control: severity -1 grave This is grave: it breaks a related package. I want to avoid this migrating into testing until we figure out what to do here.
I agree you have identified the right options. Greg, the issue here is that NFS calls gss_krb5int_set_allowable_enctypes so the kernel can pass the set of enctypes it supports. It still supports DES. After single-DES is removed the call fails. Which side of the krb5/gssd barrier do we want to fix that on? I'm leaning toward krb5 because the krb5 library has a better handle on what enctypes it wants. However I'd rather not carry a patch forever in Debian and so if you're against the idea of handling this upstream I'd look into gssd solutions. --Sam
