apt authentication failure on self-signed package

Question

I did create a gpg key using "gpg --gen-key", here is the listing:

> gpg --list-keys
/home/<user>/.gnupg/pubring.gpg
--------------------------------
pub   2048R/99EDE0B7 2013-02-05
uid                  Some Company
sub   2048R/97337D10 2013-02-05

I exported the public key using:

> gpg --output key.pub --armor --export 99EDE0B7

I signed a deb package using:

> dpkg-sig --sign builder -k 99EDE0B7 mypackage.deb

I can verify the signing on the same controller:

> dpkg-sig --verify mypackage.deb 
Processing mypackage.deb...
GOODSIG _gpgbuilder 31C631682D8C1DC833576A283C9A9AA799EDE0B7 1366790488

I import the public key on a different controller:

> apt-key add key.pub
OK
> apt-key list
/etc/apt/trusted.gpg
--------------------
pub   2048R/99EDE0B7 2013-02-05
uid                  My Company
sub   2048R/97337D10 2013-02-05

But when I verify the package on this new controller the signing is unknown:

> dpkg-sig --verify mypackage.deb 
Processing mypackage.deb...
UNKNOWNSIG _gpgbuilder 99EDE0B7

I must use "gpg --import" to actually verify the package:

> gpg --import key.pub

Then the verification works:

> dpkg-sig --verify mypackage.deb 
Processing mypackage.deb...
GOODSIG _gpgbuilder 980CDF084EC87D4C003E020C4B324EFB85743C26 1366872932

But when using apt to install the package I get an authentication error:

> apt-get install mypackage
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  mypackage
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/12.0 kB of archives.
After this operation, 0 B of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
  mypackage
Install these packages without verification [y/N]? 

And I can not figure out why :-(

thx!

Answer 1

I think I figured it out myself. apt does not check authentication on individual packages but only on the Release files.

Answer 2

try the following:

1. extract the content of the deb file using $ ar vx file.deb

2. check the file _gpgbuilder and that the data file has an extension .tar.gz

IF it has a .tar.xz means that the package was created using a dpkg-deb on Ubuntu which has default compress-type xz (check dpkg-deb's man page on option compress-type/-Z)

dpkg-sig checks for data.tar.gz (as if the file was created with compress-type gzip - default behaviour on Debian).

A small hack would be change the dpkg-sig Perl script to verify even if the data file has extension .tar.xz

Hope it helps. (I've posted this on http://ubuntuforums.org/showthread.php?t=2175836)

Edit: someone made a nice patch http://osdir.com/ml/ubuntu-bugs/2014-07/msg09103.html :)