[Pkg-privacy-maintainers] Bug#969901: torbrowser-launcher: depends on /usr/bin/gpg2 but dependency not expressed

[Jonathan Dowland]

Package: torbrowser-launcher
Version: 0.3.2-11~bpo10+1
Severity: serious
Justification: Policy 3.5

There's a few things going on in this session, but this bug report is
about the last backtrace in particular:

$ torbrowser-launcher
Tor Browser Launcher
By Micah Lee, licensed under MIT
version 0.3.2
https://github.com/micahflee/torbrowser-launcher
Creating GnuPG homedir /home/jon/.local/share/torbrowser/gnupg_homedir
Downloading Tor Browser for the first time.
Downloading https://aus1.torproject.org/torbrowser/update_3/release/Linux_x86_64-gcc3/x/en-US
Latest version: 9.5.4
Downloading https://dist.torproject.org/torbrowser/9.5.4/tor-browser-linux64-9.5.4_en-US.tar.xz.asc
Downloading https://dist.torproject.org/torbrowser/9.5.4/tor-browser-linux64-9.5.4_en-US.tar.xz
Verifying Signature
Refreshing local keyring...
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/torbrowser_launcher/launcher.py", line 589, in verify
    c.verify(signature=sig, signed_data=signed)
  File "/usr/lib/python3/dist-packages/gpg/core.py", line 559, in verify
    raise errors.BadSignatures(results[1], results=results)
gpg.errors.BadSignatures: 110775B5D101FB36BC6C911BEB774491D9FF06E2: Key expired

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/torbrowser_launcher/launcher.py", line 600, in run
    verify()
  File "/usr/lib/python3/dist-packages/torbrowser_launcher/launcher.py", line 594, in verify
    raise Exception
Exception

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/torbrowser_launcher/launcher.py", line 603, in run
    self.common.refresh_keyring()
  File "/usr/lib/python3/dist-packages/torbrowser_launcher/common.py", line 209, in refresh_keyring
    '--refresh-keys'], stderr=subprocess.PIPE)
  File "/usr/lib/python3.7/subprocess.py", line 775, in __init__
    restore_signals, start_new_session)
  File "/usr/lib/python3.7/subprocess.py", line 1522, in _execute_child
    raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: '/usr/bin/gpg2': '/usr/bin/gpg2'
Aborted




-- System Information:
Debian Release: 10.2
  APT prefers stable
  APT policy: (990, 'stable'), (500, 'stable-debug'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-6-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_WARN
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages torbrowser-launcher depends on:
ii  ca-certificates   20190110
ii  libdbus-glib-1-2  0.110-4
ii  python3           3.7.3-1
ii  python3-gpg       1.12.0-6
ii  python3-pyqt5     5.11.3+dfsg-1+b3
ii  python3-requests  2.21.0-1
ii  python3-socks     1.6.8+dfsg-1

Versions of packages torbrowser-launcher recommends:
ii  tor  0.3.5.10-1

Versions of packages torbrowser-launcher suggests:
ii  apparmor  2.13.2-10

-- no debconf information