Re: python-apt gnupg dependency

[<harald@a-little-linux-box.at>]

Hello Julian,

On Fri, Oct 07, 2016 at 09:33:51PM +0200, Julian Andres Klode wrote:

first thanks for the prompt reply and the good work you do!

> python-apt's apt.auth module uses the gpg binary.

Does this hold true for both python-apt and python3-apt? I ask because
the python3-apt package lacks any depedency on gnupg, wether it's
version 1 or 2...

> It should work with
> both versions,

Ok thanks for the info so in case I may just do a local rebuild with a
changed control file.

> but I don't want to add a fallback to an old gpg version
> for a module we have to deprecate anyway.

While I think you have a valid point I think python-apt can't go away so
fast:

apt-rdepends -r python-apt
Reading package lists... Done
Building dependency tree
Reading state information... Done
python-apt
  Reverse Depends: apprecommender (0.6.2.3-1)
  Reverse Depends: apt-forktracer (>= 0.5)
  Reverse Depends: apt-p2p (>= 0.1.8)
  Reverse Depends: apt-transport-spacewalk (1.0.6-4.1)
  Reverse Depends: apt-xapian-index (>= 0.48)
  Reverse Depends: aptoncd (>= 0.1.98+bzr117-1.4)
  Reverse Depends: bcfg2 (>= 1.4.0~pre1+git18-gea63477-1)
  Reverse Depends: bzr-builddeb (2.8.10)
  Reverse Depends: dblatex (0.3.8-1)
  Reverse Depends: debpartial-mirror (>= 0.3.1+nmu1)
  Reverse Depends: debsecan (0.4.18)
  Reverse Depends: isenkram (0.27)
  Reverse Depends: mini-dinstall (>= 0.6.30)
  Reverse Depends: ovirt-guest-agent (1.0.12.2.dfsg-1)
  Reverse Depends: piuparts-common (0.72)
  Reverse Depends: python-apport (>= 2.19.3-1)
  Reverse Depends: python-apt-dbg (= 1.1.0~beta5)
  Reverse Depends: python-apt-dev (>= 1.1.0~beta5)
  Reverse Depends: python-cdd (>= 0.0.11+nmu1)
  Reverse Depends: python-dogtail (>= 0.9.9-1)
  Reverse Depends: python-germinate (>= 2.25)
  Reverse Depends: python-linaro-image-tools (2016.05-1)
  Reverse Depends: rebuildd (>= 0.4.2)
  Reverse Depends: reportbug-ng (>= 2.1)
  Reverse Depends: rhn-client-tools (>= 2.3.5-1)
  Reverse Depends: salt-common (2016.3.2+ds-1)
  Reverse Depends: ubuntu-dev-tools (>= 0.157)
  Reverse Depends: xdeb (>= 0.6.6)

And gnupg1 is still actively maintainend, at least it receives security
updates:

Security fixes for Libgcrypt and GnuPG 1.4 (2016-08-17)   important

A bug in the random number generator of Libgcrypt and in GnuPG 1.4 has
been found. Updating the software is highly suggested. Please read this
mail for details. Note that the CVE id in that mail is not correct, the
correct one is CVE-2016-6313.

So maybe you could rethink your decision as IMHO gnupg1 provides a much
smaller footprint than gnupg2 (no agent or dirmanager)?

My suggestion would be:

Depends: ..., gnupg | gnupg1, dirmngr | gnupg1

Kind regards
Harald Jenny