Re: public key not found

On Wednesday 29 December 2004 11:36 am, Fielder George Dowding wrote:
> Right on Greg,
>
> I was wondering if you experienced the same problem. I know there are
> some changes going on - hardware wise - with debian developer's
> configuration. I did not think it had anything to do with the mirrors
> (primary or secondary) or the main repository.
>
> I have been studying the gpg man page which points me to the
> ~/.gnupgp/gpg.conf file which in turn has the line:
>
> keyserver hkp://subkeys.pgp.net
>
> which has been working, as you say, up until, hmmm... about a week
> ago for me.
>
> So, what I understand from all this is the debian folks have not
> updated their public keys on the public key servers or something else
> is broken =:-)}}}
>
> The connection here is (grep gpg /usr/bin/debmirror):
>
> Debmirror uses gpg to verify Release and Release.gpg using the
> default keying ~/.gnupkg/pubring.gpg. This can be changes by
> exporting GNUPGHOME resulting in $GNUPGHOE/pubring.gpg being used.
>
> So I tried updating again with --ignore-release-gpg which worked.
> Next I will try changing the key server.
>
> Cheerio, fgd.
>
> On Tue, Dec 28, 2004 at 10:19:17PM -0900, Greg Madden wrote:
> > On Monday 27 December 2004 01:32 pm, Fielder George Dowding wrote:
> > > Greetings on this third day of Christmas,
> > >
> > > for the Debianites:
> > >
> > > I set up to update my Debian mirror and got this error message:
> > >
> > > Get Release files. [0%] Getting: dists/woody/Release #
> > > [0%] Getting: dists/woody/Release.gpg # gpg: Signature made
> > > Mon Oct 25 09:56:33 2004 AKDT using RSA key ID 1DB114E0 gpg:
> > > Can't check signature: public key not found Release signature
> > > does not verify
> > >
> > > Huh?
> >
> > Hi Fielder, I am getting the same message on my debmiror. It will
> > dl the release files & the contents but no package.gz files. I
> > would like to figure this out this Friday night, if you do not have
> > a party to go to :) I can get the key if your interested, better
> > yet have you figures it out ?
> >
> > My mirror was working for quite some time until about two weeks ago
> > ;-( Maybe a new security measure for Debian mirrors. There is a man
> > page on pgp and creating public keys etc..

Thanks for the --ignore... tip, mirror updating now. Should have read
the debmirror manpage :)

There is some info here: http://www.debian.org/releases/ bottom of the
page, that talks about the release files and a public key. I haven't
figured out the relevance yet. There is a Debian-keyring package,
public keys of Debian developers. None of the public key for packages
& release files makes sense, yet, though I do have Kmail set up for
gnugp, and a pubic key on a key server. I stopped signing my emails and
haven't kept up with the technology.

-- 
Greg Madden
Precision Air Balance, Inc.
Phone: 907-276-0461
---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.