Subject: bug#902 closed by [email-masked] (#902: fixed in src:devuan-keyring version 2025.08.09)

From: "Devuan bug Tracking System" <[email-masked]>
Date: Fri, 15 Aug 2025 15:12:02 +0000

This is an automatic notification regarding your bug report
which was filed against the devuan-keyring package:

#902: devuan-keyring: Archive keys not installed below /etc/apt/trusted.gpg.d

It has been closed by [email-masked].

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact [email-masked] by
replying to this email.

-- 
902: https://bugs.devuan.org/cgi/bugreport.cgi?bug=902
Devuan Bug Tracking System
Contact [email-masked] with problems

Subject: #902: fixed in src:devuan-keyring version 2025.08.09
From: [email-masked]
To: [email-masked]
Date: Fri, 15 Aug 2025 15:10:02 +0000

Version: 2025.08.09

Source package devuan-keyring (2025.08.09) added to Devuan suite unstable.

This closes bug report 902.

Thanks

DAK managing the Devuan archive

Format: 1.8
Date: Sat, 09 Aug 2025 14:58:32 +0100
Source: devuan-keyring
Architecture: source
Version: 2025.08.09
Distribution: unstable
Urgency: medium
Maintainer: Devuan Developers <[email-masked]>
Changed-By: Mark Hindley <[email-masked]>
Closes: 902
Changes:
 devuan-keyring (2025.08.09) unstable; urgency=medium
 .
   * Restore installation of keys (now armoured, as Debian) in
     /etc/apt/trusted.gpg.d. (Closes: #902)
Checksums-Sha1:
 281f4a70a4eba9b66f91018c4209650b8344cccc 1500 devuan-keyring_2025.08.09.dsc
 12d32af5be7aec10722bb231ccf370fab3183413 171472 devuan-keyring_2025.08.09.tar.xz
 24d690cce69a01cbebab6f2e4d6062a24345593e 6568 devuan-keyring_2025.08.09_source.buildinfo
Checksums-Sha256:
 8de02f5f4d875335383e40a9c9e106117f2d2ddd61ff203306388d17e0bfdc1e 1500 devuan-keyring_2025.08.09.dsc
 2f8c42ef762a1c371b49b2623ed153d0d8266cce78d68e0dc4a7b6734a66ef64 171472 devuan-keyring_2025.08.09.tar.xz
 a04e404a64dd28967edfacc1241e5f750c4ac957453006790406a18c303279fb 6568 devuan-keyring_2025.08.09_source.buildinfo
Files:
 2ee4e7f242a86658057df1df371af765 1500 misc optional devuan-keyring_2025.08.09.dsc
 d7379336aa7b441b957cc3f89f6d4c54 171472 misc optional devuan-keyring_2025.08.09.tar.xz
 af2b10553773f2cad6713382ab98c86c 6568 misc optional devuan-keyring_2025.08.09_source.buildinfo

Subject: devuan-keyring: Archive keys not installed below /etc/apt/trusted.gpg.d
From: Olaf Meeuwissen <[email-masked]>
To: Devuan Bug Tracking System <[email-masked]>
Date: Sat, 09 Aug 2025 13:56:54 +0900

Package: devuan-keyring
Version: 2025.07.30
Severity: grave
Justification: renders package unusable

Dear Maintainer,

Until the 2025.06.02 version of this package, archive keys were
installed under /etc/apt/trusted.gpg.d/.  However, 2025.07.30 no
longer does.

This prevents downloading anything from the package archives without
errors like this

  $ apt-get update
  Get:1 http://deb.devuan.org/merged ceres InRelease [47.6 kB]
  Err:1 http://deb.devuan.org/merged ceres InRelease
    The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 94532124541922FB
  Reading package lists...
  W: OpenPGP signature verification failed: http://deb.devuan.org/merged ceres InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 94532124541922FB
  E: The repository 'http://deb.devuan.org/merged ceres InRelease' is not signed.

I found out after trying the above command in a freshly debootstrapped
`ceres` for the official Devuan Docker container images I maintain.
See https://git.devuan.org/paddy-hack/container-images/issues/62

To illustrate the issue,

  $ dpkg-deb -c devuan-keyring_2025.06.02_all.deb | grep /etc/apt/trusted.gpg.d
  drwxr-xr-x root/root         0 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/
  -rw-r--r-- root/root      7067 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-2016-archive.gpg
  -rw-r--r-- root/root      9964 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-2022-archive.gpg
  -rw-r--r-- root/root      5481 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-amprolla-2022-archive.gpg
  -rw-r--r-- root/root      4594 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-daedalus-archive.gpg
  -rw-r--r-- root/root      4595 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-excalibur-archive.gpg
  -rw-r--r-- root/root      5226 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-freia-archive.gpg
  $ dpkg-deb -c devuan-keyring_2025.07.30_all.deb | grep /etc/apt/trusted.gpg.d

-- System Information:
Architecture: x86_64

Kernel: Linux 6.12.38+deb13-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: runit (via /run/runit.stopit)
LSM: AppArmor: enabled

devuan-keyring depends on no packages.

devuan-keyring recommends no packages.

devuan-keyring suggests no packages.

-- no debconf information