Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 0 down vote favorite

I've created a source package for I library I'm working on. I use debuild to build it and then I can successfully upload it with dput.

Now I want to set it up so that I can do this automatically from Jenkins. The main issue I'm running into is signing the .dsc and .changes files. What I'm trying to do is sign the packages with gpg rather than having debuild do it. This way I can sign the files automatically with the gpg option --passphrase-fd 0.

So I use debuild with the options -uc and -us and then clearsign the files with gpg. But when I do this it creates a separate .dsc.asc and source.changes.asc. When I then try to upload with dput I get the error

Checking signature on .changes
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.

This would seem to suggest that I should list the .asc file as an argument to dput but I can't get this to work.

share|improve this question
What's the question?I'd suggest using a gpg key without a passphrase, for automated signing. Or just use launchpad's Daily Builds feature. – tumbleweed Dec 5 '12 at 9:47
The question is: If I sign the files with gpg instead of letting debuild do it, I get a separate source.changes.asc file instead of it signing the sources.changes file in place. How do I upload with dput in this case. – Sean Lynch Dec 6 '12 at 1:10
Also, I don't want to use a gpg key without a passphrase and the project scm is git, so I can't use the daily build feature because it is (as far as I can tell) only applicable to bzr. – Sean Lynch Dec 6 '12 at 1:11
You can set up an automatic import from the git repository to launchpad – tumbleweed Dec 6 '12 at 13:19
Why do you want to use a passphrase, when you are going to be storing this passphrase in a script, that seems stupid. Create a key without a passphrase, that's only used by this job. – tumbleweed Dec 6 '12 at 13:22
show 3 more comments

1 Answer

up vote 0 down vote accepted

The easy answer is: Launchpad daily builds, they do all of this for you, fairly securely.

If you want to be doing source upload from Jenkins, then I suggest creating a key just for this Jenkins job. Having a passphrase on it wouldn't improve the security very much, if the Jenkins job would have to know the passphrase, so one might as well just leave it unprotected.

If you really want to sign the .dsc and .changes files by hand, sign them with gpg --clearsign, and rename the .asc files over the originals.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.