Daniel Kahn Gillmor <
dkg@fifthhorseman.net> (2025-04-11):
Control: forwarded 1102621 https://dev.gnupg.org/T7603
Control: tags 1102621 + patch
On Fri 2025-04-11 19:27:12 +0200, Andreas Metzler wrote:
npth was added in
ce9906b008c94c2aa4ac770a981d1e1e0b8aea47
gpg: First rough implementation of keyboxd access for key lookup.
and libassuan in aba82684fe14289cf62b4694bc398f3a274b4762
gpg: New option --use-keyboxd.
Thanks for the sleuthing here, Andreas. It's definitely useful to
know where these additional dependencies were added. But i don't think
gpgv has any business talking to keyboxd, at least according to its documentation.
And, in the places where we use gpgv, it would probably be a disaster
if it *did* talk to keyboxd.
Alright. It wasn't clear to me how gpgv and keyboxd fit in that picture,
thanks for sorting that out!
It looks like libassuan is present only due to g10/call-keyboxd.c.
I've reported that upstream as https://dev.gnupg.org/T7603, and the
patch attached here stubs out those calls for gpgv.
I'm now looking into whether the npth dependency is really needed. it
seems like the only invocations of npth in gpgv are:
- npth_read
- npth_sleep
- npth_usleep
afaict, those are merely collaborative asynchronous wrappers around the standard POSIX calls, which again seem unnecessary for gpgv.
They appear to have been pulled in from common/sysutils.c when built
with pth, which suggests that we just need to link gpgv against a
non-pth libcommon. I'll test further and report back.
Thanks to both of you for the kick turnaround! It looks like gpgv-udeb
2.4.7-14 has satisfiable dependencies *and* manages to validate mirrors
from within d-i.
Cheers,
--
Cyril Brulebois (
kibi@debian.org) <
https://debamax.com/>
D-I release manager -- Release team member -- Freelance Consultant
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEtg6/KYRFPHDXTPR4/5FK8MKzVSAFAmf6CAwACgkQ/5FK8MKz VSAi8g/+PXAlIe6gMWZ2GHd8NkNYTVb1KS/37ECpcRY0E83sI2Rx70c4rxdt6TuO jfw7MPvNWByJjBUwdCkgYsWVTDF5omE/19YO4B4p0areCw/8iOMojlZOrxgQIN+5 G0BcJguztwOJy2+9VShhr30YDAiQXf9fvQEoqGgIryO2TT941UKBqIC5mPOqS1dm xwose7vcfZdlUbzqjKaDPnpLZZ9ey1/IJclPKQBXxTYVHqvB7yXzSoihtn74DZEc SD3NM+UG6CQsWiLlfF4CClHOQkYc+qxWwqbqoMnBD34EhmkTcBGevJ5jH+EncRcF bVTpLTVfMU4V4hs6wzv8FZsddg+v6jivJLVigi312VWnPTnhXHmSkQySuJheQj8R vuOtmtnfwcumIZfZpIQGleZFiAmSjRp1rDwuO63C9b/0Wy1WRcSODnT2+5DL+Zdi boNuwk21F2d1gc0LCCD+VUA1nStipNR/63J1IHSqgQzt8yy1jFNkAg0cHVRlC2z+ sAndICAxxW+4FEZkIu42RnWrs0rcqaaq27V2KtPvhLXYJouvYqgT5NI2jnPtaZl8 /DkAs9/cSTt+n4JGZ/XiSTUfLcd4EgK1ChNeuzlQSSs9vSO+kETOW1d09alFv/zt cG8KpKFEuYy0uFsP6EAb4XqR/r1YWFVZGZUAXfjgZ/JEtmH4Z/U=
=2QCN
-----END PGP SIGNATURE-----
--- SoupGate-Win32 v1.05
*