Dear Maintainer,

We use debarchiver for a company repository, and since we started
upgrading our servers to Bookworm, our hosts fail to verify our
repository:

W: Pas d'entrée de hachage dans le fichier Release /var/lib/apt/lists/partial/debian.octopuce.fr_octopuce_dists_bookworm_Release
E: Le dépôt http://debian.octopuce.fr/octopuce bookworm Release ne fournit que de faibles informations de sécurité.

Sorry for the French, I no longer have the full LC_ALL=C output, the
first one said "No Hash entry in Release file", and the second one
someting about "weak security".

With respect to #825123, we checked our signing key (rsa2048) and the
default signature algorithm (sha256) but the issue is unreleated.

We found out that the InRelease file is not generated by
debarchiver. We patched debarchiver to do so, along with the
Release.gpg file, and now the repository is verified.

I'm not sure how to add patches with reportbug yet, so I put it inline
here:

-*- Patch Begins here -*-
--- debarchiver.orig	2021-09-07 15:10:31.000000000 +0200
+++ debarchiver	2023-09-12 17:23:12.171618835 +0200
@@ -1302,17 +1302,26 @@
 	      3);
     if ($gpgkey) {
         unlink("$path/Release.gpg");
+        unlink("$path/InRelease");
     	if ($gpgpassfile) {
 	    cmdaction("cat $gpgpassfile | gpg --batch --no-tty -a -b -s -u $gpgkey " .
 	              "--pinentry-mode loopback --passphrase-fd 0 -o $path/Release.gpg $path/Release",
 		      "Sign Release file for $path with key '$gpgkey'",
 		      3);
+	    cmdaction("cat $gpgpassfile | gpg --batch --no-tty --clearsign -u $gpgkey " .
+	              "--pinentry-mode loopback --passphrase-fd 0 -o $path/InRelease $path/Release",
+		      "Sign InRelease file for $path with key '$gpgkey'",
+		      3);
 	}
 	else {
 	    cmdaction("gpg -a -b -s -u $gpgkey " .
 	              "-o $path/Release.gpg $path/Release",
 		      "Sign Release file for $path with key '$gpgkey'",
 		      3);
+	    cmdaction("gpg --clearsign -u $gpgkey " .
+	              "-o $path/InRelease $path/Release",
+		      "Sign InRelease file for $path with key '$gpgkey'",
+		      3);
 	}
     }
     unlink("$configpath");
-*- Patch Ends here -*-

Kind regards,
Cyprien

Hi Cyprien

Thank you very much for this. I guess this could even be a candidate for a
point release.

Do I understand correctly that the file is "InRelease" and not
"InRelease.gpg". If that is the case, the patch looks good.

Cheers

// Ola

Hi Ola,

I agree. Even a backport for current bookworm would be appreciated.

Yes, that's what apt-secure(8) tells me, as it also says to use the --clearsign
flag instead of the -a -b -s combination.

Thank you for taking care of debarchiver.