Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1111037 > unrolled thread
| Started by | Tim McConnell <tmcconnell168@gmail.com> |
|---|---|
| First post | 2022-07-26 21:30 +0200 |
| Last post | 2022-07-27 21:50 +0200 |
| Articles | 5 — 3 participants |
Back to article view | Back to linux.debian.bugs.dist
Bug#1016087: dpkg: errors about cannot verify signature fpr assorted packages Tim McConnell <tmcconnell168@gmail.com> - 2022-07-26 21:30 +0200
Bug#1016087: dpkg: errors about cannot verify signature fpr assorted packages Guillem Jover <guillem@debian.org> - 2022-07-27 12:30 +0200
Bug#1016087: dpkg: errors about cannot verify signature for assorted packages tmcconnell168@gmail.com - 2022-07-27 18:20 +0200
Bug#1016087: dpkg: errors about cannot verify signature for assorted packages Guillem Jover <guillem@debian.org> - 2022-07-27 20:40 +0200
Bug#1016087: apt-listdifferences: Indirectly calls dpkg-source w/o --no-check Guillem Jover <guillem@debian.org> - 2022-07-27 21:50 +0200
| From | Tim McConnell <tmcconnell168@gmail.com> |
|---|---|
| Date | 2022-07-26 21:30 +0200 |
| Subject | Bug#1016087: dpkg: errors about cannot verify signature fpr assorted packages |
| Message-ID | <ENypH-e0YS-3@gated-at.bofh.it> |
Package: dpkg Version: 1.21.9 Severity: normal X-Debbugs-Cc: tmcconnell168@gmail.com Dear Maintainer, What led up to the situation? Normal upgrading of system What exactly did you do (or not do) that was effective (or ineffective)? Unsure these messages started appearing. What was the outcome of this action? I now receive multiple lines of: gpgv: Signature made Fri 24 Oct 2014 06:23:17 PM CDT gpgv: using RSA key F664D256B4691A7D gpgv: Can't check signature: No public key dpkg-source: warning: cannot verify signature /var/cache/apt/sources/libtrio_1.16+dfsg1-3.dsc gpgv: Signature made Tue 03 May 2022 09:04:38 PM CDT gpgv: using RSA key A1489FE2AB99A21A gpgv: Note: signatures using the SHA1 algorithm are rejected gpgv: Can't check signature: Bad public key dpkg-source: warning: cannot verify signature /var/cache/apt/sources/r-cran- quantreg_5.93-1.dsc gpgv: Signature made Wed 20 Jul 2022 05:25:03 AM CDT gpgv: using RSA key A1489FE2AB99A21A gpgv: Note: signatures using the SHA1 algorithm are rejected gpgv: Can't check signature: Bad public key dpkg-source: warning: cannot verify signature /var/cache/apt/sources/r-cran- quantreg_5.94-1.dsc apt-listdifferences: removing old src:r-cran-quantreg 5.93-1 gpgv: Signature made Fri 27 May 2022 04:42:52 AM CDT gpgv: using RSA key 5F2A9FB82FA6C1E1077007072D191C8843B13F4D gpgv: Note: signatures using the SHA1 algorithm are rejected gpgv: Can't check signature: Bad public key dpkg-source: warning: cannot verify signature /var/cache/apt/sources/kconfig_5.94.0-3.dsc gpgv: Signature made Sat 23 Jul 2022 05:20:34 AM CDT gpgv: using RSA key 5F2A9FB82FA6C1E1077007072D191C8843B13F4D gpgv: Note: signatures using the SHA1 algorithm are rejected gpgv: Can't check signature: Bad public key dpkg-source: warning: cannot verify signature /var/cache/apt/sources/kconfig_5.94.0-4.dsc When running this command `apt-get dist-upgrade -y -m` What outcome did you expect instead? To be sure I'm getting packages from an uncompromised repo. -- Package-specific info: This system uses merged-usr-via-aliased-dirs, going behind dpkg's back, breaking its core assumptions. This can cause silent file overwrites and disappearances, and its general tools misbehavior. See <https://wiki.debian.org/Teams/Dpkg/FAQ#broken-usrmerge>. -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (500, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 5.18.0-2-amd64 (SMP w/1 CPU thread; PREEMPT) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages dpkg depends on: ii libbz2-1.0 1.0.8-5 ii libc6 2.33-8 ii liblzma5 5.2.5-2.1 ii libselinux1 3.4-1+b1 ii tar 1.34+dfsg-1 ii zlib1g 1:1.2.11.dfsg-4 dpkg recommends no packages. Versions of packages dpkg suggests: ii apt 2.5.1 ii debsig-verify 0.25+b1 -- no debconf information
[toc] | [next] | [standalone]
| From | Guillem Jover <guillem@debian.org> |
|---|---|
| Date | 2022-07-27 12:30 +0200 |
| Message-ID | <ENMsF-e9xa-3@gated-at.bofh.it> |
| In reply to | #1111037 |
Control: reassign -1 dpkg-dev 1.21.9 Control: tag -1 moreinfo Hi! On Tue, 2022-07-26 at 14:24:41 -0500, Tim McConnell wrote: > Package: dpkg > Version: 1.21.9 > Severity: normal > X-Debbugs-Cc: tmcconnell168@gmail.com > What led up to the situation? Normal upgrading of system > > What exactly did you do (or not do) that was effective (or ineffective)? Unsure > these messages started appearing. > > What was the outcome of this action? I now receive multiple lines of: gpgv: > Signature made Fri 24 Oct 2014 06:23:17 PM CDT > gpgv: using RSA key F664D256B4691A7D > gpgv: Can't check signature: No public key > dpkg-source: warning: cannot verify signature > /var/cache/apt/sources/libtrio_1.16+dfsg1-3.dsc > gpgv: Signature made Tue 03 May 2022 09:04:38 PM CDT > gpgv: using RSA key A1489FE2AB99A21A > gpgv: Note: signatures using the SHA1 algorithm are rejected > gpgv: Can't check signature: Bad public key > dpkg-source: warning: cannot verify signature /var/cache/apt/sources/r-cran- > quantreg_5.93-1.dsc > gpgv: Signature made Wed 20 Jul 2022 05:25:03 AM CDT > gpgv: using RSA key A1489FE2AB99A21A > gpgv: Note: signatures using the SHA1 algorithm are rejected > gpgv: Can't check signature: Bad public key > dpkg-source: warning: cannot verify signature /var/cache/apt/sources/r-cran- > quantreg_5.94-1.dsc > apt-listdifferences: removing old src:r-cran-quantreg 5.93-1 > gpgv: Signature made Fri 27 May 2022 04:42:52 AM CDT > gpgv: using RSA key 5F2A9FB82FA6C1E1077007072D191C8843B13F4D > gpgv: Note: signatures using the SHA1 algorithm are rejected > gpgv: Can't check signature: Bad public key > dpkg-source: warning: cannot verify signature > /var/cache/apt/sources/kconfig_5.94.0-3.dsc > gpgv: Signature made Sat 23 Jul 2022 05:20:34 AM CDT > gpgv: using RSA key 5F2A9FB82FA6C1E1077007072D191C8843B13F4D > gpgv: Note: signatures using the SHA1 algorithm are rejected > gpgv: Can't check signature: Bad public key > dpkg-source: warning: cannot verify signature > /var/cache/apt/sources/kconfig_5.94.0-4.dsc > > When running this command `apt-get dist-upgrade -y -m` I assume you have something installed that downloads source packages (and perhaps builds them) as part of the upgrade? Otherwise that seems uncommon. In any case… > What outcome did you expect instead? To be sure I'm getting packages from an > uncompromised repo. … assuming you are getting the source packages from a Debian repository, those should have the repository mataindices signed by the archive keys, which get rotated and updated when necessary, in contrast to the source package signatures which are created by the person uploading the source package (and never updated anymore). As such those latter signatures (when later verified after the archive did the initial verification on upload) can very easily come from now revoked or expired keys or from keys for people that are no longer members of the project and are thus not present in the keyrings, the signatures can be expired themselves, they might come from keys or signatures which are now considered weak, which is what happens to be the case here. These signatures use SHA1 as a hashing algorithm which is no longer considered secure and get rejected. For the above reasons apt passes --no-check to dpkg-source, and dpkg-source does not default to erroring out (unless passing to it --require-valid-signature), as can be seen from the warnings (not errors) shown above. So I see no dpkg bug here, perhaps whatever is calling dpkg-source should also be passing --no-check (if it can guarantee the source came from a verified repo). Otherwise I'll be closing this in a bit. Thanks, Guillem
[toc] | [prev] | [next] | [standalone]
| From | tmcconnell168@gmail.com |
|---|---|
| Date | 2022-07-27 18:20 +0200 |
| Subject | Bug#1016087: dpkg: errors about cannot verify signature for assorted packages |
| Message-ID | <ENRVo-ecQr-9@gated-at.bofh.it> |
| In reply to | #1111087 |
Hi Guillem, >I assume you have something installed that downloads source packages > (and perhaps builds them) as part of the upgrade? Gnome Software and I left sources.list pretty much as it came from the net install CD. So I'm getting this because some packages no longer have a maintainer, that sucks, hope you guys get some more maintainers for those projects. Either way, thanks for the clear explanation of why it's happening and where the warnings are coming from. If it's not really a bug I guess it's okay to close it and sorry for wasting your time. Have a great day! -- <tmcconnell168@gmail.com> On Wed, 2022-07-27 at 12:25 +0200, Guillem Jover wrote: > Control: reassign -1 dpkg-dev 1.21.9 > Control: tag -1 moreinfo > > Hi! > > On Tue, 2022-07-26 at 14:24:41 -0500, Tim McConnell wrote: > > Package: dpkg > > Version: 1.21.9 > > Severity: normal > > X-Debbugs-Cc: tmcconnell168@gmail.com > > > What led up to the situation? Normal upgrading of system > > > > What exactly did you do (or not do) that was effective (or > > ineffective)? Unsure > > these messages started appearing. > > > > What was the outcome of this action? I now receive multiple lines > > of: gpgv: > > Signature made Fri 24 Oct 2014 06:23:17 PM CDT > > gpgv: using RSA key F664D256B4691A7D > > gpgv: Can't check signature: No public key > > dpkg-source: warning: cannot verify signature > > /var/cache/apt/sources/libtrio_1.16+dfsg1-3.dsc > > gpgv: Signature made Tue 03 May 2022 09:04:38 PM CDT > > gpgv: using RSA key A1489FE2AB99A21A > > gpgv: Note: signatures using the SHA1 algorithm are rejected > > gpgv: Can't check signature: Bad public key > > dpkg-source: warning: cannot verify signature > > /var/cache/apt/sources/r-cran- > > quantreg_5.93-1.dsc > > gpgv: Signature made Wed 20 Jul 2022 05:25:03 AM CDT > > gpgv: using RSA key A1489FE2AB99A21A > > gpgv: Note: signatures using the SHA1 algorithm are rejected > > gpgv: Can't check signature: Bad public key > > dpkg-source: warning: cannot verify signature > > /var/cache/apt/sources/r-cran- > > quantreg_5.94-1.dsc > > apt-listdifferences: removing old src:r-cran-quantreg 5.93-1 > > gpgv: Signature made Fri 27 May 2022 04:42:52 AM CDT > > gpgv: using RSA key > > 5F2A9FB82FA6C1E1077007072D191C8843B13F4D > > gpgv: Note: signatures using the SHA1 algorithm are rejected > > gpgv: Can't check signature: Bad public key > > dpkg-source: warning: cannot verify signature > > /var/cache/apt/sources/kconfig_5.94.0-3.dsc > > gpgv: Signature made Sat 23 Jul 2022 05:20:34 AM CDT > > gpgv: using RSA key > > 5F2A9FB82FA6C1E1077007072D191C8843B13F4D > > gpgv: Note: signatures using the SHA1 algorithm are rejected > > gpgv: Can't check signature: Bad public key > > dpkg-source: warning: cannot verify signature > > /var/cache/apt/sources/kconfig_5.94.0-4.dsc > > > > When running this command `apt-get dist-upgrade -y -m` > > I assume you have something installed that downloads source packages > (and perhaps builds them) as part of the upgrade? Otherwise that > seems > uncommon. In any case… > > > What outcome did you expect instead? To be sure I'm getting > > packages from an > > uncompromised repo. > > … assuming you are getting the source packages from a Debian > repository, those should have the repository mataindices signed by > the > archive keys, which get rotated and updated when necessary, in > contrast > to the source package signatures which are created by the person > uploading > the source package (and never updated anymore). As such those latter > signatures (when later verified after the archive did the initial > verification on upload) can very easily come from now revoked or > expired > keys or from keys for people that are no longer members of the > project > and are thus not present in the keyrings, the signatures can be > expired > themselves, they might come from keys or signatures which are now > considered weak, which is what happens to be the case here. These > signatures use SHA1 as a hashing algorithm which is no longer > considered > secure and get rejected. > > For the above reasons apt passes --no-check to dpkg-source, and > dpkg-source does not default to erroring out (unless passing to it > --require-valid-signature), as can be seen from the warnings (not > errors) shown above. So I see no dpkg bug here, perhaps whatever is > calling dpkg-source should also be passing --no-check (if it can > guarantee the source came from a verified repo). Otherwise I'll be > closing this in a bit. > > Thanks, > Guillem
[toc] | [prev] | [next] | [standalone]
| From | Guillem Jover <guillem@debian.org> |
|---|---|
| Date | 2022-07-27 20:40 +0200 |
| Subject | Bug#1016087: dpkg: errors about cannot verify signature for assorted packages |
| Message-ID | <ENU6R-ee2s-3@gated-at.bofh.it> |
| In reply to | #1111128 |
