• Bug#1105027: sqv: since yesterday's trickle to Testing, fails to verify

    From =?utf-8?q?Martin-=C3=89ric_Racine?=@21:1/5 to All on Sat May 10 10:10:01 2025
    UGFja2FnZTogc3F2ClZlcnNpb246IDEuMy4wLTErYjEKU2V2ZXJpdHk6IGltcG9ydGFudApYLURl YmJ1Z3MtQ2M6IG1hcnRpbi1lcmljLnJhY2luZUBpa2kuZmkKClNpbmNlIHRoZSBhYm92ZSBzcXYg YmluLU5NVSB0cmlja2xlZCBkb3duIHRvIFRyaXhpZSwgQVBUIHN5c3RlbWF0aWNhbGx5IGZhaWxz IHRvIHZlcmlmeSBEZWJpYW4gYXJjaGl2ZSBrZXlzOgoKVzogRmFpbGVkIHRvIGZldGNoIGh0dHBz Oi8vZGViLmRlYmlhbi5vcmcvZGViaWFuLXNlY3VyaXR5L2Rpc3RzL3N0YWJsZS1zZWN1cml0eS9J blJlbGVhc2UgIE5vIGdvb2Qgc2lnbmF0dXJlClc6IEZhaWxlZCB0byBmZXRjaCBodHRwczovL2Rl Yi5kZWJpYW4ub3JnL2RlYmlhbi1zZWN1cml0eS9kaXN0cy90ZXN0aW5nLXNlY3VyaXR5L0luUmVs ZWFzZSAgTm8gZ29vZCBzaWduYXR1cmUKVzogRmFpbGVkIHRvIGZldGNoIGh0dHBzOi8vZGViLmRl Ymlhbi5vcmcvZGViaWFuL2Rpc3RzL3N0YWJsZS11cGRhdGVzL0luUmVsZWFzZSAgTm8gZ29vZCBz aWduYXR1cmUKVzogRmFpbGVkIHRvIGZldGNoIGh0dHBzOi8vZGViLmRlYmlhbi5vcmcvZGViaWFu L2Rpc3RzL3N0YWJsZS9JblJlbGVhc2UgIE5vIGdvb2Qgc2lnbmF0dXJlClc6IEZhaWxlZCB0byBm ZXRjaCBodHRwczovL2RlYi5kZWJpYW4ub3JnL2RlYmlhbi9kaXN0cy9zdGFibGUtYmFja3BvcnRz L0luUmVsZWFzZSAgTm8gZ29vZCBzaWduYXR1cmUKVzogRmFpbGVkIHRvIGZldGNoIGh0dHBzOi8v ZGViLmRlYmlhbi5vcmcvZGViaWFuL2Rpc3RzL3Rlc3RpbmctdXBkYXRlcy9JblJlbGVhc2UgIE5v IGdvb2Qgc2lnbmF0dXJlClc6IEZhaWxlZCB0byBmZXRjaCBodHRwczovL2RlYi5kZWJpYW4ub3Jn L2RlYmlhbi9kaXN0cy90ZXN0aW5nL0luUmVsZWFzZSAgTm8gZ29vZCBzaWduYXR1cmUKVzogRmFp bGVkIHRvIGZldGNoIGh0dHBzOi8vZGViLmRlYmlhbi5vcmcvZGViaWFuL2Rpc3RzL3Rlc3Rpbmct YmFja3BvcnRzL0luUmVsZWFzZSAgTm8gZ29vZCBzaWduYXR1cmUKVzogRmFpbGVkIHRvIGZldGNo IGh0dHBzOi8vZGViLmRlYmlhbi5vcmcvZGViaWFuLWRlYnVnL2Rpc3RzL3N0YWJsZS1kZWJ1Zy9J blJlbGVhc2UgIE5vIGdvb2Qgc2lnbmF0dXJlClc6IEZhaWxlZCB0byBmZXRjaCBodHRwczovL2Rl Yi5kZWJpYW4ub3JnL2RlYmlhbi1kZWJ1Zy9kaXN0cy9zdGFibGUtYmFja3BvcnRzLWRlYnVnL0lu UmVsZWFzZSAgTm8gZ29vZCBzaWduYXR1cmUKVzogRmFpbGVkIHRvIGZldGNoIGh0dHBzOi8vZGVi LmRlYmlhbi5vcmcvZGViaWFuLWRlYnVnL2Rpc3RzL3Rlc3RpbmctZGVidWcvSW5SZWxlYXNlICBO byBnb29kIHNpZ25hdHVyZQpXOiBGYWlsZWQgdG8gZmV0Y2ggaHR0cHM6Ly9kZWIuZGViaWFuLm9y Zy9kZWJpYW4tZGVidWcvZGlzdHMvdGVzdGluZy1iYWNrcG9ydHMtZGVidWcvSW5SZWxlYXNlICBO