Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1263861 > unrolled thread

Bug#1116659: git-debpush: Please depend on gpg instead of gnupg

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1116659: git-debpush: Please depend on gpg instead of gnupg Paride Legovini <paride@debian.org> - 2025-09-29 23:00 +0200
    Bug#1116659: git-debpush: Please depend on gpg instead of gnupg Sean Whitton <spwhitton@spwhitton.name> - 2025-09-29 23:40 +0200
      Bug#1116659: git-debpush: Please depend on gpg instead of gnupg Paride Legovini <paride@debian.org> - 2025-09-30 22:10 +0200
        Bug#1116659: git-debpush: Please depend on gpg instead of gnupg Ian Jackson <ijackson@chiark.greenend.org.uk> - 2025-09-30 23:10 +0200
          Bug#1116659: git-debpush: Please depend on gpg instead of gnupg Sean Whitton <spwhitton@spwhitton.name> - 2025-10-01 12:40 +0200
            Bug#1116659: git-debpush: Please depend on gpg instead of gnupg Paride Legovini <paride@debian.org> - 2025-10-01 19:00 +0200
              Bug#1116659: git-debpush: Please depend on gpg instead of gnupg Sean Whitton <spwhitton@spwhitton.name> - 2025-10-02 19:30 +0200
                Bug#1116659: git-debpush: Please depend on gpg instead of gnupg Ian Jackson <ijackson@chiark.greenend.org.uk> - 2025-10-02 20:10 +0200
          Bug#1116659: git-debpush: Please depend on gpg instead of gnupg Sean Whitton <spwhitton@spwhitton.name> - 2025-10-02 13:50 +0200

#1263861 — Bug#1116659: git-debpush: Please depend on gpg instead of gnupg

Package: git-debpush
Version: 13.15
Severity: normal
X-Debbugs-Cc: paride@debian.org

Dear Maintainer,

Please consider replacing the dependency on the gnupg metapackage
(Depends: gnupg) with a dependency on individual GnuPG tools (gpg
and possibly others, if needed). This will allow using git-debpush
with gpg-from-sq, which does not (and should not) provide gnupg.

Cheers,

Paride

[toc] | [next] | [standalone]

#1263864

[Multipart message — attachments visible in raw view] — view raw

Hello,

On Mon 29 Sep 2025 at 10:55pm +02, Paride Legovini wrote:

> Package: git-debpush
> Version: 13.15
> Severity: normal
> X-Debbugs-Cc: paride@debian.org
>
> Dear Maintainer,
>
> Please consider replacing the dependency on the gnupg metapackage
> (Depends: gnupg) with a dependency on individual GnuPG tools (gpg
> and possibly others, if needed). This will allow using git-debpush
> with gpg-from-sq, which does not (and should not) provide gnupg.

Interesting!

I don't think we don't invoke gpg directly, but only via git.

The description of bin:gpg says that bin:gpg won't be enough, because we
need to make signatures, which is a secret key-involving operation.

There are a large number of binary packages built by src:gnupg2.
I'm not sure which we need to depend on, and I'm not sure how good a job
our CI will do at telling us which are needed, because there are such a
variety of user configurations.

So help here would be appreciated.

-- 
Sean Whitton

[toc] | [prev] | [next] | [standalone]

#1264211

On 2025-09-29 23.34, Sean Whitton wrote:
> Hello,
> 
> On Mon 29 Sep 2025 at 10:55pm +02, Paride Legovini wrote:
> 
>> Package: git-debpush
>> Version: 13.15
>> Severity: normal
>> X-Debbugs-Cc: paride@debian.org
>>
>> Dear Maintainer,
>>
>> Please consider replacing the dependency on the gnupg metapackage
>> (Depends: gnupg) with a dependency on individual GnuPG tools (gpg
>> and possibly others, if needed). This will allow using git-debpush
>> with gpg-from-sq, which does not (and should not) provide gnupg.
> 
> Interesting!
> 
> I don't think we don't invoke gpg directly, but only via git.
> 
> The description of bin:gpg says that bin:gpg won't be enough, because we
> need to make signatures, which is a secret key-involving operation.
> 
> There are a large number of binary packages built by src:gnupg2.
> I'm not sure which we need to depend on, and I'm not sure how good a job
> our CI will do at telling us which are needed, because there are such a
> variety of user configurations.

For signing, gpg and gpg-agent are enough. Note that having gpg-agent
does not defeat the purpose of gpg-from-sq: actually gpg-agent is
*needed* for secret key operations like signing: gpg-from-sq will
interface to it.