On Wed, 2022-07-27 at 11:10:13 -0500, tmcconnell168@gmail.com wrote: > >I assume you have something installed that downloads source packages > > (and perhaps builds them) as part of the upgrade? > Gnome Software and I left sources.list pretty much as it came from the > net install CD. Hmm, I've checked gnome-software and I don't see anything obvious there that would cause sources to be downloaded. After looking for something using the /var/cache/apt/sources/ pathname, I've found apt-listdifferences which seems like a matching culprit. Do you happen to have that installed? If so, the problem is that it calls debdiff, which always verifies signatures, even though apt-listdifferences downloaded it from the archive, so there should be no need for that. Then I'd reassign to apt-listdifferences which would need a new option in debdiff to be able to request passing --no-check to dpkg-source. > So I'm getting this because some packages no longer have a maintainer, > that sucks, hope you guys get some more maintainers for those projects. Not necessarily, it might well be that these packages did not get uploaded after these maintainers updated their OpenPGP keys, and have remained with weak signatures. We should probably add some QA check (if there's none yet in place), to catch that, I'll check that out too. Thanks, Guillem
[toc] | [prev] | [next] | [standalone]
| From | Guillem Jover <guillem@debian.org> |
|---|---|
| Date | 2022-07-27 21:50 +0200 |
| Subject | Bug#1016087: apt-listdifferences: Indirectly calls dpkg-source w/o --no-check |
| Message-ID | <ENVcB-eeDc-3@gated-at.bofh.it> |
| In reply to | #1111037 |
Control: tag -1 - moreinfo Control: reassign -1 apt-listdifferences Control: retitle -1 apt-listdifferences: Indirectly calls dpkg-source w/o --no-check [ Replying to the initial report for some context. ] Hi! On Tue, 2022-07-26 at 14:24:41 -0500, Tim McConnell wrote: > Package: dpkg > Version: 1.21.9 > Severity: normal > X-Debbugs-Cc: tmcconnell168@gmail.com > What led up to the situation? Normal upgrading of system > > What exactly did you do (or not do) that was effective (or ineffective)? Unsure > these messages started appearing. > > What was the outcome of this action? I now receive multiple lines of: gpgv: > Signature made Fri 24 Oct 2014 06:23:17 PM CDT > gpgv: using RSA key F664D256B4691A7D > gpgv: Can't check signature: No public key > dpkg-source: warning: cannot verify signature > /var/cache/apt/sources/libtrio_1.16+dfsg1-3.dsc > gpgv: Signature made Tue 03 May 2022 09:04:38 PM CDT > gpgv: using RSA key A1489FE2AB99A21A > gpgv: Note: signatures using the SHA1 algorithm are rejected > gpgv: Can't check signature: Bad public key > dpkg-source: warning: cannot verify signature /var/cache/apt/sources/r-cran- > quantreg_5.93-1.dsc > gpgv: Signature made Wed 20 Jul 2022 05:25:03 AM CDT > gpgv: using RSA key A1489FE2AB99A21A > gpgv: Note: signatures using the SHA1 algorithm are rejected > gpgv: Can't check signature: Bad public key > dpkg-source: warning: cannot verify signature /var/cache/apt/sources/r-cran- > quantreg_5.94-1.dsc > apt-listdifferences: removing old src:r-cran-quantreg 5.93-1 > gpgv: Signature made Fri 27 May 2022 04:42:52 AM CDT > gpgv: using RSA key 5F2A9FB82FA6C1E1077007072D191C8843B13F4D > gpgv: Note: signatures using the SHA1 algorithm are rejected > gpgv: Can't check signature: Bad public key > dpkg-source: warning: cannot verify signature > /var/cache/apt/sources/kconfig_5.94.0-3.dsc > gpgv: Signature made Sat 23 Jul 2022 05:20:34 AM CDT > gpgv: using RSA key 5F2A9FB82FA6C1E1077007072D191C8843B13F4D > gpgv: Note: signatures using the SHA1 algorithm are rejected > gpgv: Can't check signature: Bad public key > dpkg-source: warning: cannot verify signature > /var/cache/apt/sources/kconfig_5.94.0-4.dsc > > When running this command `apt-get dist-upgrade -y -m` > > What outcome did you expect instead? To be sure I'm getting packages from an > uncompromised repo. The problem here in the end was (confirmed off-BTS) that apt-listdifferences is installed on the system, which downloads the source packages for binary packages being upgraded to debdiff them. But those source packages had been signed with a weak algorithm, which is rejected by dpkg-source (even though that command defaults to warning only). Because when downloading the source packages from the archive, they have switched their trust anchor from the uploader to the archive, which takes care of key (re)signing, expiration and rotation, checking the signatures in the .dsc can be more confusing than helpful. (This would be a different matter if the .dsc reached the system through some other means such as scp or sneaker net or whatever). So, ideally apt-listdifferences would call debdiff and request for it to pass --no-check to dpkg-source. But there is currently no such option. I'll file another report, and block this one with that other one. Thanks, Guillem
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web