Your message dated Fri, 18 Sep 2026 11:46:11 +0000
with message-id <[email protected]>
and subject line Bug#1137258: Removed package(s) from unstable
has caused the Debian Bug report #832673,
regarding weak temporary key remains in /etc/apt/trusted.gpg
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
832673: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832673
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: live-build
Version: 1:20151215
Severity: normal
Tags: patch
Dear Maintainer,
live-build is supposed to delete the temporary '_LB_LOCAL_KEY_EMAIL'
signing key at the end of the 'scripts/build/chroot_archives' script.
However, it fails because the 'apt-key del' command expects a key ID and not
the email address associated with the key (_LB_LOCAL_KEY_EMAIL). This
was probably missed because the command likes to return "OK" even when
a non-existent key is specified.
The result of this bug is that an insecure (and unneeded) APT signing
key is left in the `/etc/apt/trusted.gpg' keyring.
To address the problem, it is necessary to lookup the key ID for
'_LB_LOCAL_KEY_EMAIL' using the 'apt-key list' command and parse the key
ID from line previous to where the email address for the key appears (a
little tricky).
I have attached a patch that uses a sed statement to extract the key ID
and store it in an environment variable to be used with the 'apt-key
del' command.
-- Package-specific info:
-- System Information:
Debian Release: stretch/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 4.3.3-grsec-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages live-build depends on:
ii debootstrap 1.0.78
Versions of packages live-build recommends:
ii apt-utils 1.2.3
ii cpio 2.11+dfsg-5
pn live-boot-doc <none>
pn live-config-doc <none>
pn live-manual-html | live-manual <none>
ii wget 1.17.1-1+b1
Versions of packages live-build suggests:
pn debian-keyring <none>
ii gpgv 1.4.20-1
-- no debconf information
diff --git a/scripts/build/chroot_archives b/scripts/build/chroot_archives
index 029afe7..8b2546f 100755
--- a/scripts/build/chroot_archives
+++ b/scripts/build/chroot_archives
@@ -762,7 +762,8 @@ EOF
# Remove local packages key if it exists
if Chroot chroot apt-key list | grep -q ${_LB_LOCAL_KEY_EMAIL}
then
- Chroot chroot apt-key del ${_LB_LOCAL_KEY_EMAIL}
+ _LB_LOCAL_KEY_ID=`Chroot chroot apt-key list | sed -nr '/'"${_LB_LOCAL_KEY_EMAIL}"'/{x;d;};x;g;s/^.+1024R\/([[:xdigit:]]{8}).+/\1/p'`
+ Chroot chroot apt-key del ${_LB_LOCAL_KEY_ID}
fi
# Removing stage file
--- End Message ---
--- Begin Message ---
Version: 20190301-lts1-5+rm
Dear submitter,
as the package open-infrastructure-system-tools has just been removed from the
Debian archive
unstable we hereby close the associated bug reports. We are sorry
that we couldn't deal with your issue properly.
For details on the removal, please see https://bugs.debian.org/1137258
The version of this package that was in Debian prior to this removal
can still be found using https://snapshot.debian.org/.
Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.
This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
[email protected].
Debian distribution maintenance software
pp.
Thorsten Alteholz (the ftpmaster behind the curtain)
--- End Message ---
