Page MenuHome GnuPG
Create Task
Maniphest T8122

Instruction to install https://repos.gnupg.org/deb/gnupg/trixie/ fail for sqv Error: Failed to parse keyring "/usr/share/keyrings/gnupg-keyring.gpg"
Open, Needs TriagePublic
Actions

Description

Tried to install new GnuPG package on a

Description:    Debian GNU/Linux 13 (trixie)
cat /etc/debian_version
13.3

system, using the instructions at the bottom at

https://repos.gnupg.org/deb/gnupg/trixie/

I end up with the keyring as intented, but sqv does not parse it.
So the installation instruction are broken.

The error message is:

#
LANG=C apt-get update
[..]
Get:4 https://repos.gnupg.org/deb/gnupg/trixie trixie InRelease [3761 B]
Err:4 https://repos.gnupg.org/deb/gnupg/trixie trixie InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/keyrings/gnupg-keyring.gpg"  Caused by:     0: Reading "/usr/share/keyrings/gnupg-keyring.gpg": EOF     1: EOF
Reading package lists... Done
W: OpenPGP signature verification failed: https://repos.gnupg.org/deb/gnupg/trixie trixie InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/keyrings/gnupg-keyring.gpg"  Caused by:     0: Reading "/usr/share/keyrings/gnupg-keyring.gpg": EOF     1: EOF
E: The repository 'https://repos.gnupg.org/deb/gnupg/trixie trixie InRelease' is not signed.

A test as a regular user shows the keyring is readable as expected:

#
 LANG=C gpg   --no-default-keyring   --keyring /usr/share/keyrings/gnupg-keyring.gpg -k
/usr/share/keyrings/gnupg-keyring.gpg
-------------------------------------
pub   ed25519 2025-07-08 [SC] [expires: 2035-07-14]
    32097B719B3745D6E61DDA1B85C45AE3E1A2B355
    Revocable by: 02F38DFF731FF97CB039A1DA549E695E905BA208
uid           [ unknown] GnuPG.org Package Signing Key <package-maintainers@gnupg.org>

Event Timeline

bernhard created this task.Mon, Feb 23, 3:47 PM

Trying to do the verification outside of apt-get:

curl -O https://repos.gnupg.org/deb/gnupg/trixie/dists/trixie/Release
curl -O https://repos.gnupg.org/deb/gnupg/trixie/dists/trixie/Release.gpg
sqv --verbose --keyring=/usr/share/keyrings/gnupg-keyring.gpg --signature-file=Release.gpg Release

Error: Failed to parse keyring "/usr/share/keyrings/gnupg-keyring.gpg"

Caused by:
    0: Reading "/usr/share/keyrings/gnupg-keyring.gpg": EOF
    1: EOF


ls /etc/crypto-policies/back-ends/sequoia.config 
ls: cannot access '/etc/crypto-policies/back-ends/sequoia.config': No such file or directory
bernhard added a comment.Mon, Feb 23, 3:56 PM

A workaround I've found is to give the public key directly in /etc/apt/sources.list.d/gnupg.sources.

/!\ the leading spaces and the . dot in the newline are necessary,
see man sources.list in Debian.

Types: deb deb-src
URIs: https://repos.gnupg.org/deb/gnupg/trixie/
Suites: trixie
Components: main
Signed-By:
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 .
 mDMEaG0LdBYJKwYBBAHaRw8BAQdAJZTvJxjm4bFaxzJi7nBBYjJo9S+T9YfrSuZi
 +bMbZO+IjwQfFgoAOBYhBDIJe3GbN0XW5h3aG4XEWuPhorNVBQJobSdXFwyAEwLz
 jf9zH/l8sDmh2lSeaV6QW6IIAgcAAAoJEIXEWuPhorNVpl4A91y17iahfE55pD5s
 cNWKen032Dxfb0xhVjSRzUWXb0MBAOBr1LzWQrYYhOEYs6Rz0CdvopSZxtSQkjuB
 1UATw4QCtD1HbnVQRy5vcmcgUGFja2FnZSBTaWduaW5nIEtleSA8cGFja2FnZS1t
 YWludGFpbmVyc0BnbnVwZy5vcmc+iJkEExYKAEEWIQQyCXtxmzdF1uYd2huFxFrj
 4aKzVQUCaG0L8gIbAwUJEtaLgAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAK
 CRCFxFrj4aKzVdbcAQDXaWr31chEG8AeB3HYoFlyyZIZRn4YmGoJC11nMg/vjAEA
 jyVpweZ9Sla9ypavagShtG4gq2uba6iguythl5ILkgk=
 =6J8e
 -----END PGP PUBLIC KEY BLOCK-----
bernhard updated the task description. (Show Details)Mon, Feb 23, 4:02 PM
• werner added a subscriber: • werner.Mon, Feb 23, 4:06 PM

I guess you need to report this to Debian as their new sqv tools seems to be broken.

• werner added projects: Debian, Bug Report.Mon, Feb 23, 4:07 PM
bernhard added a comment.Mon, Feb 23, 5:53 PM

I guess you need to report this to Debian as their new sqv tools seems to be broken.

Done, with https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1128841

However those instructions to install on Debian Trixie are ours, and for GnuPG users.
So we should make them work until the defect with apt or sqv is fixed.