Package: ca-certificates-java
Version: 20240118
Control: affects -1 + src:gnupg2

I'm seeing test suite failures of ca-certificates-java which seem
unrelated to GnuPG, which fail when updating GnuPG in unstable.

In particular, i see failures like:

```
138s can-install-jre      FAIL stderr: /usr/bin/auto-apt-proxy: 176: 
avahi-browse: not found
```

for example in
https://ci.debian.net/packages/c/ca-certificates-java/testing/amd64/58295804/
and
https://ci.debian.net/packages/c/ca-certificates-java/testing/ppc64el/58296085/

I don't see how any of the recent changes to gpg would affect
ca-certificates-java's test suites.  gpg is not even an explicit
dependency of the relevant test suites -- it's only listed as an
explicit dependency of debian/tests/can-configure-cross-compilation, and
even there it looks to me like it could be trivially removed, by
depending on debian-archive-keyring instead, pointing to the desired
keyrings that are already in the filesystem, and not requiring keyserver
access.

I'm attaching a patch that i think should avoid the need to explicitly
depend on gpg, which should resolve matters in terms of gpg package
migration, but probably won't resolve whatever is causing the
avahi-browse problem.

I've also offered the patch at
https://salsa.debian.org/java-team/ca-certificates-java/-/merge_requests/12

Thanks for maintaining ca-certificates-java in Debian!

        --dkg

From 1ace40ba5ae892a0ca8cf77cb6b737ad54301f73 Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <[email protected]>
Date: Thu, 27 Feb 2025 13:58:24 -0500
Subject: [PATCH] debian/tests: Avoid depending on gpg or keyserver access

The debian-archive-keyring package already contains the OpenPGP
certificates this test is looking for.
---
 debian/tests/can-configure-cross-compilation | 7 ++-----
 debian/tests/control                         | 2 +-
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/debian/tests/can-configure-cross-compilation b/debian/tests/can-configure-cross-compilation
index 880b84c..1eb24de 100755
--- a/debian/tests/can-configure-cross-compilation
+++ b/debian/tests/can-configure-cross-compilation
@@ -6,10 +6,6 @@ if [ $(dpkg --print-architecture) != 'amd64' ]; then
     exit 0
 fi
 
-gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 0E98404D386FA1D9
-gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 6ED0E7B82643E131
-gpg --output unstable.pgp --export 6ED0E7B82643E131 0E98404D386FA1D9
-
 echo "Host architecture ${host_arch}"
 echo "Foreign architecture ${foreign_arch}"
 
@@ -39,7 +35,8 @@ apt-ftparchive \
 popd
 
 mmdebstrap  --setup-hook='copy-in /tmp/binaries /tmp' \
-            --keyring unstable.pgp \
+            --keyring /usr/share/keyrings/debian-archive-bullseye-automatic.gpg \
+            --keyring /usr/share/keyrings/debian-archive-bookworm-automatic.gpg \
             --mode=root \
             --variant=essential \
             --architectures=amd64,armhf \
diff --git a/debian/tests/control b/debian/tests/control
index 95912de..3ffe394 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -9,6 +9,6 @@ Restrictions: needs-root
 
 Tests: can-configure-cross-compilation
 # No depends, this is a test for a clean install
-Depends: apt-utils, bash, mmdebstrap, gpg, moreutils
+Depends: apt-utils, bash, mmdebstrap, debian-archive-keyring, moreutils
 Restrictions: needs-root, allow-stderr
 Architecture: amd64
-- 
2.47.2

Attachment: signature.asc
Description: PGP signature

__
This is the maintainer address of Debian's Java team
<https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>.
 Please use
[email protected] for discussions and questions.

Reply via email to