byBnb29kIHNpZ25hdHVyZQpXOiBTb21lIGluZGV4IGZpbGVzIGZhaWxlZCB0byBkb3dubG9hZC4g VGhleSBoYXZlIGJlZW4gaWdub3JlZCwgb3Igb2xkIG9uZXMgdXNlZCBpbnN0ZWFkLgoKJCBkcGtn IC1sIHwgZ3JlcCBhcmNoaXZlLWtleXJpbmcKaWkgIGRlYmlhbi1hcmNoaXZlLWtleXJpbmcgICAg ICAgICAyMDI1LjEgICAgICAgICAgICAgICAgICAgICAgICAgYWxsICAgICAgICAgIE9wZW5QR1Ag YXJjaGl2ZSBjZXJ0aWZpY2F0ZXMgb2YgdGhlIERlYmlhbiBhcmNoaXZlCmlpICBkZWJpYW4tcG9y dHMtYXJjaGl2ZS1rZXlyaW5nICAgMjAyNS4wNC4wNSAgICAgICAgICAgICAgICAgICAgIGFsbCAg ICAgICAgICBPcGVuUEdQIGFyY2hpdmUgY2VydGlmaWNhdGVzIG9mIHRoZSBkZWJpYW4tcG9ydHMg YXJjaGl2ZQoKVGhpcyBvbmx5IGhhcHBlbnMgb24gb25lIG9mIG15IFRyaXhpZSBob3N0cywgc28g dGhpcyBjb3VsZCBiZSBhIFJ1c3QgaXNzdWUuCgpNYXJ0aW4tw4lyaWMKCi0tIFN5c3RlbSBJbmZv cm1hdGlvbjoKRGViaWFuIFJlbGVhc2U6IHRyaXhpZS9zaWQKICBBUFQgcHJlZmVycyB0ZXN0aW5n LWRlYnVnCiAgQVBUIHBvbGljeTogKDUwMCwgJ3Rlc3RpbmctZGVidWcnKSwgKDUwMCwgJ3N0YWJs ZS11cGRhdGVzJyksICg1MDAsICdzdGFibGUtc2VjdXJpdHknKSwgKDUwMCwgJ3N0YWJsZS1kZWJ1 ZycpLCAoNTAwLCAndGVzdGluZycpLCAoNTAwLCAnc3RhYmxlJykKQXJjaGl0ZWN0dXJlOiBpMzg2 IChpNjg2KQoKS2VybmVsOiBMaW51eCA2LjEuMC0zNC02ODYtcGFlIChTTVAgdy8xIENQVSB0aHJl YWQ7IFBSRUVNUFQpCkxvY2FsZTogTEFORz1maV9GSS5VVEYtOCwgTENfQ1RZUEU9ZmlfRkkuVVRG LTggKGNoYXJtYXA9VVRGLTgpLCBMQU5HVUFHRT1maTplbgpTaGVsbDogL2Jpbi9zaCBsaW5rZWQg dG8gL3Vzci9iaW4vZGFzaApJbml0OiBzeXN0ZW1kICh2aWEgL3J1bi9zeXN0ZW1kL3N5c3RlbSkK TFNNOiBBcHBBcm1vcjogZW5hYmxlZAoKVmVyc2lvbnMgb2YgcGFja2FnZXMgc3F2IGRlcGVuZHMg b246CmlpICBsaWJjNiAgICAgICAgICAgMi40MS03CmlpICBsaWJnY2MtczEgICAgICAgMTQuMi4w LTE5CmlpICBsaWJnbXAxMCAgICAgICAgMjo2LjMuMCtkZnNnLTMKaWkgIGxpYmhvZ3dlZWQ2dDY0 ICAzLjEwLjEtMQppaSAgbGlibmV0dGxlOHQ2NCAgIDMuMTAuMS0xCgpzcXYgcmVjb21tZW5kcyBu byBwYWNrYWdlcy4KCnNxdiBzdWdnZXN0cyBubyBwYWNrYWdlcy4KCi0tIG5vIGRlYmNvbmYgaW5m b3JtYXRpb24K

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Holger Levsen@21:1/5 to All on Sat May 10 10:30:01 2025
    control: tags -1 + moreinfo
    thanks

    On Sat, May 10, 2025 at 11:02:55AM +0300, Martin-Éric Racine wrote:
    Since the above sqv bin-NMU trickled down to Trixie, APT systematically fails to verify Debian archive keys:
    [...]
    W: Some index files failed to download. They have been ignored, or old ones used instead.

