12

I was trying to recompile and rebuild libevent2 source from oneiric on my natty server and I had a small error with gpg not being able to check signature

# dpkg-source -x libevent_2.0.12-stable-1.dsc
gpgv: Signature made Fri Jun 17 07:12:50 2011 PDT using DSA key ID 7ADF9466
gpgv: Can't check signature: public key not found
dpkg-source: warning: failed to verify signature on ./libevent_2.0.12-stable-1.dsc

Any idea how to fix this warning?

0

3 Answers 3

12

I believe the conventional solution is to install the GnuPG keys of Debian Developers package:

sudo apt-get install debian-keyring
1
  • Yes, the gpg commands suggested here by @enzotib and @Flint did not work for me on Ubuntu 14.04, at least for enabling validation when running apt-get source. But installing the debian-keyring package worked, as @ændrük suggests.
    – fjarlq
    May 5, 2014 at 18:54
11

First of all, you should import the key to local keyring as @enzotib instructed:

gpg --keyserver keyserver.ubuntu.com --recv-keys 7ADF9466

Then export the key to your local trustedkeys to make it trusted:

gpg --no-default-keyring -a --export 7ADF9466 | gpg --no-default-keyring --keyring ~/.gnupg/trustedkeys.gpg --import -
1
  • This works in Ubuntu 16.04 where ~/.gnupg/trustedkeys.gpg did not exist. Jun 12, 2017 at 17:04
6

You should import the key to local keyring with the following command:

gpg --keyserver keyserver.ubuntu.com --recv-keys 7ADF9466

Then, try again the command.

3
  • 1
    Thanks but it still failed to verify the signature
    – Flint
    Aug 12, 2011 at 16:56
  • 2
    @Flint: you are running as root, so also this command should be run as root, to go to root keyring. Have you done so?
    – enzotib
    Aug 12, 2011 at 17:16
  • 6
    Are there any official sources documenting that this approach is secure? How could I know that 7ADF9466 is indeed the correct signing key if it does not exist in the keyring package? What prevents a man in the middle from serving a dsc file signed with a different key (possibly even a different key with the same 32 bit hash).
    – kasperd
    Aug 10, 2014 at 19:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .