[pkg-gnupg-maint] Bug#853102: libgpgme11: downgrade gnupg2 (gnupg) dependency to Recommends:

[Ivan Shmakov]

>>>>> Daniel Kahn Gillmor <dkg at fifthhorseman.net> writes:
>>>>> On Sun 2017-01-29 13:57:19 -0500, Ivan Shmakov wrote:

 >> [Apologies for not actually checking if the problem described is
 >> relevant to Debian testing.]

	[Apologies for taking this long to get back to the issue.]

 > I'm not sure which exact problem is the one you think is most
 > important, but if this is it:

 >> Long story short, I’ve recently tried to install Mutt on a
 >> “headless,” tty-over-SSH-only server.  To my surprise, APT found
 >> that it depends on libgtk2.0-0!  Thankfully, no, Mutt wasn’t
 >> upgraded to provide a GUI; the problem was in the ‘pinentry-gtk2’
 >> package – which is required by gnupg-agent, which is in turn
 >> required by gnupg2, and thus libgpgme11.  (JFTR, I’m aware of
 >> pinentry-curses.)

 > then you'll be glad to know that the depenencies in debian testing
 > are such that pinentry-curses is the only thing that would be
 > installed automatically on a headless server.  I think that's a
 > reasonable tradeoff.

	In this case, my problem is that I cannot anymore avoid
	installing GnuPG on systems where it will never ever be used —
	so long as I want to get Mutt on these same systems.

	It doesn’t feel right that I can install virtually any other MUA
	— from Alpine to Thunderbird — but /not/ Mutt, without also
	installing GnuPG — that isn’t going to be actually used.  Cf.:

$ apt-get -Vs install -- gnupg- alpine thunderbird 

$ apt-get -Vs install -- gnupg- mutt 

 > Note that even on jessie, if you do:

 >     apt install pinentry-curses ; apt install mutt

 > then you don't get the heavyweight libgtk dependency chain.

	That’d be somewhat error-prone.  Instead, I rely on specific
	guards in /etc/apt/preferences.d/, like:

Explanation: Pango is not useful on this (headless) server.
Package: libpango-1.0-0
Pin: release c=main
Pin-Priority: -42

[…]

 >> And indeed, providing an otherwise empty, “fake” gnupg2 package [1]
 >> made it possible to install and use Mutt with no obvious ill effects
 >> (using [2] as the test file.)  For instance:

 > this seems like a lot of work, compared to just manually installing
 > pinentry-curses before installing mutt, no?

	This was just to prove that circumventing the current Depends:
	and /not/ actually installing GnuPG does not result in unusable
	Mutt install.

	Hence, my reading of Debian Policy [3] is that in the mutt →
	libgpgme11 → gnupg dependency chain there’s at least one
	extraneous link.  And I don’t suppose it could be the mutt →
	libgpgme11 one, now could it?

[3] http://debian.org/doc/debian-policy/ch-relationships.html#s-binarydeps

[…]

-- 
FSF associate member #7257  Orchid — N8bit 2EB2 F6A5  8916 3013 B6A0 230E 334A