    $ dpkg -l | grep archive-keyring
    ii debian-archive-keyring 2025.1 all OpenPGP archive certificates of the Debian archive
    ii debian-ports-archive-keyring 2025.04.05 all OpenPGP archive certificates of the debian-ports archive

    what are your versions of apt and sqv installed?

    This only happens on one of my Trixie hosts, so this could be a Rust issue.

    how strange, though I dont understand why you think this would be a Rust issue?

    Architecture: i386 (i686)

    ok, maybe this ^ hints at an Rust on i386 issue...

    do you have several i386 hosts or only one? what CPU models do they have?

    fwiw:

    root@psi:~# apt update
    Hit:1 http://deb.debian.org/debian trixie InRelease
    Hit:2 http://deb.debian.org/debian trixie-updates InRelease
    Hit:3 http://deb.debian.org/debian trixie-backports InRelease
    Hit:4 http://security.debian.org trixie-security InRelease
    All packages are up to date.
    Notice: Some sources can be modernized. Run 'apt modernize-sources' to do so. root@psi:~# dpkg -l apt sqv gnupg2 debian-archive-keyring debian-ports-archive-keyring
    dpkg-query: no packages found matching debian-ports-archive-keyring Desired=Unknown/Install/Remove/Purge/Hold
    | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
    ||/ Name Version Architecture Description +++-======================-============-============-======================================>
    ii apt 3.0.1 amd64 commandline package manager
    ii debian-archive-keyring 2025.1 all OpenPGP archive certificates of the De>
    un gnupg2 <none> <none> (no description available) ii sqv 1.3.0-1+b1 amd64 Simple OpenPGP signature verification >
    root@psi:~#


    --
    cheers,
    Holger

    ⢀⣴⠾⠻⢶⣦⠀
    ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org
    ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
    ⠈⠳⣄

    We are not moving into a 1.5C world, we are briefly passing through it in 2024. (James Hansen)

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEuL9UE3sJ01zwJv6dCRq4VgaaqhwFAmgfDNAACgkQCRq4Vgaa qhyfAA//cf2URL87ze0QZrc4bk9wA9AmRw1cZVDWJdtGx1KivEOV/3IDp08MhfsD ZhZp/TuTa1GdPDCiVmlg0Hrv01KyzMERc7aW68M/jq5SwhzPZt85V0Ux17RJwTTJ 1FT2aaOpIWRrqJPAgw2KPUA4PzMIHLT8n5gqR+14D2rRP3VmjClz2sPf2McziYcd gvk+Zw9WFssbwDookVnrI4YmEvQFRSZPD3IpQmEB/ir5c4vEuaEqIJ4KopPLJRkx 3prEQhgdf1ZaFeHynCDj+zOrS6R5FFIDsLk0+W1yFew50GgtFGNbohqz/pOf3+0b 2p1wv/7RPTMX5p9Ywxyat3rpTuf+hZUvRGcHB7z9IYeJh19aUEmejfyDagtO6XjA qB1qhKEoz4+LhFuPMKPhFju8WgDzsW37EYbOc06YRWCbRrLpXuXaI1ZZavdxNG9V hKjANZ4mQRJ4vhCGMklk/hNvWipNhIMbVaXX45oOO22ESAKyWhdZlBEPSGRRW5gZ nPPhHxQ49ch0xX0OH6L9nrNGbaeZiRwoVszSSiRm89Qt02pVpYM2X7CFbXXOd0QC Jj5k1LMST7AG3rbXI
  • From Holger Levsen@21:1/5 to All on Sat May 10 10:40:01 2025
    control: tags -1 + unreproducible

    On Sat, May 10, 2025 at 11:02:55AM +0300, Martin-Éric Racine wrote:
    Since the above sqv bin-NMU trickled down to Trixie, APT systematically fails to verify Debian archive keys:
    This only happens on one of my Trixie hosts, so this could be a Rust issue. Architecture: i386 (i686)

