gpgv is intended for use in constrained environments, so minimal dependencies are a useful property.
the 2.4 series introduces a dependency on libassuan because of the communications to keyboxd in g10/call-keyboxd.c, where all the keydb-handling code has migrated to.
Since gpgv doesn't actually talk to keyboxd, this additional linkage is unnecessary, and indeed is causing problems for debian's installer, which depends on gpgv, as reported at https://bugs.debian.org/1102621
This patch avoids the unnecessary libassuan linkage by creating a set of stub functions to handle the keydb formats while avoiding potential callouts to keyboxd:
(edit: patch updated to keep tests building correctly)
Hm, we probably should avoid gpgv linking to npth as well, as that's also a sticking point in debian. This updated patch (also targeting the 2.4 branch) also has gpgv building against libcommon instead of libcommonpth, which appears to remove the dependency for me.
And, one more update, to fix win32 builds under --disable-npth. This is a roll-up patch that i think covers everything, you can disregard the earlier patches posted here.