Hi,

Now that we have deb822 format for specifying APT repo which includes everything within one file, the user should be discouraged from using
old styles where the GPG key is stored in a "keyring" (whether it be a
trusted keyring or just a folder in another place with that name).

Far too many places mention the legacy and old styles. That includes
software docs which are maintained.

One cannot possibly open issues and convince in every repo, provided if
the software or doc-cycle are open in the first place.

A big red warning (and not error / failure) will bring a much needed
kinetic force for the change IMO, on the same lines as the warning when
using the old apt-keys stuff.

Hence, I request for making deb822 the default format and deprecating
the previous .list method with a noisy warning.

Thanks,
Siddh

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Fri, 02 May 2025 00:00:04 +0530
Siddh Raman Pant <sanganaka@siddh.me> wrote:

Hi,

Now that we have deb822 format for specifying APT repo which includes everything within one file, the user should be discouraged from using
old styles where the GPG key is stored in a "keyring" (whether it be a trusted keyring or just a folder in another place with that name).

Far too many places mention the legacy and old styles. That includes
software docs which are maintained.

One cannot possibly open issues and convince in every repo, provided
if the software or doc-cycle are open in the first place.

A big red warning (and not error / failure) will bring a much needed
kinetic force for the change IMO, on the same lines as the warning
when using the old apt-keys stuff.

Hence, I request for making deb822 the default format and deprecating
the previous .list method with a noisy warning.

This mailing list/newsgroup is read by users, almost all of whom are
not developers. You need to raise this in a bug report with the
appropriate severity, which is wishlist in this case.

https://www.debian.org/Bugs/

Those of us using apt already get a message informing us the there are
legacy sources, which in my case is Opera. Even though Opera does have
a new-style source declaration, Opera insists on recreating the legacy sources.list with its own entry on each upgrade, which I later delete.
I'm sure this will be fixed soon.

But we were informed of this a couple of months ago. There is an
automatic moderniser which is offered by apt if legacy sources are
found. The usual Debian way is to issue warnings of deprecation and
removal when actual dates have been decided. We've had the deprecation
one.

--
Joe

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Thu May 1, 2025 at 7:30 PM BST, Siddh Raman Pant wrote:

A big red warning (and not error / failure) will bring a much needed
kinetic force for the change IMO, on the same lines as the warning when
using the old apt-keys stuff.

Hence, I request for making deb822 the default format and deprecating
the previous .list method with a noisy warning.

You ask in the wrong place: try debian-devel, or file a request against
the relevant packages (apt?)

However, can I point out that the pre-822 format has been around for *27 years*: it's going to take a long time for people who are familiar with
it to internalise the new format. Introducing nagging warnings too soon
will frustrate people. We will have to be a bit patient.


--
Please do not CC me for listmail.

👱🏻 Jonathan Dowland
✎ jmtd@debian.org
🔗 https://jmtd.net

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2025-05-02, Siddh Raman Pant wrote:

Now that we have deb822 format for specifying APT repo which includes everything within one file, the user should be discouraged from using
old styles where the GPG key is stored in a "keyring" (whether it be a trusted keyring or just a folder in another place with that name).

Besides what have been said, deb822 format can use a GPG key in a
"keyring" with "Signed-By:". So using deb822 is not a way to discourage
its use.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Thu May 1, 2025 at 9:17 PM BST, Jonathan Dowland wrote:

However, can I point out that the pre-822 format has been around for
*27 years*: it's going to take a long time for people who are familiar
with it to internalise the new format. Introducing nagging warnings
too soon will frustrate people. We will have to be a bit patient.

According to a recent blog post on PDO, the warning you want is already
in place <https://daniel-lange.com/archives/192-Make-apt-shut-up-about-modernize-sources-in-Trixie.html>
(and already annoying!)

--
Please do not CC me for listmail.

👱🏻 Jonathan Dowland
✎ jmtd@debian.org
🔗 https://jmtd.net

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Sun, May 11, 2025 at 09:34:44PM +0100, Darac Marjal wrote:

I read some advice recently that suggested taking the time some thing
has existed to be a "half-life" for deprecation. So, if the pre-deb822
format has existed for 27 years and we deprecated it now, we can
expect 50% of users will have noticed the deprecation by the middle of
the century. By the year 2100, a little over 10% of users will still
be unaware or unwilling to change.

An important factor is whether the change brings a tangible benefit. In
this case, I see zero reason for the average user to care that their sources.list is in a spiffy new format so I would expect many people to
be uninterested in doing busy work. At least now there's a nag message
to "encourage" them to do busy work. :-/

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)