trusted.gpg.d

Package: devuan-keyring; Maintainer for devuan-keyring is Devuan Developers <devuan-dev@lists.dyne.org>; Source for devuan-keyring is src:devuan-keyring.

Reported by: Olaf Meeuwissen <paddy-hack@member.fsf.org>

Date: Sat, 9 Aug 2025 04:58:01 UTC

Severity: grave

Found in version devuan-keyring/2025.07.30

Fixed in version 2025.08.09

Done: dak@devuan.org

Full log

🔗 View this message in rfc822 format

X-Loop: owner@bugs.devuan.org
Subject: bug#902: devuan-keyring: Archive keys not installed below /etc/apt/trusted.gpg.d
Reply-To: Olaf Meeuwissen <paddy-hack@member.fsf.org>, 902@bugs.devuan.org
Resent-From: Olaf Meeuwissen <paddy-hack@member.fsf.org>
Resent-To: devuan-bugs@lists.dyne.org
Resent-CC: Devuan Developers <devuan-dev@lists.dyne.org>
X-Loop: owner@bugs.devuan.org
Resent-Date: Sat, 09 Aug 2025 04:58:01 +0000
Resent-Message-ID: <handler.902.B.1754715432746@bugs.devuan.org>
Resent-Sender: owner@bugs.devuan.org
X-Devuan-PR-Message: report 902
X-Devuan-PR-Package: devuan-keyring
X-Devuan-PR-Keywords: 
X-Devuan-PR-Source: devuan-keyring
Received: via spool by submit@bugs.devuan.org id=B.1754715432746
          (code B); Sat, 09 Aug 2025 04:58:01 +0000
Received: (at submit) by bugs.devuan.org; 9 Aug 2025 04:57:12 +0000
Delivered-To: bugs@devuan.org
Received: from email.devuan.org [2a01:4f9:fff1:13::5fd9:f9e4]
	by doc.devuan.org with IMAP (fetchmail-6.4.16)
	for <debbugs@localhost> (single-drop); Sat, 09 Aug 2025 04:57:12 +0000 (UTC)
Received: from email.devuan.org
	by email.devuan.org with LMTP
	id 9phkFiHVlmgVewAAmSBk0A
	(envelope-from <olaf@ueda.ne.jp>)
	for <bugs@devuan.org>; Sat, 09 Aug 2025 04:57:05 +0000
Received: by email.devuan.org (Postfix, from userid 109)
	id 40DF96B3; Sat,  9 Aug 2025 04:57:05 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on email.devuan.org
X-Spam-Level: 
X-Spam-Status: No, score=-0.0 required=5.0 tests=SPF_PASS,T_SCC_BODY_TEXT_LINE,
	UNPARSEABLE_RELAY autolearn=ham autolearn_force=no version=3.4.6
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=220.100.193.65; helo=hsmtpd-def-c1101.xspmail.jp; envelope-from=olaf@ueda.ne.jp; receiver=<UNKNOWN> 
Received: from hsmtpd-def-c1101.xspmail.jp (hsmtpd-def-c1101.xspmail.jp [220.100.193.65])
	by email.devuan.org (Postfix) with ESMTPS id 7FDF81D
	for <submit@bugs.devuan.org>; Sat,  9 Aug 2025 04:57:02 +0000 (UTC)
X-Country-Code: JP
Received: from basecamp (u004559.ueda.ne.jp [202.213.49.6])
	by hsmtpd-out-2.mose.c1101.xspmail.jp (Halon) with ESMTPSA (TLSv1.3) tls TLS_AES_128_GCM_SHA256
	id 0c5d96ad-8844-4546-905e-019d0bba74f9;
	Sat, 09 Aug 2025 13:56:55 +0900 (JST)
Received: from olaf (uid 1000)
	(envelope-from olaf@ueda.ne.jp)
	id 1ab8ee
	by basecamp (DragonFly Mail Agent v0.13);
	Sat, 09 Aug 2025 13:56:54 +0900
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Olaf Meeuwissen <paddy-hack@member.fsf.org>
To: Devuan Bug Tracking System <submit@bugs.devuan.org>
Message-ID: <175471541405.7365.13707578174712627271.reportbug@basecamp>
X-Mailer: reportbug 13.2.0+devuan1
Date: Sat, 09 Aug 2025 13:56:54 +0900

Package: devuan-keyring
Version: 2025.07.30
Severity: grave
Justification: renders package unusable

Dear Maintainer,

Until the 2025.06.02 version of this package, archive keys were
installed under /etc/apt/trusted.gpg.d/.  However, 2025.07.30 no
longer does.

This prevents downloading anything from the package archives without
errors like this

  $ apt-get update
  Get:1 http://deb.devuan.org/merged ceres InRelease [47.6 kB]
  Err:1 http://deb.devuan.org/merged ceres InRelease
    The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 94532124541922FB
  Reading package lists...
  W: OpenPGP signature verification failed: http://deb.devuan.org/merged ceres InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 94532124541922FB
  E: The repository 'http://deb.devuan.org/merged ceres InRelease' is not signed.

I found out after trying the above command in a freshly debootstrapped
`ceres` for the official Devuan Docker container images I maintain.
See https://git.devuan.org/paddy-hack/container-images/issues/62

To illustrate the issue,

  $ dpkg-deb -c devuan-keyring_2025.06.02_all.deb | grep /etc/apt/trusted.gpg.d
  drwxr-xr-x root/root         0 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/
  -rw-r--r-- root/root      7067 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-2016-archive.gpg
  -rw-r--r-- root/root      9964 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-2022-archive.gpg
  -rw-r--r-- root/root      5481 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-amprolla-2022-archive.gpg
  -rw-r--r-- root/root      4594 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-daedalus-archive.gpg
  -rw-r--r-- root/root      4595 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-excalibur-archive.gpg
  -rw-r--r-- root/root      5226 2025-06-03 01:11 ./etc/apt/trusted.gpg.d/devuan-keyring-freia-archive.gpg
  $ dpkg-deb -c devuan-keyring_2025.07.30_all.deb | grep /etc/apt/trusted.gpg.d

-- System Information:
Architecture: x86_64

Kernel: Linux 6.12.38+deb13-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: runit (via /run/runit.stopit)
LSM: AppArmor: enabled

devuan-keyring depends on no packages.

devuan-keyring recommends no packages.

devuan-keyring suggests no packages.

-- no debconf information

Send a report that this bug log contains spam.

Devuan bug report logs - #902 devuan-keyring: Archive keys not installed below /etc/apt/trusted.gpg.d

Devuan bug report logs - #902
devuan-keyring: Archive keys not installed below /etc/apt/trusted.gpg.d