    I also don't see this on i386:

    holger@infom07-i386:~$ sudo apt update
    Hit:1 http://security.debian.org trixie-security InRelease
    Hit:2 http://deb.debian.org/debian trixie InRelease
    Hit:3 http://deb.debian.org/debian trixie-updates InRelease
    Hit:4 http://deb.debian.org/debian trixie-backports InRelease
    All packages are up to date.
    Notice: Some sources can be modernized. Run 'apt modernize-sources' to do so. holger@infom07-i386:~$ dpkg -l apt sqv gnupg2 debian-archive-keyring Desired=Unknown/Install/Remove/Purge/Hold
    | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
    ||/ Name Version Architecture Description +++-======================-============-============-==================================================
    ii apt 3.0.1 i386 commandline package manager
    ii debian-archive-keyring 2025.1 all OpenPGP archive certificates of the Debian archive
    un gnupg2 <none> <none> (no description available) ii sqv 1.3.0-1+b1 i386 Simple OpenPGP signature verification program
    holger@infom07-i386:~$ cat /proc/cpuinfo |tail -28|head -13
    processor : 7
    vendor_id : AuthenticAMD
    cpu family : 23
    model : 49
    model name : AMD EPYC-Rome Processor
    stepping : 0
    microcode : 0x1000065
    cpu MHz : 1996.250
    cache size : 512 KB
    physical id : 1
    siblings : 4
    core id : 3
    cpu cores : 4
    holger@infom07-i386:~$


    --
    cheers,
    Holger

    ⢀⣴⠾⠻⢶⣦⠀
    ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org
    ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
    ⠈⠳⣄

    If nothing saves us from death, may love at least save us from life.

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEuL9UE3sJ01zwJv6dCRq4VgaaqhwFAmgfDfsACgkQCRq4Vgaa qhyTdA//WN3dE+CVc4Dj7jNml61EzUVYLH3CXvC0QqNI70nrYAkc9yRjKjSyA2Y+ B+6SdlrjAHt7EOlTsnzf0e+kcR7DR8614eRY4mzb9lEOGtFNQcI6En+SDbuZi487 SJHYJQ6uTwMVEkYsr3OB7s+R5eSyPxICAG4fyLCgkOiQgLqYtwrXGCy1Snb4pe9y HxiLKxa1/G3LYN5M5RwdM7IYwvfiQBUtdR85FzdOscyMnCAP2aEk2fua2dsV/DPc r/Dvb+Bn9iacrJ9tY242JchsHGmfdXQAWG427r+PNNII9oSwlKLKBe41TDlyODsM VUhOlYCwb8Vg0xO9TQNai6RDLXzO5FlKATHzu7U4HgN/xMfmUrviq4wnV2z08BFo 0nLiTJCFtrf0jgc4GuaOEY0e0+876/eQZsRiaRvhtFM2QlD5vJP3TcBPDToHp8Y5 xddS0EWxftvRzunRKWDeEmsH70NDTxiAwBR5LpKKaxzBhtz5WQJxLh29xj8A3rat XBsbiqas70Owl40P/jd7YT8UTUa5USoS6hgiwa/83uJliiFT8BdY0Hdwba28kNaz 20b4+PCTsNb+XL+O83wXAsnSZIaQdTMj/npIimWAWR3J
  • From Holger Levsen@21:1/5 to Holger Levsen on Sat May 10 11:10:01 2025
    XPost: linux.debian.doc

    On Sat, May 10, 2025 at 08:51:17AM +0000, Holger Levsen wrote:
    ok, this was to be expected, see #1095862, thus reassigning to release-notes.

    also I wanted to add: this is with a Pentium III processor. It's successor,
    the Pentium IV (which has SSE2) was launched in November 2000, so almost
    25 years ago.

    Pentium IIIs were produced from 1999 until 2004 (desktop) and 2007
    (mobile versions).


    --
    cheers,
    Holger

    ⢀⣴⠾⠻⢶⣦⠀
    ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org
    ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
    ⠈⠳⣄

    Where will your kids go when they become climate refugees?

