B82AD0A1E93.canon
hokey (hopenpgp-tools) 0.23.11
Copyright (C) 2012-2023 Clint Adams
hokey comes with ABSOLUTELY NO WARRANTY. This is free software, and you
are welcome to redistribute it under certain conditions.
$ sha256sum baylibre-keyring/7E845B82AD0A1E93
baylibre-keyring/7E845B82AD0A1E93.canon
048d5a50c05562d219b4ed47d631810a4dc1f376d51e97c16c379e2923b08eb5
7E845B82AD0A1E93
048d5a50c05562d219b4ed47d631810a4dc1f376d51e97c16c379e2923b08eb5
7E845B82AD0A1E93.canon
So as expected the cert file doesn't change on canonicalizing again.
However if my colleague Clément (on Cc), who is using Arch btw, does the
same with hokey 0.23.11 linked against hashable 1.4.7.0, he gets:
$ sha256sum baylibre-keyring/7E845B82AD0A1E93
baylibre-keyring/7E845B82AD0A1E93.canon
048d5a50c05562d219b4ed47d631810a4dc1f376d51e97c16c379e2923b08eb5
7E845B82AD0A1E93
255da847cfeb96a6bb47624e83e9310183e3bd0a021f903c5d8de65e9a3c6085
7E845B82AD0A1E93.canon
.
Clément worked out the reason (with the help of Claude, so take it with
a grain of salt given that we're not fluent in Haskell):
Packet ordering bases on comparing hashes
(Codec/Encryption/OpenPGP/Types.hs, `instance Ord Pkt`) and canonicalize
sorts using that Ord instance. Now hashable changed byte hashing in
https://github.com/haskell-unordered-containers/hashable/pull/301 and
thus canonicalization changed.
IMHO canonicalization shouldn't depend on an (unstable) hashing
algorithm. It should at least be documented that canonicalization is
unstable, or better, canonicalization should be fixed to be independent
of hashing.
Best regards
Uwe
-- System Information:
Debian Release: 13.5
APT prefers stable-updates
APT policy: (750, 'stable-updates'), (750, 'stable-security'), (750,
'stable-debug'), (750, 'stable'), (700, 'oldstable-security'), (700,
'oldstable-debug'), (700, 'oldstable'), (600, 'unstable'), (500,
'unstable-debug'), (500, 'testing-debug'), (500, 'proposed-updates'), (500,
'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: arm64
Kernel: Linux 7.1.3+deb14-amd64 (SMP w/22 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages hopenpgp-tools depends on:
ii libbz2-1.0 1.0.8-6
ii libc6 2.42-17
ii libffi8 3.4.8-2
ii libgmp10 2:6.3.0+dfsg-3
ii libnettle8t64 3.10.2-1+b1
ii libnuma1 2.0.19-1
ii libyaml-0-2 0.2.5-2
ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1
hopenpgp-tools recommends no packages.
hopenpgp-tools suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: haskell-hopenpgp-tools
Source-Version: 0.25-1
Done: Clint Adams <[email protected]>
We believe that the bug you reported is fixed in the latest version of
haskell-hopenpgp-tools, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Clint Adams <[email protected]> (supplier of updated haskell-hopenpgp-tools
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 22 Jul 2026 18:55:02 -0400
Source: haskell-hopenpgp-tools
Architecture: source
Version: 0.25-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Haskell Group
<[email protected]>
Changed-By: Clint Adams <[email protected]>
Closes: 872271 931238 971474 1141576
Changes:
haskell-hopenpgp-tools (0.25-1) unstable; urgency=medium
.
* New upstream version.
- Changes `hokey canonicalize` ordering to not be
dependent on an underlying hash library.
closes: #1141576.
- Adds `hop verify`. closes: #872271.
- `hot armor` no longer emits Version header.
closes: #931238.
* Mark the autopkgtest as superficial. closes: #971474.
