0

I've created a source package for I library I'm working on. I use debuild to build it and then I can successfully upload it with dput.

Now I want to set it up so that I can do this automatically from Jenkins. The main issue I'm running into is signing the .dsc and .changes files. What I'm trying to do is sign the packages with gpg rather than having debuild do it. This way I can sign the files automatically with the gpg option --passphrase-fd 0.

So I use debuild with the options -uc and -us and then clearsign the files with gpg. But when I do this it creates a separate .dsc.asc and source.changes.asc. When I then try to upload with dput I get the error

Checking signature on .changes
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.

This would seem to suggest that I should list the .asc file as an argument to dput but I can't get this to work.

8
  • What's the question?I'd suggest using a gpg key without a passphrase, for automated signing. Or just use launchpad's Daily Builds feature.
    – tumbleweed
    Dec 5, 2012 at 9:47
  • The question is: If I sign the files with gpg instead of letting debuild do it, I get a separate source.changes.asc file instead of it signing the sources.changes file in place. How do I upload with dput in this case.
    – Sean Lynch
    Dec 6, 2012 at 1:10
  • Also, I don't want to use a gpg key without a passphrase and the project scm is git, so I can't use the daily build feature because it is (as far as I can tell) only applicable to bzr.
    – Sean Lynch
    Dec 6, 2012 at 1:11
  • You can set up an automatic import from the git repository to launchpad
    – tumbleweed
    Dec 6, 2012 at 13:19
  • Why do you want to use a passphrase, when you are going to be storing this passphrase in a script, that seems stupid. Create a key without a passphrase, that's only used by this job.
    – tumbleweed
    Dec 6, 2012 at 13:22

2 Answers 2

8

I found the following solution with debsign and the -p option:

  • use debuild without the signature, as you mentioned
  • use then debsign with -p option setting the passphrase to use, like this

    debsign \
      -p'gpg --passphrase-file /home/myname/my_passphrase_file.txt --batch --no-use-agent'\
      -S -kMYKEYID package_source.change
    

Still having some other issues, but this part looks like working. Signing files with GPG directly does not work as the checksums computed during the debuild are changed.

I always prefer storing keys with passphrase anyway.

3
  • This should be the correct answer Jul 26, 2017 at 23:24
  • Warning: anyone with access to the my_passphrase file can publish packages in your name and maybe inject malicious code, which is then installed automatically for all users trusting your signature!!!
    – Ichthyo
    Sep 17, 2022 at 17:19
  • This is why you use gpg subkeys: that specific subkey can be revoked without compromising too much your gpg identity. Any fully automated method needs a passphrase to be stored clear text: there is no magic here. The computer on which this is executed should be secured as you transfer trust to that computer to sign on your behalf.
    – Raffi
    Sep 18, 2022 at 18:54
1

The easy answer is: Launchpad daily builds, they do all of this for you, fairly securely.

If you want to be doing source upload from Jenkins, then I suggest creating a key just for this Jenkins job. Having a passphrase on it wouldn't improve the security very much, if the Jenkins job would have to know the passphrase, so one might as well just leave it unprotected.

If you really want to sign the .dsc and .changes files by hand, sign them with gpg --clearsign, and rename the .asc files over the originals.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .