I am trying to use live-build 5.0 on Debian squeeze to build a Raspbian live image. The sudo lb build command fails during the debootstrap phase, at the step:

I: Checking Release signature
E: Release signed by unknown key (key id 9165938D90FDDD2E)

I have tried (on the build system):

  • installing the Raspbian repo key using sudo apt-key add
  • manually installing raspbian-archive-keyring_20120528.2_all.deb
  • adding the Raspbian key to config/archives/raspbian.key.(binary|chroot) (ie. from /usr/share/keyrings/raspbian-archive-keyring.gpg)
  • prepending DEBOOTSTRAP_OPTIONS="--keyring=/usr/share/keyrings/raspbian-archive-keyring.gpg" to lb config and lb build
  • same, but for /etc/apt/trusted.gpg
  • including --keyring-packages "raspbian-archive-keyring" in my auto/config

None of it worked. What do I need to do to tell debootstrap to use a different keyring? I don't want to tell it not to verify anything at all.

  • Try wget https://archive.raspbian.org/raspbian.public.key gpg --import raspbian.public.key debootstrap --keyring /root/.gnupg/pubring.gpg If the above fails then birchroad.wordpress.com/2012/06/09/… may be of use to you. – ChrisK Feb 8 '16 at 15:31

This was a very basic mistake. I was prepending DEBOOTSTRAP_OPTIONS="--keyring=/usr/share/keyrings/raspbian-archive-keyring.gpg" to lb config && sudo lb build, not realising that sudo does not allow environment variables through (because of the Defaults env_reset line in sudoers).

When I invoked with sudo DEBOOTSTRAP_OPTIONS="--keyring=/usr/share/keyrings/raspbian-archive-keyring.gpg" lb build, it was successful.

| improve this answer | |

As root run:

wget -qO - https://archive.raspbian.org/raspbian.public.key | gpg --import -
debootstrap --keyring /root/.gnupg/pubring.kbx ...
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.