Re: EC SRM key for bookworm?

[Adrian Bunk <bunk@debian.org>]

On Fri, Mar 10, 2023 at 09:27:30AM +0000, Adam D. Barratt wrote:
> On Sat, 2023-03-04 at 16:03 +0200, Adrian Bunk wrote:
> > On Sat, Mar 04, 2023 at 01:33:13PM +0000, Adam D. Barratt wrote:
> > > SRM is considering using an ed25519 GPG key for bookworm. Does
> > > anyone
> > > see any issues with that?
> > > ...
> > > We know that GPG(V) 1.X can't handle EC keys,
> > > ...
> > 
> > in all releases from stretch to bookworm:
> >   Package: apt
> >   Depends: ..., gpgv | gpgv2 | gpgv1, ...
> > 
> > This has to become only[1] "gpgv" in at least bullseye and bookworm,
> > otherwise there would be users running into problems - even in
> > unstable "apt-get remove gpgv" works and installs "gpgv1" instead.
> 
> FWIW I can't replicate that on bullseye:
> 
> $ sudo apt-get remove gpgv
> Reading package lists... Done
> Building dependency tree... Done
> Reading state information... Done
> The following packages were automatically installed and are no longer
> required:
> [...]
> Use 'sudo apt autoremove' to remove them.
> The following packages will be REMOVED:
>   apt apt-utils debian.org debian.org-recommended debian.org-
> recommended-bullseye devscripts gnupg gpgv
> WARNING: The following essential packages will be removed.
> This should NOT be done unless you know exactly what you are doing!
>   apt gpgv (due to apt)
>...

Using fresh chroots created with
  debootstrap bullseye bullseye
and
  debootstrap sid sid
as testcases, apt in unstable does find the solution of installing gpgv1 
when removing gpgv but apt in bullseye does not.

But the following should always work:
# apt-get install gpgv1
# apt-get remove gpgv

And something like this might have happened for various odd reasons in 
the past years.

> Regards,
> 
> Adam

cu
Adrian