Leo Famulari <leo@famulari.name> writes:

> On Sun, Jul 29, 2018 at 04:41:52PM +0100, Christopher Baines wrote:
>> Modify the package to patch gnu.py with an unreleased upstream change to fix
>> duplicity working with recent releases of GnuPG. This change make the package
>> build again.
>>
>> +        gnupg.options.extra_args.append('--ignore-mdc-error')"))
>
> Thanks for taking care of this package.
>
> I'm concerned about the impact of this change, and Duplicity in general.
>
> By ignoring the result of the MDC (modification detection code) check, I
> *think* Duplicity loses the ability to authenticate its archives. If so,
> the Duplicity package description should be changed to reflect this. I
> would at least remove the text about safety against modification.
>
> Also and FYI, Duplicity uses the MD4 message digest truncated to 64 bits
> (via librsync) to identify chunks for deduplication. [0] MD4 collisions
> are trivial to generate.

Hmm, this does look like more of an issue that I anticipated. I was
thinking that this was maybe to do with the tests alone, but checking
the upstream change again, it looks like it effects general operation.

> It's not totally reasonable to remove packages like backup programs
> since, in the future, people will want to read the archives they have
> created. But perhaps we should steer users away from Duplicity in the
> package description.

Yeah, removing the statement about "modification" in the description
sounds like a good step. I don't know enough to add something more
informative to the description though.

One extra thing to note is that I use duplicity (well, not much) through
Deja Dup, so if there is issues with duplicity to describe in the
package description, it might be good to add something similar to the
few packages that use duplicity.

Thanks for looking in to this Leo :)