1

How can I remove signatures from a deb package signed with a gpg key by dpkg-sig?

I have a particular apt repository that I've set up, which through research and testing led me to manually sign my deb packages.

I've tested it out on a package and signed it multiple times with the same key. Now there are three signatures wrapped around the deb package.

The command used for signing the package was:

dpkg-sig -k ######## --sign bulder xul-ext-ubufox_3.0-0ubuntu0.14.10.1_all.deb
Improve this question

2 Answers 2

Reset to default
3

I'm not sure if there's a better way, but at the very least you could remove the signature "manually" with ar:

ar d "$yourpackage.deb" _gpgbuilder

(or additional things besides _gpgbuilder if you accomplished having "three signatures" by giving role names other than "builder").

This works because .deb files, at the outermost layer, are essentially just "ar" archives, and embedded deb sigs are stored in that outermost layer. There is a small difference between .debs created with dpkg and those created with ar, so normally it's a good idea to stick to real dpkg tools when manipulating deb files, but all modern tools (afaik) can handle both just fine.

Improve this answer
0
0

For embedded signatures, you can open the .deb file with file-roller, and remove the embedded signature file. You can also use ar with ar d package.deb _gpgbuilder.

For detached signatures, you can just open the xul-ext-ubufox_3.0-0ubuntu0.14.10.1.dsc file in a text editor, and should be able to remove the extra signature blocks from the bottom of the file.

If you did the same for the source package as well, you can perform a similar action on the _source.changes file.

Improve this answer
5
  • 1
    dpkg-sig creates an embedded signature in a .deb file, not a signed .dsc or .changes file. This is not a very common thing, still; most end-user tools and public repositories tend to rely solely on signed Release files for integrity checks. But embedded sigs have been possible for over a decade and might eventually gain some traction.
    – the paul
    Apr 16, 2015 at 4:19
  • @thepaul is right. It's embedded and not in a separate signature file.
    – naisanza
    Apr 16, 2015 at 13:59
  • @thepaul - speaking of signed Release files for integrity checks; the Release file is verifiable. I have mine signed but it still refuses trust packages from my local repository.
    – naisanza
    Apr 16, 2015 at 14:06
  • Oh right. I've updated the answer to suggest how to do it for both embedded and detached now.
    – dobey
    Apr 16, 2015 at 14:09
  • As for my question about signed Release files for integrity checks, I found this solution: askubuntu.com/questions/136607/…
    – naisanza
    Apr 16, 2015 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .