[Pkg-privacy-maintainers] txtorcon is marked for autoremoval from testing

[Sascha Steinbiss]

Hi meejah,

[...]
> So, from a packaging perspective, simply not installing any database is fine.
> txtorcon from 26.6.0 (yet to be released) onwards will use this new default path /usr/share/tor/geoip

Thanks! If no one from the team objects in the next couple of days, I
will then upload a version of the current txtorcon package which does
not depend on python3-geoip anymore.

Once the next release you mention arrives, it should be simple to depend
on Tor's geoip package when updating the Debian package for your new
upstream version.

Best
Sascha


> On Tue, 26 May 2026, at 14:33, Sascha Steinbiss wrote:
>> Hi meejah,
>>
>>> Alternatively, is it possible to depend on tor-geoipdb instead?
>>> Or does this package suffer the same problem?
>>>
>>> https://packages.debian.org/trixie/tor-geoipdb
>>
>> This seems to be unaffected by the MaxMind issue since these are from
>> another source, under a more permissive license, see [1].
>> However, the format is potentially different:
>>
>> ❯ head -n 100 /usr/share/tor/geoip
>> # This file has been converted from the IPFire Location database
>> # using Tor's geoip-db-tool, which is available in the
>> # scripts/maint/geoip/geoip-db-tool directory in the Tor source
>> # code repository at https://gitlab.torproject.org/tpo/core/tor/ .
>> #
>> # For more information on the data, see https://location.ipfire.org/.
>> #
>> # Below is the header from the original export:
>> #
>> #
>> # Location Database Export
>> #
>> # Generated: Wed, 06 May 2026 04:32:30 GMT
>> # Vendor:    IPFire Project
>> # License:   CC BY-SA 4.0
>> #
>> # This database has been obtained from https://location.ipfire.org/
>> #
>> # Find the full license terms at
>> https://creativecommons.org/licenses/by-sa/4.0/
>> #
>> 15726992,15726999,??
>> 16777216,16777471,AU
>> 16777472,16778239,CN
>> 16778240,16779263,AU
>> 16779264,16781311,CN
>> 16781312,16785407,JP
>> 16785408,16793599,CN
>> 16793600,16809983,JP
>> 16809984,16842751,TH
>> 16842752,16843007,CN
>> 16843008,16843263,AU
>> 16843264,16859135,CN
>> 16859136,16875519,JP
>> 16875520,16908287,TH
>> [...]
>>
>>
>> If you can make this work with txtorcon, then I guess it would be usable
>> from a licensing point of view. Note that installing tor-geoipdb as a
>> dependency at runtime pulls in the whole of Tor, including the server,
>> via another dependency though. Not sure if that's a good side effect.
>>
>> Cheers
>> Sascha
>>
>> [1]
>> https://gitlab.torproject.org/tpo/core/debian/tor/-/blob/debian-main/debian/tor-geoipdb.copyright?ref_type=heads
>>
>> Attachments:
>> * OpenPGP_signature.asc

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-privacy-maintainers/attachments/20260601/a7dc340b/attachment.sig>