1

System: Linux Mint 19 Cinnamon, based on Ubuntu 18.04.


In this answer, I am being pointed at a different solution, other than installing directly from source.

Since I haven't ever used dget, I must have it installed first with:

$ sudo apt-get install devscripts

Upon the first suggested line:

$ dget -x http://deb.debian.org/debian/pool/main/r/redshift/redshift_1.12-2.dsc

I originally got Validation FAILED!!, which I quickly overcame with creating the following file:

~/.devscripts

with contents:

DSCVERIFY_KEYRINGS="/etc/apt/trusted.gpg:~/.gnupg/pubring.kbx"

as pointed out, slightly changed by me, in this AskUbuntu answer.

And simultaneously importing the public key with:

$ gpg --keyserver hkp://keys.gnupg.net --recv-keys 402543B2D98854007F627D36A63A58A3F2E17569

I get a warning:

dpkg-source: warning: failed to verify signature on ./redshift_1.12-2.dsc

The whole command output follows:

dget: retrieving http://deb.debian.org/debian/pool/main/r/redshift/redshift_1.12-2.dsc
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   328  100   328    0     0   2466      0 --:--:-- --:--:-- --:--:--  2466
100  2180  100  2180    0     0   8549      0 --:--:-- --:--:-- --:--:--  8549
dget: retrieving http://deb.debian.org/debian/pool/main/r/redshift/redshift_1.12.orig.tar.xz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   334  100   334    0     0    865      0 --:--:-- --:--:-- --:--:--   865
100  474k  100  474k    0     0   666k      0 --:--:-- --:--:-- --:--:-- 2597k
dget: retrieving http://deb.debian.org/debian/pool/main/r/redshift/redshift_1.12-2.debian.tar.xz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   338  100   338    0     0    840      0 --:--:-- --:--:-- --:--:--   840
100  5720  100  5720    0     0  11793      0 --:--:-- --:--:-- --:--:-- 11793
redshift_1.12-2.dsc:
      Good signature found
   validating redshift_1.12.orig.tar.xz
   validating redshift_1.12-2.debian.tar.xz
All files validated successfully.
gpgv: Signature made Tue 02 Oct 2018 12:40:08 PM CEST
gpgv:                using RSA key 402543B2D98854007F627D36A63A58A3F2E17569
gpgv: Can't check signature: No public key
dpkg-source: warning: failed to verify signature on ./redshift_1.12-2.dsc
dpkg-source: info: extracting redshift in redshift-1.12
dpkg-source: info: unpacking redshift_1.12.orig.tar.xz
dpkg-source: info: unpacking redshift_1.12-2.debian.tar.xz

At this point, I am out of ideas where the warning is coming from? And how to fix it?

1 Answer 1

3

I am unsure if this is the right solution to my problem, but since it resolved the warning, I will add it here:

sudo apt-get install debian-keyring

As pointed out by Stephen Kitt, there is another possibility to disable verification with:

dget -x -u ...

but the above approach is better from the security standpoint.

1
  • I'd say installing debian-keyring is certainly the right solution in this case. That package contains the keys of all Debian developers and maintainers, who you already trust since you are running a Debian derivative distribution. If instead the package comes from Ubuntu you may need to install ubuntu-keyring. Don't disable code signature verification. Mar 16, 2019 at 21:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .