GPG invalid signature on self-signed repository

Question

Foreword: we are using Spacewalk to distribute some internal packages to Ubuntu systems via a private repository, thus necessitating the self-signing. Unfortunately Spacewalk doesn't handle the signing portion of this yet, so it has to be done manually.

We are having issues with apt stating that signatures are invalid for the Release files::

# apt update  
Apt-Spacewalk: Updating sources.list  
Ign:1 spacewalk://spacewalk.server extras-ubuntu InRelease  
[...]  
Reading package lists... Done  
W: GPG error: spacewalk://spacewalk.server extras-ubuntu Release: 
The following signatures were invalid: 41CDF527725B5CD68EA405AA27D22AF72385D175  

The key is imported to apt-key

# apt-key list
/etc/apt/trusted.gpg
--------------------
pub   rsa2048 2018-03-23 [SC]
       41CD F527 725B 5CD6 8EA4  05AA 27D2 2AF7 2385 D175
uid           [ unknown] Spacewalk (For GPG signing APT repos) <nobody@nowhere>

And the Release file is, in fact, signed with the correct key:

# gpg -k
/root/.gnupg/pubring.gpg
------------------------
pub   2048R/2385D175 2018-03-23
uid                  Spacewalk (For GPG signing APT repos) <nobody@nowhere>

# gpg ./Release.gpg
Detached signature.
Please enter name of data file: Release
gpg: Signature made Fri 23 Mar 2018 10:43:50 AM EDT using RSA key ID 2385D175
gpg: Good signature from "Spacewalk (For GPG signing APT repos) <nobody@nowhere>"

What is the cause of this invalid signature error and how can we fix it? We strictly followed the instructions on http://www.devops-blog.net/spacewalk/gpg-signing-apt-repository-in-spacewalk so everything seems like it should work, but it doesn't.

Answer 1

I was running into the same issue on a local Debian 9 repo, not Spacewalk specific. Tracked it down to:

• Needed SHA-256 for the key
• Using "signed-by" to the gpg key in the sources.list
• Device public key could not be ASCII, must be binary

Figured it out by reading the documentation Instructions to connect to a third-party repository