Re: Is packages build without verifying the source package signatures?

2017-12-02 Thread Paul Wise
On Sat, Dec 2, 2017 at 7:15 PM, Davide Prina wrote: > If I don't mistake the automatic package build system don't require that the > source signature is verified correctly. To clarify what Adam said; there are two times where source package verification can happen during builds. The first is

Re: Is packages build without verifying the source package signatures?

2017-12-02 Thread Adam D. Barratt
On Sat, 2017-12-02 at 12:15 +0100, Davide Prina wrote: > If I don't mistake the automatic package build system don't require > that the source signature is verified correctly. [...] > So it don't have the public key (?) and so it don't check the > package  signature. But the package is build

Is packages build without verifying the source package signatures?

2017-12-02 Thread Davide Prina
If I don't mistake the automatic package build system don't require that the source signature is verified correctly. In here: https://buildd.debian.org/status/fetch.php?pkg=gnome-shell=amd64=3.26.2-1=1509919343=0 I have found this: Unpack source - gpgv: unknown type of key