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEuL9UE3sJ01zwJv6dCRq4VgaaqhwFAmgfFLAACgkQCRq4Vgaa qhwmQw//b943CJDVq+l7ecI/DCcwfA5ZBwhYdHnyd5n8c8TIfxWx5jgJ4Vvac0lK YFo18HaJUtbZ/Fjky4kANh1kwb6tk/bJAsAN9BCXz/Aub50E/sB+Nc8dooWe1c6U 9lQUJJIqAvTyOJAaelQdG5Ipl93uggXD+KyUVocCIgaypa/5Q/sorNdwoN3tYE4M 1jc9ZslzjZF2d3MwOp64FZUDgiCV6ANsMro6fizw+cSxXMAMTYr0C/3tWJ/YtNb3 QXGUyawqBZN7DtrldQqPM0p2jwZk9XmIi6nRxRloReUk91S3kioaNjQ/b78YrgDl VtDTVufgtRwgv4kfGS2SXqzWd/fdvEf00+4W62qCVKuZ2+vCQFS+fhOojs117y3K zIVoM2SnUjM40eWQef+vFKmR9rtKmLpheOceJYhTeFJDy3vZeW7qdkznWiXNQo9I Ex5u7wxRL//xqla5ivLK4i/Tr/GoiKfJU0lKtzN+dPGvLvnBvYEvKrEmnAXh/HZW 0AB+bhJkK6Jle5sDqSlrmJhCWnOCJhx9Z4RvkfyR8i6KiFaWzA2E1FhFi9LI8Q// kDQLw076NzZXBM2HnDSOWjEwkEtTAmgdwPagcN7DOqsmHS0IoPvD0B
  • From Holger Levsen@21:1/5 to All on Sat May 10 11:00:01 2025
    control: reassign -1 release-notes
    control: tags -1 - moreinfo unreproducible
    control: retitle -1 document that rust packages require SSE2 on i386
    thanks

    Hi,

    I'm reassigning this to release-notes as this needs to be documented
    for the trixie release. Leaving some context too, but please read the full
    bug.

    On Sat, May 10, 2025 at 11:37:48AM +0300, Martin-Éric Racine wrote:
    la 10.5.2025 klo 11.23 Holger Levsen (holger@layer-acht.org) kirjoitti:
    On Sat, May 10, 2025 at 11:02:55AM +0300, Martin-Éric Racine wrote:
    Since the above sqv bin-NMU trickled down to Trixie, APT systematically fails to verify Debian archive keys:
    [...]
    W: Some index files failed to download. They have been ignored, or old ones used instead.
    what are your versions of apt and sqv installed?
    ii apt 3.0.1 i386
    ii sqv 1.3.0-1+b1 i386
    This only happens on one of my Trixie hosts, so this could be a Rust issue.
    Architecture: i386 (i686)
    do you have several i386 hosts or only one? what CPU models do they have?
    I have two i386 hosts tracking Testing (currently Trixie). The U1400
    one updates its APT lists just fine. This Pentium III (Coppermine) has
    been failing to do so ever since sqv 1.3.0-1+b1 trickled into Testing yesterday.

    ok, this was to be expected, see #1095862, thus reassigning to release-notes.

    That said, can you please try removing sqv and see what happens? apt should use gpgv then instead and that should work.


    --
    cheers,
    Holger

    ⢀⣴⠾⠻⢶⣦⠀
    ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org
    ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
    ⠈⠳⣄

    Right-handed people commit 90% of all crime world-wide.

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEuL9UE3sJ01zwJv6dCRq4VgaaqhwFAmgfE4MACgkQCRq4Vgaa qhwJqw//SMpUe0OQ1z2XljK/OX0Hv+Lg/1N0GmnvsoPx5ctxQ9ab1qB5rTx+qbd8 B4KdaYp2FdgAcRC1NDfs07dY6EYQGnEjqUaz8vG1j5121MEKuuchwjcnJwmppdDV q6hqcozXXXwZ8x9mkEiAWujebA/sMEvOLWgfgquMvpCOGnU/RQ0K0moApswqnEW2 yUfp619Hh1tawGiYAiZQNP2jPu87dB18XBSUp0WU/uLrNo/SiNAle8OjI66x0+sY BA0dZoy/2jjZYtRIuqZJGJcptn04ril0tr5xMyDGr5xkTrxIgbUWH4q125hkzQOt ImgvpzGXYAjT6HrkxfdFI+FMIITG6FODtY9CcPlYtJey3kAd10a6YcFMCpK9t9eI 19HrTjZ/+/jOWX/H7t5+DxffC2wcM7ZvZmoY8LVAzM1nlkHxOx5r0Rpm4Zx7Zfm0 ZSgI6rWEgYT2+Mpa1yUeXmI7p8bD+XspT+0reg/lFEuwKAIv3VDZarQW8oyrNPIe 4UJN/TDmcmEaGbSOkbuF6kY7mXG4vefln5YZwTZd2M+IbHE5f4LfSG7Mo5afXWOq vjan7d4G7F/ZxwVSZQBF0oVPqq3kXD9urC+iBPBQyXV/64LurWZqpqPob
  • From =?UTF-8?Q?Martin=2D=C3=89ric_Racine@21:1/5 to All on Sat May 10 11:40:01 2025
    XPost: linux.debian.doc

    la 10.5.2025 klo 11.51 Holger Levsen (holger@layer-acht.org) kirjoitti:

    control: reassign -1 release-notes
    control: tags -1 - moreinfo unreproducible
    control: retitle -1 document that rust packages require SSE2 on i386
    thanks

    Hi,

    I'm reassigning this to release-notes as this needs to be documented
    for the trixie release. Leaving some context too, but please read the full bug.

    This might indeed be a good idea. IIRC Go packages have similar requirements.

    On Sat, May 10, 2025 at 11:37:48AM +0300, Martin-Éric Racine wrote:
    la 10.5.2025 klo 11.23 Holger Levsen (holger@layer-acht.org) kirjoitti:
    On Sat, May 10, 2025 at 11:02:55AM +0300, Martin-Éric Racine wrote:
    Since the above sqv bin-NMU trickled down to Trixie, APT systematically fails to verify Debian archive keys:
    [...]
    W: Some index files failed to download. They have been ignored, or old ones used instead.
    what are your versions of apt and sqv installed?
    ii apt 3.0.1 i386
    ii sqv 1.3.0-1+b1 i386
    This only happens on one of my Trixie hosts, so this could be a Rust issue.
    Architecture: i386 (i686)
    do you have several i386 hosts or only one? what CPU models do they have?
    I have two i386 hosts tracking Testing (currently Trixie). The U1400
    one updates its APT lists just fine. This Pentium III (Coppermine) has
    been failing to do so ever since sqv 1.3.0-1+b1 trickled into Testing yesterday.

    ok, this was to be expected, see #1095862, thus reassigning to release-notes.

    Debian might as well push i386 over to debian-ports at this point,
    instead of releasing Trixie with broken support and without kernels,
    since making Pentium 4 the base CPU level for Rust, Go, etc. will
    essentially kill the whole x86-32 user base, except for the last few
    laptop chipsets that were released before AMD and Intel discontinued
    x86-32 production.

    That said, can you please try removing sqv and see what happens? apt should use
    gpgv then instead and that should work.

    It cannot be removed without --force-depends since APT nowadays has
    sqv as a hard Depends. It would be a good idea for APT to list
    supported alternatives e.g. "sqv | gpgv" instead, preferably in the
    same order as dpkg-dev does.

    Once sqv was force-removed, APT indeed was able to update its APT
    lists. However, since a Depends was removed, it now cannot perform any
    useful operation until that missing dependency is resolved.

    Martin-Éric

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Holger Levsen@21:1/5 to All on Sat May 10 11:40:02 2025
    XPost: linux.debian.doc

    On Sat, May 10, 2025 at 12:26:10PM +0300, Martin-Éric Racine wrote:
    That said, can you please try removing sqv and see what happens? apt should use
    gpgv then instead and that should work.
    It cannot be removed without --force-depends since APT nowadays has
    sqv as a hard Depends.

    right.

    It would be a good idea for APT to list
    supported alternatives e.g. "sqv | gpgv" instead, preferably in the
    same order as dpkg-dev does.

    I'm not sure why this isn't the case already, but maybe it's worth
    cloning and reassigning this bug to src:apt.

    Once sqv was force-removed, APT indeed was able to update its APT
    lists. However, since a Depends was removed, it now cannot perform any
    useful operation until that missing dependency is resolved.

    equivs helps with that, but is probably not installed :/


    --
    cheers,
    Holger

    ⢀⣴⠾⠻⢶⣦⠀
    ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org
    ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
    ⠈⠳⣄

    The average US president has been charged with 2 felonies: #45 with 91 and
    the others with 0.

