Moin josch,

as already discussed in IRC, I don't find a use case for gpgvnoexpkeysig
and think it could be deprecated. According to mmdebstrap(1):

| Example: This is necessary for allowing old timestamps from
| snapshot.debian.org
|
|  --aptopt='Acquire::Check-Valid-Until "false"'
|  --aptopt='Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"'

As well as:

| Create a buildd tarball for EOL distro:
|
|  $ mmdebstrap --include=apt --variant=buildd --aptopt \
|      'Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \
|      --aptopt='Acquire::Check-Valid-Until "false"' \
|      --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
|      --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older \
|      jessie ~/.cache/sbuild/jessie-arm64.tar \
|      http://archive.debian.org/debian

Adding --aptopt Apt::Key::gpgvcommand has two consequences:

1. It is added to the outer apt config on the host system.

2. It is added to /etc/apt/apt.conf.d/99mmdebstrap inside the chroot.
   This is only needed when you want to use apt inside the chroot.

Let's inspect 1. first:

mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \
 --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
 --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older jessie \
 /dev/null http://archive.debian.org/debian

as well as:

mmdebstrap --variant=apt --aptopt='Acquire::Check-Valid-Until "false"' \
 --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
 --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older unstable \
 /dev/null https://snapshot.debian.org/archive/debian/20131012T160100Z/

works just fine here. I was not able to test older then 20131012T160100Z
even with gpgvnoexpkeysig.

So with a recent apt 1. gpgvnoexpkeysig is not needed. It is also
problematic because it tries to call gpgv but there is not direct
dependency to it so on a system without gpgv installs it fails with:

W: http://snapshot.debian.org/archive/debian/20260824T022231Z/dists/unstable/InRelease: Loading /etc/apt/trusted.gpg from deprecated option Dir::Etc::Trusted
W: Signature verification failed: http://snapshot.debian.org/archive/debian/20260824T022231Z unstable InRelease: GPG: gpgv executable not found
E: The repository 'http://snapshot.debian.org/archive/debian/20260824T022231Z unstable InRelease' is not signed.

Which is not obvious.

For 2. the problem is that gpgvnoexpkeysig would need to exist inside
the chroot, which is not normally the case and the mmdebstrap versions
in older releases does not even provide it. So I think the real command
should be something like:

Hi,

Quoting Jochen Sprickerhof (2026-09-15 15:38:17)

this sounds like it is added to the /etc of the system running mmdebstrap
but this is not the case.

Indeed it seems more is needed with modern versions of apt. In addition to
what the mmdebstrap man page says, these days you also must convince apt that
SHA1 is fine:


Yes, but I wouldn't make gpgv a dependency. At maximum I'd make it a Suggests.
The error message says "gpgv executable not found" which I find a error message
which is good enough to understand that gpgv must be installed for this to
work.

Yes, this is because mmdebstrap is used like this with ancient timestamps only
in debbisect which throws away the chroot after it created it, so there is
never an "apt update" happening. If you want to keep the ancient chroot to work
with it later then yes, you'd need gpgvnoexpkeysig. I haven't heard yet of
anybody who has a use-case for doing that.

$ mmdebstrap --arch=i386 --variant=apt unstable /dev/null --aptopt \
    'Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \
    --aptopt='APT::Hashes::SHA1::Weak "yes"' \
    --aptopt='Acquire::Check-Valid-Until "false"' \
    --aptopt='APT::Snapshot "20090523T213852Z"' \
    --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \
    --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older

Remove the Apt::Key::gpgvcommand option and the above will fail with:

W: Signature verification failed: https://snapshot.debian.org/archive/debian/20090523T213852Z unstable Release: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 150C8614919D8446E01E83AF9AA38DCD55BE302B is not bound:            No binding signature at time 2009-05-23T20:54:07Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
E: The repository 'https://snapshot.debian.org/archive/debian/20090523T213852Z unstable Release' is not signed.

The first Debian unstable snapshot timestamp which does not require
gpgvnoexpkeysig is 2013-10-12T16:01:00Z.

I don't think it's needed for debrebuild because you never want to rebuild
anything in snapshot timestamps from 2013 or earlier.

Since there seems to be a use-case for gpgvnoexpkeysig for timestamps of Debian
unstable (the timestamps differ for other suites) between 2009-05-23T21:38:52Z
and 2013-10-12T13:01:34Z what is the argument to remove the utility. Where does
its existence in the mmdebstrap codebase cause problems?

Thanks!

cheers, josch

* Johannes Schauer Marin Rodrigues <josch@debian.org> [2026-10-07 15:54]:

Right, I meant that it is added to the mmdebstrap apt config that is
used when mmdebstrap uses the host system apt to do the initial
bootstrap.

Thanks for pointing that out! Feel free to close this bug with that
change.

I think documenting the dependency next to how and when to use
gpgvnoexpkeysig is enough.

Not really a use case but rust-rust-apt 0.11.3-2 added a gpgv dependency
so it works in debrebuild with gpgvnoexpkeysig.

I will open an MR for that later.

It is fine and we should keep it.

Thanks!

Jochen

Quoting Jochen Sprickerhof (2026-10-08 05:39:51)

I'm closing this bug now. This bug was a request for removal of gpgvnoexpkeysig
(which seems to not be needed) not about a need for documentation of how to go
as far back as 2009 on snapshot.d.o.

I now have the following paragraph in the man page:

The "gpgvnoexpkeysig" script requires the gpgv utility and is no longer
required for snapshots of Debian unstable of "2013-10-12T16:01:00Z" and later.
https://salsa.debian.org/rust-team/debcargo-conf/-/merge_requests/1405

It seems that got added to satisfy an upstream test requirement and not because
of mmdebstrap or gpgvnoexpkeysig? The error message in the MR text is

Internal error: Cannot find gpgv

The error message you get from mmdebstrap with gpgvnoexpkeysig is different and
you mention it in your bug report:

GPG: gpgv executable not found

Yes. I don't think debrebuild should require this. On the other hand debbisect
should.

Thank you for opening this bug! This made me find the new
APT::Hashes::SHA1::Weak requirement and the man page is improved now.

Thanks!

cheers, josch

* Johannes Schauer Marin Rodrigues <josch@debian.org> [2026-10-08 06:17]:

Right, not sure what is going on there. I only noted that 0.11.3-1
(without the gpgv dependency) build fine on the buildd:

https://buildd.debian.org/status/fetch.php?pkg=rust-rust-apt&arch=amd64&ver=0.11.3-1&stamp=1789425843&raw=0

but failed on reproduce.d.n:

https://reproduce.debian.net/amd64/api/v1/builds/289593/log

And there is no trace of gpgv in the buildd log.

Hi,

obligatory: https://knowyourmeme.com/sensitive/memes/we-need-to-go-deeper

Quoting Johannes Schauer Marin Rodrigues (2026-10-07 15:54:12)

with the help of DonKult I managed to go another three years back to
2006-08-04. I updated the mmdebstrap man page with what is necessary to do so.
Here is the current version:

Thanks!

cheers, josch