Your message dated Thu, 08 Oct 2026 06:17:14 +0200
with message-id <179143303444.21057.15731531746072031491@localhost>
and subject line Re: Bug#1147931: mmdebstrap: deprecate use of gpgvnoexpkeysig
has caused the Debian Bug report #1147931,
regarding mmdebstrap: deprecate use of gpgvnoexpkeysig
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147931: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147931
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: mmdebstrap
Version: 1.5.7-3
Severity: normal
Moin josch,
as already discussed in IRC, I don't find a use case for gpgvnoexpkeysig
and think it could be deprecated. According to mmdebstrap(1):
| Example: This is necessary for allowing old timestamps from
| snapshot.debian.org
|
| --aptopt='Acquire::Check-Valid-Until "false"'
| --aptopt='Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"'
As well as:
| Create a buildd tarball for EOL distro:
|
| $ mmdebstrap --include=apt --variant=buildd --aptopt \
| 'Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \
| --aptopt='Acquire::Check-Valid-Until "false"' \
| --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
| --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older \
| jessie ~/.cache/sbuild/jessie-arm64.tar \
| http://archive.debian.org/debian
Adding --aptopt Apt::Key::gpgvcommand has two consequences:
1. It is added to the outer apt config on the host system.
2. It is added to /etc/apt/apt.conf.d/99mmdebstrap inside the chroot.
This is only needed when you want to use apt inside the chroot.
Let's inspect 1. first:
mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \
--keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
--hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older jessie \
/dev/null http://archive.debian.org/debian
as well as:
mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \
--keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
--hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older unstable \
/dev/null https://snapshot.debian.org/archive/debian/20131012T160100Z/
works just fine here. I was not able to test older then 20131012T160100Z
even with gpgvnoexpkeysig.
So with a recent apt 1. gpgvnoexpkeysig is not needed. It is also
problematic because it tries to call gpgv but there is not direct
dependency to it so on a system without gpgv installs it fails with:
W:
http://snapshot.debian.org/archive/debian/20260824T022231Z/dists/unstable/InRelease:
Loading /etc/apt/trusted.gpg from deprecated option Dir::Etc::Trusted
W: Signature verification failed:
http://snapshot.debian.org/archive/debian/20260824T022231Z unstable InRelease:
GPG: gpgv executable not found
E: The repository 'http://snapshot.debian.org/archive/debian/20260824T022231Z
unstable InRelease' is not signed.
Which is not obvious.
For 2. the problem is that gpgvnoexpkeysig would need to exist inside
the chroot, which is not normally the case and the mmdebstrap versions
in older releases does not even provide it. So I think the real command
should be something like:
--customize-hook='copy-in /usr/libexec/mmdebstrap/gpgvnoexpkeysig /tmp'
But a quick search did not find any prior reference so I don't think
anyone is doing that.
I also tried to find out if it was needed in older releases but even
this fails with KEYEXPIRED:
mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \
--keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
--hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older jessie \
--customize-hook='copy-in /usr/libexec/mmdebstrap/gpgvnoexpkeysig /tmp'
--aptopt='Apt::Key::gpgvcommand "/tmp/gpgvnoexpkeysig"'
--chrooted-customize-hook='apt update'
/dev/null http://archive.debian.org/debian
Do you have any example where gpgvnoexpkeysig is needed?
If not, my proposal would be to make it a noop and drop it form
mmdebstrap(1).
Related, I think we should also drop it from being used in debootsnap by
default. Given that gpgv would be required outside (1.) nor
gpgvnoexpkeysig being installed inside the chroot I don't see a case for
having it. In case you have a use case I would opt for an extra argument
to add it.
Cheers Jochen
P.S.: Given all this I am also confident that it is not needed by
debrebuild, so dropping from debootsnap should not break reproduce.d.n :).
--- End Message ---
--- Begin Message ---
Quoting Jochen Sprickerhof (2026-10-08 05:39:51)
> >Indeed it seems more is needed with modern versions of apt. In addition to
> >what the mmdebstrap man page says, these days you also must convince apt that
> >SHA1 is fine:
> >
> > --aptopt='APT::Hashes::SHA1::Weak "yes"'
> >
> >I have the man page adjusted accordingly in git. If you do this, you can go
> >back as far as 2009-05-23T21:38:52Z. If you try to go further back you get:
>
> Thanks for pointing that out! Feel free to close this bug with that
> change.
I'm closing this bug now. This bug was a request for removal of gpgvnoexpkeysig
(which seems to not be needed) not about a need for documentation of how to go
as far back as 2009 on snapshot.d.o.
> >Yes, but I wouldn't make gpgv a dependency. At maximum I'd make it a
> >Suggests.
> >The error message says "gpgv executable not found" which I find a error
> >message
> >which is good enough to understand that gpgv must be installed for this to
> >work.
>
> I think documenting the dependency next to how and when to use
> gpgvnoexpkeysig is enough.
I now have the following paragraph in the man page:
The "gpgvnoexpkeysig" script requires the gpgv utility and is no longer
required for snapshots of Debian unstable of "2013-10-12T16:01:00Z" and later.
> >Yes, this is because mmdebstrap is used like this with ancient timestamps
> >only
> >in debbisect which throws away the chroot after it created it, so there is
> >never an "apt update" happening. If you want to keep the ancient chroot to
> >work
> >with it later then yes, you'd need gpgvnoexpkeysig. I haven't heard yet of
> >anybody who has a use-case for doing that.
>
> Not really a use case but rust-rust-apt 0.11.3-2 added a gpgv dependency
> so it works in debrebuild with gpgvnoexpkeysig.
That's this MR, no?
https://salsa.debian.org/rust-team/debcargo-conf/-/merge_requests/1405
It seems that got added to satisfy an upstream test requirement and not because
of mmdebstrap or gpgvnoexpkeysig? The error message in the MR text is
Internal error: Cannot find gpgv
The error message you get from mmdebstrap with gpgvnoexpkeysig is different and
you mention it in your bug report:
GPG: gpgv executable not found
> >I don't think it's needed for debrebuild because you never want to rebuild
> >anything in snapshot timestamps from 2013 or earlier.
>
> I will open an MR for that later.
Yes. I don't think debrebuild should require this. On the other hand debbisect
should.
> >Since there seems to be a use-case for gpgvnoexpkeysig for timestamps of
> >Debian unstable (the timestamps differ for other suites) between
> >2009-05-23T21:38:52Z and 2013-10-12T13:01:34Z what is the argument to remove
> >the utility. Where does its existence in the mmdebstrap codebase cause
> >problems?
>
> It is fine and we should keep it.
Thank you for opening this bug! This made me find the new
APT::Hashes::SHA1::Weak requirement and the man page is improved now.
Thanks!
cheers, josch
signature.asc
Description: signature
--- End Message ---
