Subject: devuan-keyring: Archive keys not installed below /etc/apt/trusted.gpg.d

From: Olaf Meeuwissen <[email-masked]>
Date: Sat, 09 Aug 2025 13:56:54 +0900

Package: devuan-keyring
Version: 2025.07.30
Severity: grave
Justification: renders package unusable

Dear Maintainer,

Until the 2025.06.02 version of this package, archive keys were
installed under /etc/apt/trusted.gpg.d/.  However, 2025.07.30 no
longer does.

This prevents downloading anything from the package archives without
errors like this

  $ apt-get update
  Get:1 http://deb.devuan.org/merged ceres InRelease [47.6 kB]
  Err:1 http://deb.devuan.org/merged ceres InRelease
    The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 94532124541922FB
  Reading package lists...
  W: OpenPGP signature verification failed: http://deb.devuan.org/merged ceres InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 94532124541922FB
  E: The repository 'http://deb.devuan.org/merged ceres InRelease' is not signed.

I found out after trying the above command in a freshly debootstrapped
`ceres` for the official Devuan Docker container images I maintain.
See https://git.devuan.org/paddy-hack/container-images/issues/62

To illustrate the issue,

  $ dpkg-deb -c devuan-keyring_2025.06.02_all.deb | grep /etc/apt/trusted.gpg.d
  drwxr-xr-x root/root         0 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/
  -rw-r--r-- root/root      7067 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-2016-archive.gpg
  -rw-r--r-- root/root      9964 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-2022-archive.gpg
  -rw-r--r-- root/root      5481 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-amprolla-2022-archive.gpg
  -rw-r--r-- root/root      4594 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-daedalus-archive.gpg
  -rw-r--r-- root/root      4595 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-excalibur-archive.gpg
  -rw-r--r-- root/root      5226 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-freia-archive.gpg
  $ dpkg-deb -c devuan-keyring_2025.07.30_all.deb | grep /etc/apt/trusted.gpg.d

-- System Information:
Architecture: x86_64

Kernel: Linux 6.12.38+deb13-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: runit (via /run/runit.stopit)
LSM: AppArmor: enabled

devuan-keyring depends on no packages.

devuan-keyring recommends no packages.

devuan-keyring suggests no packages.

-- no debconf information

---

From: Mark Hindley <[email-masked]>
Date: Sat, 9 Aug 2025 18:04:22 +0100

Olaf,

Thanks for this.

I propose the attached changes which

 - restore installation of keys in /etc/apt/trusted.gpg
 - change the keys to ascii armoured (as Debian already does)
 - handles the renamed conffiles.

Boian,

Any comments?

Mark

diff --git a/Makefile b/Makefile
index 391fa64..35b5fe8 100644
--- a/Makefile
+++ b/Makefile
@@ -8,10 +8,13 @@ INDIVIDUAL_KEYS := $(wildcard public_keys/individual/*.pgp)
 ARCHIVE_KEYS := $(wildcard public_keys/archive/*.pgp)
 REMOVED_KEYS := $(wildcard public_keys/removed/*.pgp)
 
-all: keyrings/devuan-archive-keyring.pgp keyrings/devuan-keyring.pgp keyrings/devuan-removed-keys.pgp
+all: keyrings/devuan-archive-keyring.pgp keyrings/devuan-keyring.pgp keyrings/devuan-removed-keys.pgp $(patsubst %.pgp,%.asc,$(ARCHIVE_KEYS))
 
 .DELETE_ON_ERROR:
 
+%.asc : %.pgp
+	gpg --armor --export --no-default-keyring --keyring $< > $@
+
 keyrings/gnupg:
 	install -m700 -d $@
 
@@ -49,6 +52,6 @@ refresh: | keyrings/gnupg
 	done
 
 clean:
-	rm -fr keyrings
+	rm -fr keyrings public_keys/archive/*.asc
 
 .PHONY: clean refresh
diff --git a/debian/changelog b/debian/changelog
index 5fb94a8..a851aba 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+devuan-keyring (2025.08.09) unstable; urgency=medium
+
+  * Restore installation of keys (now ascii armoured, as Debian) in
+    /etc/apt/trusted.gpg.d. (Closes: #902)
+
+ -- Mark Hindley <[email-masked]>  Sat, 09 Aug 2025 14:58:32 +0100
+
 devuan-keyring (2025.07.30) unstable; urgency=medium
 
