Devuan bug report logs - #895
devuan-keyring: recommends gnupg; can we have a minimal devuan-archive-keyring?

Package: devuan-keyring; Maintainer for devuan-keyring is Devuan Developers <devuan-dev@lists.dyne.org>; Source for devuan-keyring is src:devuan-keyring.

Reported by: Andrew Bower <andrew@bower.uk>

Date: Mon, 23 Jun 2025 18:40:01 UTC

Severity: wishlist

Found in version devuan-keyring/2022.09.04

Fixed in version 2025.07.30

Done: Mark Hindley <mark@hindley.org.uk>

Full log

Message #13 received at 895@bugs.devuan.org (full text, mbox, reply):

Received: (at 895) by bugs.devuan.org; 23 Jun 2025 19:43:39 +0000
Return-Path: <andrew@bower.uk>
Delivered-To: bugs@devuan.org
Received: from email.devuan.org [2a01:4f9:fff1:13::5fd9:f9e4]
	by doc.devuan.org with IMAP (fetchmail-6.4.16)
	for <debbugs@localhost> (single-drop); Mon, 23 Jun 2025 19:43:39 +0000 (UTC)
Received: from email.devuan.org
	by email.devuan.org with LMTP
	id q2c8HhiuWWjePgAAmSBk0A
	(envelope-from <andrew@bower.uk>)
	for <bugs@devuan.org>; Mon, 23 Jun 2025 19:42:16 +0000
Received: by email.devuan.org (Postfix, from userid 109)
	id 5B0C93E1; Mon, 23 Jun 2025 19:42:16 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on email.devuan.org
X-Spam-Level: 
X-Spam-Status: No, score=-2.3 required=5.0 tests=RCVD_IN_DNSWL_MED,SPF_PASS,
	T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2a00:1098:0:86:1000:0:2:1; helo=mx1.mythic-beasts.com; envelope-from=andrew@bower.uk; receiver=<UNKNOWN> 
Received: from mx1.mythic-beasts.com (mx1.mythic-beasts.com [IPv6:2a00:1098:0:86:1000:0:2:1])
	by email.devuan.org (Postfix) with ESMTPS id C96C51D
	for <895@bugs.devuan.org>; Mon, 23 Jun 2025 19:42:13 +0000 (UTC)
Received: by mailhub-cam-d.mythic-beasts.com with esmtpsa  (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <andrew@bower.uk>)
	id 1uTn3U-004wWE-MS; Mon, 23 Jun 2025 20:42:13 +0100
Received: from andy by shenstone.ab8.net with local (Exim 4.98.2)
	(envelope-from <andrew@bower.uk>)
	id 1uTn3R-000000007In-1wuN;
	Mon, 23 Jun 2025 20:42:09 +0100
Date: Mon, 23 Jun 2025 20:42:09 +0100
From: Andrew Bower <andrew@bower.uk>
To: Mark Hindley <mark@hindley.org.uk>
Cc: 895@bugs.devuan.org
Subject: Re: [devuan-dev] bug#895: devuan-keyring: recommends gnupg; can we
 have a minimal devuan-archive-keyring?
Message-ID: <aFmuEdLhzzyzxCSf@shenstone.ab8.net>
References: <aFme9e9cwYRunCZy@romsey.ab8.net>
 <aFmkwlb7_Kk5gzjy@hindley.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <aFmkwlb7_Kk5gzjy@hindley.org.uk>
User-Agent: Mutt/2.2.13 (2024-03-09)
X-BlackCat-Spam-Score: 10

Thanks for the quick reply, Mark!

On Mon, Jun 23, 2025 at 08:02:26PM +0100, Mark Hindley wrote:
> On Mon, Jun 23, 2025 at 07:37:41PM +0100, Andrew Bower wrote:
> > but it would be nice if there were a devuan-archive-keyring package along the
> > lines of debian-archive-keyring that did not have this recommends.
> > 
> > Any reason this isn't already the case? I see that the package only
> > includes archive keyrings anyway.
> 
> I think a few individual keys are in /usr/share/keyrings/devuan-keyring.gpg as
> well.
> 
> I suspect the answer is that, there are so few individual keys that it has never
> seemed worth separating them. The packaging metainfo would probably be larger
> than the content!
> 
> Since gnupg is only Recommends, is it worth it?

Indeed it is probably not worth a separate package, contra my bug title!

It might be worth reviewing if even the Recommends is warranted though -
slapping gnupg on everyone's system by default seems like a significant
difference from Debian.

I get the impression there are debates about OpenPGP implementations in
Debian. I don't have a horse in that race but it might give the edge to
dropping the relationship.

Send a report that this bug log contains spam.

Devuan bug report logs - #895 devuan-keyring: recommends gnupg; can we have a minimal devuan-archive-keyring?

Devuan bug report logs - #895
devuan-keyring: recommends gnupg; can we have a minimal devuan-archive-keyring?