2

Why does debsig-verify fail to verify when the _gpgorigin detached signature matches the combined debian-binary control.tar.gz data.tar.gz file?

Is it because of this WARNING: This key is not certified with a trusted signature!?

On debian:7 docker container package signing worked well and on debian:9.8 it fails with

gpg: no valid OpenPGP data found.
    gpg: processing message failed: Unknown system error
    debsig: subprocess getKeyID returned error exit status 2

Signing Process

# Unpack
ar x unsigned.deb

# Generate combine file
cat debian-binary control.tar.gz data.tar.gz > combined

# Create detached signature for combined
gpg -abs -o _gpgorigin combined

# Repack
ar rc signed.deb _gpgorigin debian-binary control.tar.gz data.tar.gz

Verify detached signature (seems successful)

gpg --output doc --decrypt _gpgorigin
        Detached signature.
        Please enter name of data file: combined
        gpg: Signature made Thu Apr 25 22:43:37 2019 UTC
        gpg:                using RSA key AAAABBBBCCCCDDDD996FCC98FFFFFFFFFFFFFFFF
        gpg: Good signature from "mygroup Testing <[email protected]>" [unknown]
        gpg: WARNING: This key is not certified with a trusted signature!
        gpg:          There is no indication that the signature belongs to the owner.
        Primary key fingerprint: AAAA BBBB CCCC DDDD 996F CC98 FFFF FFFF FFFF FFFF

Verify signed package (fails)

debsig-verify -v -d signed.deb

    debsig: Starting verification for: signed.deb
    debsig:         getSigKeyID: got FFFFFFFFFFFFFFFF for origin key
    debsig: Using policy directory: /etc/debsig/policies/FFFFFFFFFFFFFFFF
    debsig:   Parsing policy file: /etc/debsig/policies/FFFFFFFFFFFFFFFF/mygroup-test.pol
    debsig:     parsePolicyFile: parsing '/etc/debsig/policies/FFFFFFFFFFFFFFFF/mygroup-test.pol'
    debsig:     parsePolicyFile: completed
    debsig:     Checking Selection group(s).
    debsig:       Processing 'origin' key...
    gpg: no valid OpenPGP data found.
    gpg: processing message failed: Unknown system error
    debsig: subprocess getKeyID returned error exit status 2

Key Listing for policie's keyring

 gpg --no-default-keyring --keyring  /usr/share/debsig/keyrings/FFFFFFFFFFFFFFFF/pubring.gpg --list-sigs
/usr/share/debsig/keyrings/FFFFFFFFFFFFFFFF/pubring.gpg
-------------------------------------------------------
pub   rsa2048 2017-06-19 [SC]
      AAAABBBBCCCCDDDD996FCC98FFFFFFFFFFFFFFFF
uid           [ unknown] MyGroup Testing <[email protected]>
sig 3        FFFFFFFFFFFFFFFF 2017-06-19  MyGroup Testing <[email protected]>
sub   rsa2048 2017-06-19 [E]
sig          FFFFFFFFFFFFFFFF 2017-06-19  MyGroup Testing <[email protected]>


2 Answers 2

2

I've just had a similar problem, and found a number of things that I was doing wrong, that aren't obvious from the documentation/examples:

  1. make sure that the policy file has the XML namespace using https (not http as the few examples use) i.e. <Policy xmlns="https://www.debian.org/debsig/1.0/">

  2. the 'keyring' file isn't a keyring, it's just a (public) key.

  3. the 'keyring' file must NOT be ASCII-armoured.

With the above changes, package verification succeeded (Ubuntu 18.04)

2
  • oooooh. Thank you so much. I am using http which was A - OK in earlier debian
    – Peter Kahn
    May 2, 2019 at 14:22
  • I believe I have a similar problem, but after changing http to https I still cannot make debsig-verify work. I created a new question in superuser, superuser.com/questions/1504081 .
    – jme52
    Nov 21, 2019 at 21:44
1

I had the same error. To clarify Anthony's answer, the key file cannot be imported to the keyring. It has to be a public key that is copied to the keyring folder. (Example using DDDF2F4CE732A79A)

This will cause the error

$ gpg --no-default-keyring \
      --keyring /usr/share/debsig/keyrings/DDDF2F4CE732A79A/debsig.gpg \
      --import <public key>

This will work

$ cp <public key> /usr/share/debsig/keyrings/DDDF2F4CE732A79A/debsig.gpg

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.