Checksums-Sha1:
c815157e280fe4bc7a283d14a36cddb97250a30a 3084 haskell-hopenpgp-tools_0.25-1.dsc
b228aea41ddda3d84f8225817ac2758427d27bee 83268
haskell-hopenpgp-tools_0.25.orig.tar.gz
f04ef55915d7613cd8110f7185c13c41868f9faa 14596
haskell-hopenpgp-tools_0.25-1.debian.tar.xz
f60da94ea5733f0c668b79ccdc60bc7bc66a79a9 14248
haskell-hopenpgp-tools_0.25-1_source.buildinfo
Checksums-Sha256:
3575f508ed09c3fbbe10d946e0a76692c63fa6c0243ddbc28e57fe205ac16404 3084
haskell-hopenpgp-tools_0.25-1.dsc
20f8ca76d3bf6afac2a3f0e63448a97279fe89ad51ffd2c41f04d881172395c0 83268
haskell-hopenpgp-tools_0.25.orig.tar.gz
4c3764fafe6512bd11a9e9666a082e4ef9d65b4662c4a7585d96b794ac4c0861 14596
haskell-hopenpgp-tools_0.25-1.debian.tar.xz
50fde031cfff17026c4fd0b9359efb62eb904cdb8a04312774304237588b9904 14248
haskell-hopenpgp-tools_0.25-1_source.buildinfo
Files:
0ff678ae8adfca088f1dd4f0578815bc 3084 haskell optional
haskell-hopenpgp-tools_0.25-1.dsc
cc44088b2179dd9326a62db1212a6c39 83268 haskell optional
haskell-hopenpgp-tools_0.25.orig.tar.gz
ab641517b6d34cc503d83952f59a60ee 14596 haskell optional
haskell-hopenpgp-tools_0.25-1.debian.tar.xz
35d41d9d7d92d42d88ab02156b2523ab 14248 haskell optional
haskell-hopenpgp-tools_0.25-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJqYVF0CRD200lbsK6aAkcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmdMVp8dat4DsJPm0NF4QVixoR1+t9u7h0yKcKXXakKn
7BYhBCEAoyxG+JWvOgh4OvbTSVuwrpoCAAAX5w//SHQehXh0jR6Rz9owmbQinFXN
gzqK4KEQps/WdQvGjLH6kTamkzTb0ZW2sl4r6JwVDCUCQkojdUJl5YJfZjLZ/iTu
+EDG0mSQ+CZMOsCa3gk2EEhnzte/XDGW0S5TyO+oNVKwmBH1OC6If6BcZnp8eeqD
M41/R+3Hjm6sUBlvKFWQn/5sPKD4eRLAh3RcXhbwX4pCM2oYuNWJ+f7nCmzlkHD4
vPXr6Y7xGIdG+XSxcl40v1KxQ6wkN2zBEK4BQ9/q3mN9pvbftNbEAExN5ZDoB8Fn
c/pWucr9wfThd8NqKZ7aK78unxYaZEcZV0ESU7OkJ6vdnGPBOn1Vmm/i9bQ/7oNY
iFGAbyIe7LfrJnxLtel4VBbAiTKjU2W8a1qNSqNzri20+fJQK8U8e+nTNW+qUcoT
Uq/CtQQOxJttfoZyBRvINESSZ4Dw1n0QtOHUTNtkkzN5iRiUXW0f3Jj4gjkGmQkn
8JQ4vAhm2KLpF1VIZg7V9ICqIWKCZn2QJsb8lnozMYEV0a5aMIabQGXM+PnC79S/
wWmPsiOhAiV+LYVgjbtdy2eYW93LAyAG+tk1supEnM4nuBAmN5kBolj24qMUZUAl
e8LSXMeuFTYj6u6xrRGB+dr0f/5G3YnoI95adRynby2LqwK24G3M3vD4gW19PO4e
KLCuvOeLbrsduVM1XgQ=
=4+Ya
-----END PGP SIGNATURE-----
pgpc2L5QM78VR.pgp
Description: PGP signature
--- End Message ---
