Your message dated Sun, 02 May 2021 19:34:19 +0000
with message-id <[email protected]>
and subject line Bug#985712: fixed in devscripts 2.21.2
has caused the Debian Bug report #985712,
regarding dscverify doesn't check against the non-uploading developer keyring
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
985712: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985712
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: devscripts
Version: 2.21.1
Severity: normal
X-Debbugs-Cc: [email protected]
Tags: patch
Dear Maintainer,
When using dget to get a package I uploaded, dscverify was unable to
verify my signature[1]. It is, however, in the debian-nonupload.gpg
keyring[2]. DDs non-uploading are treated like DMs for uploading
packages [3].
See the attached patch[4], which I will be submitting to salsa as soon
as I have a bug report number.
Thanks!
Taowa
[1]
taowa@tarteausucre:~/debian/yubikey-manager/unblock$ dscverify
yubikey-manager_4.0.0~a1-3.dsc
yubikey-manager_4.0.0~a1-3.dsc:
dscverify: yubikey-manager_4.0.0~a1-3.dsc failed signature check:
gpg: WARNING: no command supplied. Trying to guess what you mean ...
gpg: Signature made Sat 20 Mar 2021 04:52:15 PM EDT
gpg: using RSA key 6EFF24397EA032A9159404AC08F9E3E20C2C79A7
gpg: Can't check signature: No public key
Validation FAILED!!
[2]
gpg --keyring /usr/share/keyrings/debian-nonupload.gpg --no-default-keyring
--list-key --with-subkey-fingerprint taowa
pub rsa4096 2018-07-10 [C] [expires: 2022-12-31]
8FB9C5D6AE7BA82B7BB1D887C51EA7006E6BDC0D
...
uid [ultimate] Taowa <[email protected]>
...
sub rsa4096 2020-04-28 [S] [expires: 2021-12-31]
6EFF24397EA032A9159404AC08F9E3E20C2C79A7
[3]
https://salsa.debian.org/ftp-team/dak/commit/39205cff6633040adecfdf0f7e4e5db06431a03c
[4]
diff --git a/scripts/dscverify.1 b/scripts/dscverify.1
index a0452f84..151885f8 100644
--- a/scripts/dscverify.1
+++ b/scripts/dscverify.1
@@ -73,6 +73,8 @@ locations:
- /usr/share/keyrings/debian-keyring.gpg
- /usr/share/keyrings/debian-maintainers.gpg
+
+- /ush/share/keyrings/debian-nonupload.gpg
.SH "SEE ALSO"
.BR gpg (1),
.BR gpg2 (1),
diff --git a/scripts/dscverify.pl b/scripts/dscverify.pl
index 8ae2c340..8ec02946 100755
--- a/scripts/dscverify.pl
+++ b/scripts/dscverify.pl
@@ -95,7 +95,8 @@ sub xdie {
sub get_rings {
my @rings = @_;
my @keyrings = qw(/usr/share/keyrings/debian-keyring.gpg
- /usr/share/keyrings/debian-maintainers.gpg);
+ /usr/share/keyrings/debian-maintainers.gpg
+ /usr/share/keyrings/debian-nonupload.gpg);
$ENV{HOME} = File::HomeDir->my_home;
if (defined $ENV{HOME} && -r "$ENV{HOME}/.gnupg/trustedkeys.gpg") {
unshift(@keyrings, "$ENV{HOME}/.gnupg/trustedkeys.gpg");
--
Taowa (they)
taowa.ca
LOC FN35EM
--- End Message ---
--- Begin Message ---
Source: devscripts
Source-Version: 2.21.2
Done: Mattia Rizzolo <[email protected]>
We believe that the bug you reported is fixed in the latest version of
devscripts, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mattia Rizzolo <[email protected]> (supplier of updated devscripts package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 02 May 2021 20:57:28 +0200
Source: devscripts
Architecture: source
Version: 2.21.2
Distribution: unstable
Urgency: medium
Maintainer: Devscripts Maintainers <[email protected]>
Changed-By: Mattia Rizzolo <[email protected]>
Closes: 972585 983271 985712 987563
Changes:
devscripts (2.21.2) unstable; urgency=medium
.
