Bonjour la liste
je suis en version 13.4 et Je tente de vérifier la signature du
SHA512SUM pour l'image debian-13.4.0-amd64-netinst.iso
J'ai pris les fichiers ici :
https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/
$ gpg --verify SHA512SUMS.sign SHA512SUMS
gpg: Signature made Sat 14 Mar 2026 18:41:59 CET
gpg: using RSA key DF9B9C49EAA9298432589D76DA87E80D6294BE9B
J'ai pourtant installé debian-keyring.
$ gpg --no-default-keyring --keyring /usr/share/keyrings/debian-keyring.gpg
--verify SHA512SUMS.sign SHA512SUMS
gpg: Signature made Sat 14 Mar 2026 18:41:59 CET
gpg: using RSA key DF9B9C49EAA9298432589D76DA87E80D6294BE9B
gpg: Can't check signature: No public key
Si j'importe la clé à la main
$ gpg --keyserver hkps://keyring.debian.org:443 --recv-keys
0xDF9B9C49EAA9298432589D76DA87E80D6294BE9B
La vérification est correcte
$ gpg --verify SHA512SUMS.sign SHA512SUMS
gpg: Signature made Sat 14 Mar 2026 18:41:59 CET
gpg: using RSA key DF9B9C49EAA9298432589D76DA87E80D6294BE9B
gpg: Good signature from "Debian CD signing key<[email protected]>"
[unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: DF9B 9C49 EAA9 2984 3258 9D76 DA87 E80D 6294 BE9B
Je me demande pourquoi la clé n'est-elle pas dans debian-keyring ?
Merci pour vos lumières
