12

Trying to download Django source package using dget and the .dsc file from here.

Then dget fails to verify the source, because it is missing a public key.

$ dget https://launchpad.net/ubuntu...
[...]
dscverify: python-django_1.4.1-2.dsc failed signature check:
gpg: Signature made Tue 21 Aug 2012 09:12:04 CEST using RSA key ID F2AC729A
gpg: Can't check signature: public key not found
Validation FAILED!!

Fine, I added this key to my keyring, because I think I can trust this one:

$ gpg --keyserver keyserver.ubuntu.com --recv-key 0xF2AC729A
gpg: requesting key F2AC729A from hkp server keyserver.ubuntu.com
gpg: key F2AC729A: "Raphaël Hertzog <raphael@ouaza.com>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

(well, this output is run afterwards, when it was already in my keyring)

And it is really there:

$ gpg --fingerprint F2AC729A
pub   4096R/F2AC729A 2009-05-07
      Key fingerprint = 3E4F B711 7877 F589 DBCF  06D6 E619 045D F2AC 729A
uid                  Raphaël Hertzog <raphael@ouaza.com>
uid                  Raphaël Hertzog (Debian) <hertzog@debian.org>
uid                  Raphaël Hertzog (Freexian SARL) <raphael@freexian.com>
sub   2048R/71F23DEE 2009-05-07

But still fails for the same reason:

gpg: Signature made Tue 21 Aug 2012 09:12:04 CEST using RSA key ID F2AC729A
gpg: Can't check signature: public key not found

I'm running all these commands as my regular user. I also tried adding this key to APT's keyring and root's keyring. Both to no avail.

What am I missing here?

11

I got the same problem as you and after checking the man page of dscverify I found a solution:

Add following line to your ~/.devscripts:

DSCVERIFY_KEYRINGS="/etc/apt/trusted.gpg:~/.gnupg/pubring.gpg"
2

You can reverse files and use /etc/devscripts.conf:

DSCVERIFY_KEYRINGS="~/.gnupg/pubring.gpg:/etc/apt/trusted.gpg"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.