package: debian-keyring version: 2012.11.15 severity: important Signature verification currently fails on source packages that were signed by keys that are no longer present in the active keyrings. This can easily lead to the incorrect conclusion that those packages are not to be trusted or possibly malicious. Many packages tend to remain in the archive far longer than the key used to sign them, so I think it would make a lot of sense to ship the removed-keys to be ably to easily verify them into the indefinite future.
As an example, I was looking at boost and saw: $ apt-get source boost1.49 Reading package lists... Done Building dependency tree Reading state information... Done NOTICE: 'boost1.49' packaging is maintained in the 'Svn' version control system at: svn://svn.debian.org/svn/pkg-boost/boost/trunk Need to get 48.6 MB of source archives. Get:1 http://ftp.debian.org/debian/ sid/main boost1.49 1.49.0-3.1 (dsc) [4,696 B] Get:2 http://ftp.debian.org/debian/ sid/main boost1.49 1.49.0-3.1 (tar) [48.5 MB] Get:3 http://ftp.debian.org/debian/ sid/main boost1.49 1.49.0-3.1 (diff) [105 kB] Fetched 48.6 MB in 1min 5s (746 kB/s) gpgv: Signature made Sat 23 Jun 2012 05:14:11 AM EDT using DSA key ID 9B7C328D gpgv: Can't check signature: public key not found dpkg-source: warning: failed to verify signature on ./boost1.49_1.49.0-3.1.dsc Which made me think that somehow I received invalid files, but the reality is much more benign. That package is validly signed by Luk Claes' old key, but since that key is now in the removed-keys and thus not shipped, the source package unfortunately looks inauthentic without a lot more work. Thanks, Mike -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
