On Sun, Oct 11, 2026 at 05:56:52PM +0200, Bill Allombert wrote: > On Sun, Oct 11, 2026 at 04:42:57PM +0300, Peter Pentchev wrote: > > On Sun, Oct 11, 2026 at 02:45:21PM +0200, Bill Allombert wrote: > > > On Sat, Oct 10, 2026 at 03:30:22PM +0100, Jonathan McDowell wrote: > > > > https://wiki.debian.org/FixKeyWithSha1 > > > > > > > > should help. > > > > > > Thanks it worked! > > > > > > Do you know which gpg options dpkg-source use to generate the error > > > 'Signing key is not bound' > > > > > > Plain gpg do not detect this. > > > > I think dpkg uses Sequoia (sq or sqop) by default now, and > > the "cert lint" invocation on that wiki page detects that problem. > > I think this checks the certificate but not with the signature. > This is not the same.
It is the same: the error pertains to the signing key, not to the signature. And the output of `sq cert lint` contains a couple of lines like these: ... 0 have all User IDs protected by SHA-1. (GOOD) ... 1 of the non-revoked linted certificates has at least one non-revoked, live subkey: 0 have at least one non-revoked, live subkey with a binding signature that uses SHA-1. (GOOD) 0 of the non-revoked linted certificates have at least one non-revoked, live, signing-capable subkey: 0 certificates have at least one non-revoked, live, signing-capable subkey with a strong binding signature, but a backsig that uses SHA-1. (GOOD) G'luck, Peter -- Peter Pentchev [email protected] [email protected] [email protected] PGP key: https://www.ringlet.net/roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13
signature.asc
Description: PGP signature