Thanks,

Paride

[toc] | [prev] | [next] | [standalone]

#1264216

Paride Legovini writes ("Bug#1116659: git-debpush: Please depend on gpg instead of gnupg"):
> For signing, gpg and gpg-agent are enough. Note that having gpg-agent
> does not defeat the purpose of gpg-from-sq: actually gpg-agent is
> *needed* for secret key operations like signing: gpg-from-sq will
> interface to it.

To be clear, I think you are saying we should replace
  Depends: ..., gnupg, ...
with
  Depends: ..., gpg | gnupg, gpg-agent | gnupg, ...
?

We also have this:
  Package: dgit-infrastructure
  Depends: ..., gpgv, ...
Do you know if there is a gpgv-work-a-like that uses SOP and if so
what we should put here?

Ian.

-- 
Ian Jackson <ijackson@chiark.greenend.org.uk>   These opinions are my own.  

Pronouns: they/he.  If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.

[toc] | [prev] | [next] | [standalone]

#1264261

[Multipart message — attachments visible in raw view] — view raw

Hello,

On Tue 30 Sep 2025 at 10:02pm +01, Ian Jackson wrote:

> Paride Legovini writes ("Bug#1116659: git-debpush: Please depend on gpg instead of gnupg"):
>> For signing, gpg and gpg-agent are enough. Note that having gpg-agent
>> does not defeat the purpose of gpg-from-sq: actually gpg-agent is
>> *needed* for secret key operations like signing: gpg-from-sq will
>> interface to it.
>
> To be clear, I think you are saying we should replace
>   Depends: ..., gnupg, ...
> with
>   Depends: ..., gpg | gnupg, gpg-agent | gnupg, ...
> ?

No, I think just 'gpg, gpg-agent' without the alternatives.

gnupg is just a metapackage.

-- 
Sean Whitton

[toc] | [prev] | [next] | [standalone]

#1264291

On 2025-10-01 12.33, Sean Whitton wrote:
> Hello,
> 
> On Tue 30 Sep 2025 at 10:02pm +01, Ian Jackson wrote:
> 
>> Paride Legovini writes ("Bug#1116659: git-debpush: Please depend on gpg instead of gnupg"):
>>> For signing, gpg and gpg-agent are enough. Note that having gpg-agent
>>> does not defeat the purpose of gpg-from-sq: actually gpg-agent is
>>> *needed* for secret key operations like signing: gpg-from-sq will
>>> interface to it.
>>
>> To be clear, I think you are saying we should replace
>>   Depends: ..., gnupg, ...
>> with
>>   Depends: ..., gpg | gnupg, gpg-agent | gnupg, ...
>> ?
> 
> No, I think just 'gpg, gpg-agent' without the alternatives.
> 
> gnupg is just a metapackage.

Yes, that would be it, thanks.

--
Paride

[toc] | [prev] | [next] | [standalone]

#1264421

[Multipart message — attachments visible in raw view] — view raw

Ian,

I just tried changing the dependency and running autopkgtest.
It passes.  Shall we go ahead?  It's possible that this will still break
things for people but we can easily add more dependencies if so, and of
course the local fix is very easy.

-- 
Sean Whitton

[toc] | [prev] | [next] | [standalone]

#1264430

Sean Whitton writes ("Re: Bug#1116659: git-debpush: Please depend on gpg instead of gnupg"):
> I just tried changing the dependency and running autopkgtest.
> It passes.  Shall we go ahead?  It's possible that this will still break
> things for people but we can easily add more dependencies if so, and of
> course the local fix is very easy.

Yes, let's.  Now is the right time to do this.

Ian.

-- 
Ian Jackson <ijackson@chiark.greenend.org.uk>   These opinions are my own.  

Pronouns: they/he.  If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.

[toc] | [prev] | [next] | [standalone]

#1264379

[Multipart message — attachments visible in raw view] — view raw

Hello,

On Tue 30 Sep 2025 at 10:02pm +01, Ian Jackson wrote:

> We also have this:
>   Package: dgit-infrastructure
>   Depends: ..., gpgv, ...
> Do you know if there is a gpgv-work-a-like that uses SOP and if so
> what we should put here?

I know it exists because it is what apt uses, from trixie onwards.

There is a package sopv-gpgv that installs it to /usr/bin/sopv.

In the absence of some gpgv-is-sopv package, maybe we could depend on
sopv-gpgv|gpgv and look for whether /usr/bin/sopv exists, falling back
to /usr/bin/gpgv if it does not?

-- 
Sean Whitton

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web