[Pkg-privacy-maintainers] txtorcon is marked for autoremoval from testing

[meejah]

Current versions of txtorcon should work fine with the Tor database.

I'm just about to do a release that uses the Debian location of the Tor geoip database by default.

Since several versions, using these databases has been basically "optimization" since txtorocn will fall back and ask Tor for (country-level) locations by default anyway.

So, from a packaging perspective, simply not installing any database is fine.
txtorcon from 26.6.0 (yet to be released) onwards will use this new default path /usr/share/tor/geoip

thanks,
meejah

On Tue, 26 May 2026, at 14:33, Sascha Steinbiss wrote:
> Hi meejah,
>
>> Alternatively, is it possible to depend on tor-geoipdb instead?
>> Or does this package suffer the same problem?
>> 
>> https://packages.debian.org/trixie/tor-geoipdb
>
> This seems to be unaffected by the MaxMind issue since these are from
> another source, under a more permissive license, see [1].
> However, the format is potentially different:
>
> ❯ head -n 100 /usr/share/tor/geoip
> # This file has been converted from the IPFire Location database
> # using Tor's geoip-db-tool, which is available in the
> # scripts/maint/geoip/geoip-db-tool directory in the Tor source
> # code repository at https://gitlab.torproject.org/tpo/core/tor/ .
> #
> # For more information on the data, see https://location.ipfire.org/.
> #
> # Below is the header from the original export:
> #
> #
> # Location Database Export
> #
> # Generated: Wed, 06 May 2026 04:32:30 GMT
> # Vendor:    IPFire Project
> # License:   CC BY-SA 4.0
> #
> # This database has been obtained from https://location.ipfire.org/
> #
> # Find the full license terms at
> https://creativecommons.org/licenses/by-sa/4.0/
> #
> 15726992,15726999,??
> 16777216,16777471,AU
> 16777472,16778239,CN
> 16778240,16779263,AU
> 16779264,16781311,CN
> 16781312,16785407,JP
> 16785408,16793599,CN
> 16793600,16809983,JP
> 16809984,16842751,TH
> 16842752,16843007,CN
> 16843008,16843263,AU
> 16843264,16859135,CN
> 16859136,16875519,JP
> 16875520,16908287,TH
> [...]
>
>
> If you can make this work with txtorcon, then I guess it would be usable
> from a licensing point of view. Note that installing tor-geoipdb as a
> dependency at runtime pulls in the whole of Tor, including the server,
> via another dependency though. Not sure if that's a good side effect.
>
> Cheers
> Sascha
>
> [1]
> https://gitlab.torproject.org/tpo/core/debian/tor/-/blob/debian-main/debian/tor-geoipdb.copyright?ref_type=heads
>
> Attachments:
> * OpenPGP_signature.asc