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEuL9UE3sJ01zwJv6dCRq4VgaaqhwFAmgfHj8ACgkQCRq4Vgaa qhxl4w/+NquS1dpkRb7JHXl+i51dB+t1JnMzIqSJwP8s6ECho7IO7ARIqf2HzN3u 3LaPVFQCPVRHqojCstae/Us6U33q55nOl+E2vYMA1ki42WyXz/mP3RIVLRqS8tSj EnC/QtSpAmGju+BEZnHaPaNh1PM96cVkHyEv6y4iVQH8PTMYAx+4gmBeqIfgrOPl Ak0vOKMs/t7hzx0cr8quop9c04tWCI1Q81TmrIFkh+2E6u2OACFvD94OeUru63HO 5wQJV6hqz2JpJBdDoP4eDQC4C5J3yADMHoEhFBntjmbkAoiyWWMcKL5zHuKXHgFH MPXe3jKqPQ49d26jITcCCX8VsVleQ8a/2I5Kt+I25sfPGbQxOseDKN8qFkIECHYF Y5bf8SstWCC5oSvUpV/RbsshF9yDaokyEw/54qyQ07rD2f/cF2zOk/Jk//YaTzvC Y3e4fjl/GeZzHODM/AHEP2W4KrzFkag9S5xnfAYKZzz7zLvYLs7sMQRyFXNb2qsm qfvjEPPQCzyrvUhqWX+J3mgnj/Oz08XP4DjbhqnCQOAE6dtcUqEbQl+uJbVns4e2 jUtvzCeef2qS//4vbe
  • From Holger Levsen@21:1/5 to Holger Levsen on Sat May 10 12:00:01 2025
    control: affects -1 apt
    control: document that apt (and rust packages) require SSE2 on i386
    thanks

    Hi,

    looping in the apt maintainers, please read the full report, in short:
    since the latest binNMU sqv now fails to run on i386 because due to
    #1095862 in rustc the baseline was raised to require SSE2, so causing
    apt to fail to verify because sqv fails to run...

    On Sat, May 10, 2025 at 09:37:04AM +0000, Holger Levsen wrote:
    On Sat, May 10, 2025 at 12:26:10PM +0300, Martin-Éric Racine wrote:
    That said, can you please try removing sqv and see what happens? apt should use
    gpgv then instead and that should work.
    It cannot be removed without --force-depends since APT nowadays has
    sqv as a hard Depends.

    right.

    It would be a good idea for APT to list
    supported alternatives e.g. "sqv | gpgv" instead, preferably in the
    same order as dpkg-dev does.

    I'm not sure why this isn't the case already, but maybe it's worth
    cloning and reassigning this bug to src:apt.

    Once sqv was force-removed, APT indeed was able to update its APT
    lists. However, since a Depends was removed, it now cannot perform any useful operation until that missing dependency is resolved.

    equivs helps with that, but is probably not installed :/



    --
    cheers,
    Holger

    ⢀⣴⠾⠻⢶⣦⠀
    ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org
    ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
    ⠈⠳⣄

    „Wenn der Faschismus kommt, scheint noch immer die Sonne. Die Vögel singen. Sie
    gehen zur Arbeit. Alles ist normal. Nur trans Menschen verlieren ihre Rechte.
    Und Asylsuchende. Und Immigranten. Und Behinderte. Und Muslime. Und Juden. Und
    linke Journalisten. Und dann andere Journalisten. Und ich. Und Sie.“
    - Marina Weisband am 6.4.2025 zum 80. Befreiungstag des KZ Buchenwald

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEuL9UE3sJ01zwJv6dCRq4VgaaqhwFAmgfITQACgkQCRq4Vgaa qhwa2g/+M7OhYRdFZNjGNNkLvyXjAkwgg3BrdrPT8j1XE3pDHPEY6AzLYCko+XBi 5ElWTxOw4Yy2ofuv47Gpf/2xnBWkihwkraihOqyaxTXa1xQGNkis4EcgYjtWADBl vsDRS7CWc+2pT/tAbedBEYbYYxu6Gnt42UNn2H8lKHJ+lUZulVjnsTqIpBQ6YNHK d4jM01CWoSxuLy9KhqJXPHAd6veTeM+1m1aQvik4O3cdHNj8X2cZ2EH9zpGVAJoR Cw7EXg8G3txlnsPEV0UcIfFN7Xbm9+c5gSjpg26jG/2vPvu08FF3rb
  • From Ansgar =?UTF-8?Q?=F0=9F=99=80?=@21:1/5 to All on Sat May 10 12:10:01 2025
    Hi,

    On Sat, 10 May 2025 08:51:15 +0000 Holger Levsen wrote:
    control: retitle -1 document that rust packages require SSE2 on i386
    [...]
    I'm reassigning this to release-notes as this needs to be documented
    for the trixie release. Leaving some context too, but please read the full bug.

