On 08/22/2010 12:46 AM, Carsten Hey wrote:
By removing the (currently indirect) apt dependencies on gnupg and libusb-0.1-4 and making apt depend on gpgv (or gpgv | gpgv-tiny) instead, 5272 kB could be saved. There are ways to accomplish this for Squeeze+1, how it could be done seems to be nothing that needs to be discussed before Squeeze is released.
Please note that, due to how apt currently handles keyrings, you do need a full gnupg available to run apt-key. The use of gpgv is only implemented in the installer, as it uses only one keyring file. An alternative might be looping over several keyrings using gpgv, to verify the signature, instead of using a large one. But this wasn't implemented yet, of course.
Kind regards, Philipp Kern