   [ Boian Bonev ]
diff --git a/debian/install b/debian/install
index 92b5554..17299a5 100644
--- a/debian/install
+++ b/debian/install
@@ -1,2 +1,3 @@
 keyrings/devuan-*.pgp /usr/share/keyrings
 keyrings/devuan-*.gpg /usr/share/keyrings
+public_keys/archive/*.asc /etc/apt/trusted.gpg.d
diff --git a/debian/maintscript b/debian/maintscript
new file mode 100644
index 0000000..34172df
--- /dev/null
+++ b/debian/maintscript
@@ -0,0 +1,7 @@
+mv_conffile /etc/apt/trusted.gpg.d/devuan-keyring-2016-archive.gpg /etc/apt/trusted.gpg.d/devuan-keyring-2016-archive.asc 2025-08-09
+mv_conffile /etc/apt/trusted.gpg.d/devuan-keyring-2022-archive.gpg /etc/apt/trusted.gpg.d/devuan-keyring-2022-archive.asc 2025-08-09
+mv_conffile /etc/apt/trusted.gpg.d/devuan-keyring-amprolla-2022-archive.gpg /etc/apt/trusted.gpg.d/devuan-keyring-amprolla-2022-archive.asc 2025-08-09
+mv_conffile /etc/apt/trusted.gpg.d/devuan-keyring-daedalus-archive.gpg /etc/apt/trusted.gpg.d/devuan-keyring-daedalus-archive.asc 2025-08-09
+mv_conffile /etc/apt/trusted.gpg.d/devuan-keyring-dak-2025-archive.gpg /etc/apt/trusted.gpg.d/devuan-keyring-dak-2025-archive.asc 2025-08-09
+mv_conffile /etc/apt/trusted.gpg.d/devuan-keyring-excalibur-archive.gpg /etc/apt/trusted.gpg.d/devuan-keyring-excalibur-archive.asc
+mv_conffile /etc/apt/trusted.gpg.d/devuan-keyring-freia-archive.gpg /etc/apt/trusted.gpg.d/devuan-keyring-freia-archive.asc

---

From: Olaf Meeuwissen <[email-masked]>
Date: Sun, 10 Aug 2025 09:41:41 +0900

Mark,

Thanks for the quick response on this.

Two nitpicks:
- s/ascii/ASCII/g, to avoid confusion with Devuan's ascii release ;-)
- /etc/apt/trusted.gpg.d/ becomes a bit of a misnomer when it only has
  *.asc files

One question:
- Does the patch also add /var/lib/dpkg/info/devuan-keyring.conffiles?
  That file was missing after installing 2025.07.30.

Hope this helps,
--
Olaf Meeuwissen

---

From: Mark Hindley <[email-masked]>
Date: Sun, 10 Aug 2025 07:23:11 +0100

Olaf,

Thanks.

> - s/ascii/ASCII/g, to avoid confusion with Devuan's ascii release ;-)

Good point: even the Devuan release is occasionally uppercase. I will remove it
completely and just refer to 'armoured'.

> - /etc/apt/trusted.gpg.d/ becomes a bit of a misnomer when it only has

Yes. That requires coordination with apt. I expect that will get updated in
Debian during the next cycle.

>   That file was missing after installing 2025.07.30.

Yes, that is restored and contains

  /etc/apt/trusted.gpg.d/devuan-keyring-2016-archive.asc
  /etc/apt/trusted.gpg.d/devuan-keyring-2022-archive.asc
  /etc/apt/trusted.gpg.d/devuan-keyring-amprolla-2022-archive.asc
  /etc/apt/trusted.gpg.d/devuan-keyring-daedalus-archive.asc
  /etc/apt/trusted.gpg.d/devuan-keyring-dak-2025-archive.asc
  /etc/apt/trusted.gpg.d/devuan-keyring-excalibur-archive.asc
  /etc/apt/trusted.gpg.d/devuan-keyring-freia-archive.asc
  /etc/apt/trusted.gpg.d/devuan-keyring-gryphon-archive.asc

Once I have and ACK from Boian, I will build.

Mark

---

From: Boian Bonev <[email-masked]>
Date: Sun, 10 Aug 2025 15:44:11 +0300

Hi,

I was trying to reproduce w/o success... Tried all combinations of
gpgv/sqv and whats not else. Then did a fresh debootstrap and the
problem is present there.

The difference between my test system and the new chroot came to be
modernized apt sources (apt modernize-sources). That includes:

	Signed-By: /usr/share/keyrings/devuan-archive-keyring.gpg

which obviously resolves the problem. And that was the reason my
testing of the devuan-keyring showed no problems before it got built :(

Let's restore the .asc files in /etc/apt/trusted.gpg.d/
and keep the pgp extension change (including the gpg symlinks). That is
most closely following debian-archive-keyring.

With best regards,
b.