Hi, Quoting Jochen Sprickerhof (2026-09-15 15:38:17) > Adding --aptopt Apt::Key::gpgvcommand has two consequences: > > 1. It is added to the outer apt config on the host system.
this sounds like it is added to the /etc of the system running mmdebstrap but this is not the case. > 2. It is added to /etc/apt/apt.conf.d/99mmdebstrap inside the chroot. > This is only needed when you want to use apt inside the chroot. > > Let's inspect 1. first: > > mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \ > --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \ > --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older jessie \ > /dev/null http://archive.debian.org/debian > > as well as: > > mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \ > --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \ > --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older unstable \ > /dev/null https://snapshot.debian.org/archive/debian/20131012T160100Z/ > > works just fine here. I was not able to test older then 20131012T160100Z > even with gpgvnoexpkeysig. Indeed it seems more is needed with modern versions of apt. In addition to what the mmdebstrap man page says, these days you also must convince apt that SHA1 is fine: --aptopt='APT::Hashes::SHA1::Weak "yes"' I have the man page adjusted accordingly in git. If you do this, you can go back as far as 2009-05-23T21:38:52Z. If you try to go further back you get: W: https://snapshot.debian.org/archive/debian/20090523T161634Z/dists/unstable/Release.gpg: Signature by key A99951DAF9BB569BDB50AD90A70DAF536070D3A1 uses weak algorithm (SHA1) W: Signature verification failed: https://snapshot.debian.org/archive/debian/20090523T161634Z unstable Release: The following signatures were invalid: A99951DAF9BB569BDB50AD90A70DAF536070D3A1 (untrusted public key algorithm: dsa1024) I did not manage to find out how to convince apt that dsa1024 is okay. Maybe it's impossible with modern apt. > So with a recent apt 1. gpgvnoexpkeysig is not needed. It is also > problematic because it tries to call gpgv but there is not direct > dependency to it so on a system without gpgv installs it fails with: > > W: > http://snapshot.debian.org/archive/debian/20260824T022231Z/dists/unstable/InRelease: > Loading /etc/apt/trusted.gpg from deprecated option Dir::Etc::Trusted > W: Signature verification failed: > http://snapshot.debian.org/archive/debian/20260824T022231Z unstable > InRelease: GPG: gpgv executable not found > E: The repository 'http://snapshot.debian.org/archive/debian/20260824T022231Z > unstable InRelease' is not signed. > > Which is not obvious. Yes, but I wouldn't make gpgv a dependency. At maximum I'd make it a Suggests. The error message says "gpgv executable not found" which I find a error message which is good enough to understand that gpgv must be installed for this to work. > For 2. the problem is that gpgvnoexpkeysig would need to exist inside > the chroot, which is not normally the case and the mmdebstrap versions > in older releases does not even provide it. So I think the real command > should be something like: > > --customize-hook='copy-in /usr/libexec/mmdebstrap/gpgvnoexpkeysig /tmp' > > But a quick search did not find any prior reference so I don't think > anyone is doing that. Yes, this is because mmdebstrap is used like this with ancient timestamps only in debbisect which throws away the chroot after it created it, so there is never an "apt update" happening. If you want to keep the ancient chroot to work with it later then yes, you'd need gpgvnoexpkeysig. I haven't heard yet of anybody who has a use-case for doing that. > I also tried to find out if it was needed in older releases but even > this fails with KEYEXPIRED: > > mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \ > --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \ > --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older jessie \ > --customize-hook='copy-in /usr/libexec/mmdebstrap/gpgvnoexpkeysig /tmp' > --aptopt='Apt::Key::gpgvcommand "/tmp/gpgvnoexpkeysig"' > --chrooted-customize-hook='apt update' > /dev/null http://archive.debian.org/debian > > Do you have any example where gpgvnoexpkeysig is needed? Yes, consider this: $ mmdebstrap --arch=i386 --variant=apt unstable /dev/null --aptopt \ 'Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \ --aptopt='APT::Hashes::SHA1::Weak "yes"' \ --aptopt='Acquire::Check-Valid-Until "false"' \ --aptopt='APT::Snapshot "20090523T213852Z"' \ --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \ --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older Remove the Apt::Key::gpgvcommand option and the above will fail with: W: Signature verification failed: https://snapshot.debian.org/archive/debian/20090523T213852Z unstable Release: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 150C8614919D8446E01E83AF9AA38DCD55BE302B is not bound: No binding signature at time 2009-05-23T20:54:07Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z E: The repository 'https://snapshot.debian.org/archive/debian/20090523T213852Z unstable Release' is not signed. The first Debian unstable snapshot timestamp which does not require gpgvnoexpkeysig is 2013-10-12T16:01:00Z. > If not, my proposal would be to make it a noop and drop it form > mmdebstrap(1). > > Related, I think we should also drop it from being used in debootsnap by > default. Given that gpgv would be required outside (1.) nor > gpgvnoexpkeysig being installed inside the chroot I don't see a case for > having it. In case you have a use case I would opt for an extra argument > to add it. > > Cheers Jochen > > P.S.: Given all this I am also confident that it is not needed by > debrebuild, so dropping from debootsnap should not break reproduce.d.n :). I don't think it's needed for debrebuild because you never want to rebuild anything in snapshot timestamps from 2013 or earlier. Since there seems to be a use-case for gpgvnoexpkeysig for timestamps of Debian unstable (the timestamps differ for other suites) between 2009-05-23T21:38:52Z and 2013-10-12T13:01:34Z what is the argument to remove the utility. Where does its existence in the mmdebstrap codebase cause problems? Thanks! cheers, josch
signature.asc
Description: signature
