Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I was trying to recompile and rebuild libevent2 source from oneiric on my natty server and I had a small error with gpg not being able to check signature

# dpkg-source -x libevent_2.0.12-stable-1.dsc
gpgv: Signature made Fri Jun 17 07:12:50 2011 PDT using DSA key ID 7ADF9466
gpgv: Can't check signature: public key not found
dpkg-source: warning: failed to verify signature on ./libevent_2.0.12-stable-1.dsc

Any idea how to fix this warning?

share|improve this question

3 Answers 3

You should import the key to local keyring with the following command:

gpg --keyserver keyserver.ubuntu.com --recv-keys 7ADF9466

Then, try again the command.

share|improve this answer
    
Thanks but it still failed to verify the signature –  Flint Aug 12 '11 at 16:56
1  
@Flint: you are running as root, so also this command should be run as root, to go to root keyring. Have you done so? –  enzotib Aug 12 '11 at 17:16
    
Are there any official sources documenting that this approach is secure? How could I know that 7ADF9466 is indeed the correct signing key if it does not exist in the keyring package? What prevents a man in the middle from serving a dsc file signed with a different key (possibly even a different key with the same 32 bit hash). –  kasperd Aug 10 at 19:35

I believe the conventional solution is to install the GnuPG keys of Debian Developers package:

sudo apt-get install debian-keyring
share|improve this answer
    
Yes, the gpg commands suggested here by @enzotib and @Flint did not work for me on Ubuntu 14.04, at least for enabling validation when running apt-get source. But installing the debian-keyring package worked, as @ændrük suggests. –  Matt Day May 5 at 18:54
up vote 3 down vote accepted

I know this is old question but I wanted to post the solution that I have found somewhere else here in case anyone else is also having this problem

First of all, you should import the key to local keyring as @enzotib instructed

gpg --keyserver keyserver.ubuntu.com --recv-keys 7ADF9466

Then export the key to your local trustedkeys to make it trusted

gpg --no-default-keyring -a --export 7ADF9466 | gpg --no-default-keyring --keyring ~/.gnupg/trustedkeys.gpg --import -

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.