Package: mmdebstrap Version: 1.5.7-3 Severity: normal Moin josch,
as already discussed in IRC, I don't find a use case for gpgvnoexpkeysig and think it could be deprecated. According to mmdebstrap(1): | Example: This is necessary for allowing old timestamps from | snapshot.debian.org | | --aptopt='Acquire::Check-Valid-Until "false"' | --aptopt='Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' As well as: | Create a buildd tarball for EOL distro: | | $ mmdebstrap --include=apt --variant=buildd --aptopt \ | 'Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \ | --aptopt='Acquire::Check-Valid-Until "false"' \ | --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \ | --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older \ | jessie ~/.cache/sbuild/jessie-arm64.tar \ | http://archive.debian.org/debian Adding --aptopt Apt::Key::gpgvcommand has two consequences: 1. It is added to the outer apt config on the host system. 2. It is added to /etc/apt/apt.conf.d/99mmdebstrap inside the chroot. This is only needed when you want to use apt inside the chroot. Let's inspect 1. first: mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \ --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \ --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older jessie \ /dev/null http://archive.debian.org/debian as well as: mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \ --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \ --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older unstable \ /dev/null https://snapshot.debian.org/archive/debian/20131012T160100Z/ works just fine here. I was not able to test older then 20131012T160100Z even with gpgvnoexpkeysig. So with a recent apt 1. gpgvnoexpkeysig is not needed. It is also problematic because it tries to call gpgv but there is not direct dependency to it so on a system without gpgv installs it fails with: W: http://snapshot.debian.org/archive/debian/20260824T022231Z/dists/unstable/InRelease: Loading /etc/apt/trusted.gpg from deprecated option Dir::Etc::Trusted W: Signature verification failed: http://snapshot.debian.org/archive/debian/20260824T022231Z unstable InRelease: GPG: gpgv executable not found E: The repository 'http://snapshot.debian.org/archive/debian/20260824T022231Z unstable InRelease' is not signed. Which is not obvious. For 2. the problem is that gpgvnoexpkeysig would need to exist inside the chroot, which is not normally the case and the mmdebstrap versions in older releases does not even provide it. So I think the real command should be something like: --customize-hook='copy-in /usr/libexec/mmdebstrap/gpgvnoexpkeysig /tmp' But a quick search did not find any prior reference so I don't think anyone is doing that. I also tried to find out if it was needed in older releases but even this fails with KEYEXPIRED: mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \ --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \ --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older jessie \ --customize-hook='copy-in /usr/libexec/mmdebstrap/gpgvnoexpkeysig /tmp' --aptopt='Apt::Key::gpgvcommand "/tmp/gpgvnoexpkeysig"' --chrooted-customize-hook='apt update' /dev/null http://archive.debian.org/debian Do you have any example where gpgvnoexpkeysig is needed? If not, my proposal would be to make it a noop and drop it form mmdebstrap(1). Related, I think we should also drop it from being used in debootsnap by default. Given that gpgv would be required outside (1.) nor gpgvnoexpkeysig being installed inside the chroot I don't see a case for having it. In case you have a use case I would opt for an extra argument to add it. Cheers Jochen P.S.: Given all this I am also confident that it is not needed by debrebuild, so dropping from debootsnap should not break reproduce.d.n :).
