I did create a gpg key using "gpg --gen-key", here is the listing:

> gpg --list-keys
pub   2048R/99EDE0B7 2013-02-05
uid                  Some Company
sub   2048R/97337D10 2013-02-05

I exported the public key using:

> gpg --output key.pub --armor --export 99EDE0B7

I signed a deb package using:

> dpkg-sig --sign builder -k 99EDE0B7 mypackage.deb

I can verify the signing on the same controller:

> dpkg-sig --verify mypackage.deb 
Processing mypackage.deb...
GOODSIG _gpgbuilder 31C631682D8C1DC833576A283C9A9AA799EDE0B7 1366790488

I import the public key on a different controller:

> apt-key add key.pub
> apt-key list
pub   2048R/99EDE0B7 2013-02-05
uid                  My Company
sub   2048R/97337D10 2013-02-05

But when I verify the package on this new controller the signing is unknown:

> dpkg-sig --verify mypackage.deb 
Processing mypackage.deb...
UNKNOWNSIG _gpgbuilder 99EDE0B7

I must use "gpg --import" to actually verify the package:

> gpg --import key.pub

Then the verification works:

> dpkg-sig --verify mypackage.deb 
Processing mypackage.deb...
GOODSIG _gpgbuilder 980CDF084EC87D4C003E020C4B324EFB85743C26 1366872932

But when using apt to install the package I get an authentication error:

> apt-get install mypackage
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/12.0 kB of archives.
After this operation, 0 B of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
Install these packages without verification [y/N]? 

And I can not figure out why :-(



I think I figured it out myself. apt does not check authentication on individual packages but only on the Release files.


try the following:

  1. extract the content of the deb file using $ ar vx file.deb

  2. check the file _gpgbuilder and that the data file has an extension .tar.gz

IF it has a .tar.xz means that the package was created using a dpkg-deb on Ubuntu which has default compress-type xz (check dpkg-deb's man page on option compress-type/-Z)

dpkg-sig checks for data.tar.gz (as if the file was created with compress-type gzip - default behaviour on Debian).

A small hack would be change the dpkg-sig Perl script to verify even if the data file has extension .tar.xz

Hope it helps. (I've posted this on http://ubuntuforums.org/showthread.php?t=2175836)

Edit: someone made a nice patch http://osdir.com/ml/ubuntu-bugs/2014-07/msg09103.html :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.