#926757 sbuild doesn't use installed keys for archive verification

Package:
sbuild
Source:
sbuild
Submitter:
peterc
Date:
2019-11-23 20:39:07 UTC
Severity:
normal
#926757#5
Date:
2019-04-10 05:51:00 UTC
From:
To:
Package: sbuild
Version: 0.78.1-2
Severity: normal

Dear Maintainer,

I'm trying to build a chroot for riscv64.

I've done
     sudo apt-get install debian-ports-archive-keyring
     sudo sbuild-createchroot --include=eatmydata,ccache,gnupg \
          --arch=riscv64 \
          sid /usr/home/sid-riscv64-sbuild \
http://deb.debian.org/debian-ports/

and see:
Failed to fetch http://deb.debian.org/debian-ports/dists/sid/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA1B2CEA81DCBC61


To fix I had to do:
 sudo gpg --no-default-keyring --keyring /usr/share/keyrings/debian-archive-keyring.gpg --import /etc/apt/trusted.gpg.d/debian-ports-archive-2019.gpg

Looks like when sbuild invokes apt-get it's not using the right
mechanism for finding keys.

Peter C
#926757#8
Date:
2019-04-10 06:10:39 UTC
From:
To:
Hi,

Quoting peterc (2019-04-10 07:51:00)

should you not add debian-ports-archive-keyring to --include so that the
keyring exists inside the chroot?

Thanks!

cheers, josch
#926757#13
Date:
2019-04-10 06:17:55 UTC
From:
To:
Johannes> [1 <text/plain; utf-8 (quoted-printable)>] Hi,

Johannes> should you not add debian-ports-archive-keyring to --include
Johannes> so that the keyring exists inside the chroot?

Yes, but that doesn't fix this issue.  sbuild-chroot bombs out on
fetching the Release file before it ever gets that far.
#926757#16
Date:
2019-04-14 05:47:24 UTC
From:
To:
Hi,

Quoting Chubb, Peter (Data61, Kensington NSW) (2019-04-10 08:17:55)

why do you think that this is an sbuild problem and not a debootstrap problem?

Did you manage to successfully create a chroot with debootstrap? If yes, how?
If not, then please either re-assign this bug to debootstrap or suggest what
sbuild can do to fix this.

Thanks!

cheers, josch