Devuan bug report logs - #895
devuan-keyring: recommends gnupg; can we have a minimal devuan-archive-keyring?

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.devuan.org (full text, mbox, reply):

Package: devuan-keyring
Version: 2022.09.04
Severity: wishlist

Dear Maintainer,

I upgraded a minimal Debian Bullseye VM to Devuan Chimaera and it pulled
in gnupg and friends, which some years later pulled in an MTA on
upgrading to Excalibur and suddenly didn't look so minimal.

Obviously I should have installed the keyring with
--no-install-recommends, but it would be nice if there were a
devuan-archive-keyring package along the lines of debian-archive-keyring
that did not have this recommends.

Any reason this isn't already the case? I see that the package only
includes archive keyrings anyway.

Thanks!

Message #8 received at 895@bugs.devuan.org (full text, mbox, reply):

Andrew,

Thanks for this.

On Mon, Jun 23, 2025 at 07:37:41PM +0100, Andrew Bower wrote:
> but it would be nice if there were a devuan-archive-keyring package along the
> lines of debian-archive-keyring that did not have this recommends.
> 
> Any reason this isn't already the case? I see that the package only
> includes archive keyrings anyway.

I think a few individual keys are in /usr/share/keyrings/devuan-keyring.gpg as
well.

I suspect the answer is that, there are so few individual keys that it has never
seemed worth separating them. The packaging metainfo would probably be larger
than the content!

Since gnupg is only Recommends, is it worth it?

Mark

Message #13 received at 895@bugs.devuan.org (full text, mbox, reply):

Thanks for the quick reply, Mark!

On Mon, Jun 23, 2025 at 08:02:26PM +0100, Mark Hindley wrote:
> On Mon, Jun 23, 2025 at 07:37:41PM +0100, Andrew Bower wrote:
> > but it would be nice if there were a devuan-archive-keyring package along the
> > lines of debian-archive-keyring that did not have this recommends.
> > 
> > Any reason this isn't already the case? I see that the package only
> > includes archive keyrings anyway.
> 
> I think a few individual keys are in /usr/share/keyrings/devuan-keyring.gpg as
> well.
> 
> I suspect the answer is that, there are so few individual keys that it has never
> seemed worth separating them. The packaging metainfo would probably be larger
> than the content!
> 
> Since gnupg is only Recommends, is it worth it?

Indeed it is probably not worth a separate package, contra my bug title!

It might be worth reviewing if even the Recommends is warranted though -
slapping gnupg on everyone's system by default seems like a significant
difference from Debian.

I get the impression there are debates about OpenPGP implementations in
Debian. I don't have a horse in that race but it might give the edge to
dropping the relationship.

Message #18 received at 895@bugs.devuan.org (full text, mbox, reply):

On Mon, Jun 23, 2025 at 08:42:09PM +0100, Andrew Bower wrote:
> It might be worth reviewing if even the Recommends is warranted though -
> slapping gnupg on everyone's system by default seems like a significant
> difference from Debian.

We could downgrade it to Suggests.

> I get the impression there are debates about OpenPGP implementations in
> Debian. I don't have a horse in that race but it might give the edge to
> dropping the relationship.

Yes, or adding other alternatives.

Mark

Message #23 received at 895-done@bugs.devuan.org (full text, mbox, reply):

Version: 2025.07.30

This Recommends was removed as part of
https://git.devuan.org/devuan/devuan-keyring/pulls/10[1].

Closing as resolved.

Mark

[1]  https://git.devuan.org/devuan/devuan-keyring/commit/6e149148c801ce474d5f042c33ccfda8bba471bd

Send a report that this bug log contains spam.