    As I mentioned on #-release:

    I think we should just document that the baseline on i386 now requires
    SSE2 instead of limiting the statement to selected packages. If apt
    requires SSE2 indirectly, it doesn't matter to most users that
    technically it is only sqv.

    This together with other changes (such as dropped i386 kernels)
    probably also answers de-facto the questions what the i386 port is for:
    running on old systems or running old software on new systems. (And
    would probably mean that GCC could also enable SSE2 by default in
    future releases.)

    Ansgar

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From =?UTF-8?Q?Martin=2D=C3=89ric_Racine@21:1/5 to All on Sat May 10 12:10:01 2025
    la 10.5.2025 klo 12.50 Holger Levsen (holger@layer-acht.org) kirjoitti:

    control: affects -1 apt
    control: document that apt (and rust packages) require SSE2 on i386
    thanks

    Incorrect title. APT doesn't require SSE2. Only sqv does. Making apt
    Depends on sqv | gpgv fixes this.

    looping in the apt maintainers, please read the full report, in short:
    since the latest binNMU sqv now fails to run on i386 because due to
    #1095862 in rustc the baseline was raised to require SSE2, so causing
    apt to fail to verify because sqv fails to run...

    On Sat, May 10, 2025 at 09:37:04AM +0000, Holger Levsen wrote:
    On Sat, May 10, 2025 at 12:26:10PM +0300, Martin-Éric Racine wrote:
    That said, can you please try removing sqv and see what happens? apt should use
    gpgv then instead and that should work.
    It cannot be removed without --force-depends since APT nowadays has
    sqv as a hard Depends.

    right.

    It would be a good idea for APT to list
    supported alternatives e.g. "sqv | gpgv" instead, preferably in the
    same order as dpkg-dev does.

    I'm not sure why this isn't the case already, but maybe it's worth
    cloning and reassigning this bug to src:apt.

    Once sqv was force-removed, APT indeed was able to update its APT
    lists. However, since a Depends was removed, it now cannot perform any useful operation until that missing dependency is resolved.

    equivs helps with that, but is probably not installed :/

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Holger Levsen@21:1/5 to All on Sat May 10 13:00:02 2025
    reassign 1105027 release-notes
    clone 1105027 -1
    reassign -1 apt
    tag -1 + wontfix
    thanks

    hi,

    from an apt maintainer:

    < juliank> I'm not adding a | gpgv alternative because that completely undermines our security support and will cause systems behaving differently
    < juliank> There's more details
    < juliank> If you have a | gpgv alternative all upgraded systems stay on gpgv
    < juliank> This is horrible divergence



    --
    cheers,
    Holger

    ⢀⣴⠾⠻⢶⣦⠀
    ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org
    ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
    ⠈⠳⣄

    Only change is constant.

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEuL9UE3sJ01zwJv6dCRq4VgaaqhwFAmgfLpgACgkQCRq4Vgaa qhyuKxAAkaAaGj7nbHsKFCxKsbClHPOCnPcRCAvQzR7F8IhmzmzjgheSQzXLOUAN VWJQQlty9D3t0k/W6xjlfqomj/+yHOc2M0TaM6Vkm12/R6GQeLyBaHIdkt6lC/6u FdEa4U58emTxrwlCvhVF0h5T9y0Mw1QdwB6Era/VzhW/ZP0iblUaaFnt4ktry3nA Sp6NQln1mmKBubu1oGRD3BhrqGg8rBibP3aL6f8+SGNZ1dSXjOXpyuV/4WvokyWP fw1PUR/x24/e3eZtbjcq5ax7RhQrKhvSuNPrBG58J4cvjqsrPAVXvMtyISYdSP/h ydQzM312g4wVlIHLRy6sQMXlvkai544WOpXCDcC1OPE6ucF9kj6CN/o+bHWseGdM a6/5Dxq4e0GYAMwHbjJZyO+jla8ghfX3vSiEbBcrl+EZnbpIwdwWyy+PLzP9oqs8 ld23o2dEsIDCBn8u/Mg/kc7yrAXTvQVYzhq+oiOR8B/zro/IzZp2D0mLPpgbUwXf A6QlwpYCDr9LpG2k3pNbo/2iWD5kxlUB2HAFvL9zy99fkvrmMWmws5XTCOxqtXaP AGOIXR9lbOkhUCTisd5foTeqXlvoN8xGkUNf4+Rw0DGC3z1mcaMi1ia6klqGAcze TFDnNaWFpesFXPT+Cs+gwR