[ Mattia Rizzolo ]
* po4a:
+ Generalize makefile to more easily support more languages.
+ New Portuguese translation of the manpages. Closes: #983271
Thanks to Américo Monteiro <[email protected]>.
* tests:
+ test_uscan_svn: save the produced tarball in case of autopkgtest failure.
* nmudiff:
+ Replace call to deprecated tempfile(1) with mktemp(1). Closes: #987563
.
[ Logan Rosen ]
* dget:
+ Fix typo in help text. MR: !218
.
[ Taowa ]
* dscverify:
+ Add non-uploading developer keyring to the keys used to check the files.
Closes: #985712; MR: !219
* who-uploads: MR: !222
+ Add non-uploading developer keyring to the keys the tool checks against.
+ Update the default config file with the default set of keyrings checked.
.
[ Yadd ]
* uscan:
+ Always clean temporary git checkouts. Closes: #972585; MR: !227
* Update fr translation.
Checksums-Sha1:
177d8664e1f462a0a4f6df49373f762437744d5c 3184 devscripts_2.21.2.dsc
8f2de89d5dc134fb9b5e067cd63c86ee8c85d24f 980516 devscripts_2.21.2.tar.xz
d6280ae2c1540c2ba415912198b6cb0c41fa0ab4 12364
devscripts_2.21.2_amd64.buildinfo
Checksums-Sha256:
10e3fc4573eee6601221e8426c27a54012bbc8c3fd66ac94c86806f9547c1723 3184
devscripts_2.21.2.dsc
c32db3f5b62c30d4ac77724c1ab2eb241eb4b9a1d9ea24bd762eba4d6b07ed32 980516
devscripts_2.21.2.tar.xz
e268b241010690cf63d8e804faf3919971794ae267a787b89ba118522a6a310f 12364
devscripts_2.21.2_amd64.buildinfo
Files:
e1813e7831598ff553bddbf225f01351 3184 devel optional devscripts_2.21.2.dsc
80986e7300a77f39391360e2603b625e 980516 devel optional devscripts_2.21.2.tar.xz
315a2d48c3a6ed351dc72a518f5316f3 12364 devel optional
devscripts_2.21.2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAmCO+DwACgkQCBa54Yx2
K63U3g//Ter0Z3NjJz/2WfAES9ZtWrf/ykV/2tfY2BsPB0ZinBPK7nK+wU0ZzewF
3Ubg1cLZIbmnwa2XtBF7XLWl7bxNAxXlECBPyt3mslyw0r1sMpAeIZhlhKK9Qcm6
HpQGyrtX9MOt6Ld2sqKjQgQgAijI5R7kc1u21IzRAeP5qlteOehvsNWuRwkOOgVy
hCpvZ7UOMBCZ9mfJUWvDRc2TFGK3WTmULuKI92zYuHYxhvkd5+juo5DoBKMY3mEu
RON0/1palg326h1HAsaSkNunNYbNqTZQ4eH17y6+viiqDKwe0k8ZmCdvGHViOaXc
ucJpQ84O2ovy4Nc4BqEd3UtcL99QQc+M/JFx7cZQ4O+ImvJTGjCSYZUFA1DNGR8q
TKXVESAKwpiCuHo9ckMxz2e4gFDo2T33Rg6Vh7G5WYm0gMEUMBDMwx3ZUdGJ5Hey
iAMVK/Zp31dJ5nHQCqRZ577s+hy0LaMT9uMW4ZPXq0Vqe0TylD6zh81luwhCvPTy
bz9NCW8crZUIay0CBsEdK9RmxA8UrxIjNO27REQ/RpRvg+LYWufbVdNoFvZm4Efh
TrvJE5FWmKkBrm9T0oaxEAf1j+TyGj1oyABhE2V52ER7S2un7g52eF7TdLCjOfvq
dc6Pd0Cji7CaIm8Tz32hMDXlCs6Nw0/AhFRnoEeqbRKKuaoVzPA=
=bewZ
-----END PGP SIGNATURE-----
--- End Message ---
