* Johannes Schauer Marin Rodrigues <[email protected]> [2026-10-07 15:54]:
Quoting Jochen Sprickerhof (2026-09-15 15:38:17)Adding --aptopt Apt::Key::gpgvcommand has two consequences:1. It is added to the outer apt config on the host system.this sounds like it is added to the /etc of the system running mmdebstrap but this is not the case.
Right, I meant that it is added to the mmdebstrap apt config that is used when mmdebstrap uses the host system apt to do the initial bootstrap.
Indeed it seems more is needed with modern versions of apt. In addition to what the mmdebstrap man page says, these days you also must convince apt that SHA1 is fine: --aptopt='APT::Hashes::SHA1::Weak "yes"' I have the man page adjusted accordingly in git. If you do this, you can go back as far as 2009-05-23T21:38:52Z. If you try to go further back you get:
Thanks for pointing that out! Feel free to close this bug with that change.
Yes, but I wouldn't make gpgv a dependency. At maximum I'd make it a Suggests. The error message says "gpgv executable not found" which I find a error message which is good enough to understand that gpgv must be installed for this to work.
I think documenting the dependency next to how and when to use gpgvnoexpkeysig is enough.
Yes, this is because mmdebstrap is used like this with ancient timestamps only in debbisect which throws away the chroot after it created it, so there is never an "apt update" happening. If you want to keep the ancient chroot to work with it later then yes, you'd need gpgvnoexpkeysig. I haven't heard yet of anybody who has a use-case for doing that.
Not really a use case but rust-rust-apt 0.11.3-2 added a gpgv dependency so it works in debrebuild with gpgvnoexpkeysig.
I don't think it's needed for debrebuild because you never want to rebuild anything in snapshot timestamps from 2013 or earlier.
I will open an MR for that later.
Since there seems to be a use-case for gpgvnoexpkeysig for timestamps of Debian unstable (the timestamps differ for other suites) between 2009-05-23T21:38:52Z and 2013-10-12T13:01:34Z what is the argument to remove the utility. Where does its existence in the mmdebstrap codebase cause problems?
It is fine and we should keep it. Thanks! Jochen
signature.asc
Description: PGP signature
