[Pkg-privacy-maintainers] txtorcon is marked for autoremoval from testing

[Sascha Steinbiss]

Dear list, hi meejah,

I am the maintainer of gnome-keysign, who, via its dependency magic-
wormhole, is affected by the issue below:

> txtorcon 24.8.0-1.1 is marked for autoremoval from testing on 
> 2026-05-31
> 
> It (build-)depends on packages with these RC bugs: 1134158: geoip- 
> database: license of package doesn't match license provided upstream
> and is likely not DFSG-compliant https:// bugs.debian.org/1134158

Would it be acceptable to just remove the optional dependency on
python3-geoip (and hence geoip-database) from the Debian txtorcon
package? It seems to only be required by upstream when the [dev] option
is passed on installation [1,2].

I just tested removing the python3-geoip deps and rebuilding txtorcon's
reverse dependencies in Debian using ratt [3] and all 4 such packages at
least _built_ correctly (except tahoe-lafs, whose builds currently fail
for other reasons [4]).
Also see attached patch.

I know this does not solve the underlying fundamental license issue with
geoip-database we have in Debian but at least remove some urgency based
on removals affecting other packages.

What do you think? Any other ideas to address the situation?

CC'ing the txtorcon and magic-wormhole upstream (meejah) for potentially
more insight on whether the geoip dependency is actually required.

Thanks and best regards
Sascha


[1] https://github.com/meejah/txtorcon/
blob/85c213092104aebea24adc858ab0ffdd0791ad1d/setup.py#L46
[2] https://github.com/meejah/txtorcon/
blob/85c213092104aebea24adc858ab0ffdd0791ad1d/dev-requirements.txt#L14
[3] https://github.com/debian/ratt
[4] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123360
-------------- next part --------------
A non-text attachment was scrubbed...
Name: txtorcon-remove-geoip.diff
Type: text/x-patch
Size: 1090 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-privacy-maintainers/attachments/20260524/efa0fbe6/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-privacy-maintainers/attachments/20260524/efa0fbe6/attachment.sig>