Cannot build deb package: fails to sign, no secret key available

[CristianCantoro]

Hi,

as part of the pull request https://github.com/cornelinux/yubikey-luks/pull/25, I have tried to build the deb package - as stated in the README.md - with:

make builddeb

I get the following error:

Now signing changes and any dsc files...
 signfile yubikey-luks_0.5.1-1.dsc Cornelius Kölbel <cornelius.koelbel@netknights.it>
gpg: skipped "Cornelius Kölbel <cornelius.koelbel@netknights.it>": secret key not available
gpg: /tmp/debsign.iyH37NeU/yubikey-luks_0.5.1-1.dsc: clearsign failed: secret key not available
debsign: gpg error occurred!  Aborting....
debuild: fatal error at line 1295:
running debsign failed
Makefile:16: recipe for target 'builddeb' failed
make: *** [builddeb] Error 25

The full build log is attached [1].

Attachment:

1. build.log

[Vincent43]

Hm, I remember building it on debian stretch and signing error was ignored, package was build successfully.

[CristianCantoro]

I am on Ubuntu 16.40.3 LTS:

cristian@inara: ~ $ uname -a
Linux inara 4.13.0-32-generic #35~16.04.1-Ubuntu SMP Thu Jan 25 10:13:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

cristian@inara: ~ $ lsb_release -a                                            
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.3 LTS
Release:    16.04
Codename:   xenial

[Vincent43]

I just checked this and have same error but package is builded in DEBUILD folder. Same message is in your logs: dpkg-deb: building package 'yubikey-luks' in '../yubikey-luks_0.5.1-1_all.deb'. Are you sure it's not builded? Do you have write access to /opt/yubikey-full-disk-encryption/yubikey-luks ?

[CristianCantoro]

Ok, I checked and I have the package in fact the package built as yubikey-luks_0.5.1-1_all.deb in DEBUILD. Still, the error message is confusing, also, I think it leaves the user with the doubt that the package is fully or correctly built.

I am not an expert on package building, so I do not know if and how it is possible to suppress the signing of the package (you need that only if you are going to upload it on some repo for others to download, you don't need to sign if, if you are building it on your machine to install it locally).

At least a message could be added like:

If you get an error about debsign not being able to sign the package
you can safely ignore it

It would not be ideal, but marginally better than now.

[Vincent43]

I'm not sure if it's package specific or distro issue

[cornelinux]

Of course the private key is not available.

If you want to sign the package, you need to change the name and email in debian/changelog to match your name, for which a private key is available.

However, originially the buildded directive was not ment to be used by the "end user". Ideas are welcome.

[CristianCantoro]

@cornelinux said:

Of course the private key is not available.

Of course :-)

If you want to sign the package, you need to change the name and email in debian/changelog to match your name, for which a private key is available.

I imagined that, but the point of this bug is "why should I sign the package that I am self building?". Also, as of now this procedure is undocumented in the README, so, it's still a bug.

However, originially the buildded directive was not ment to be used by the "end user". Ideas are welcome.

IMHO, the best thing to do would be to add an option not to sign the package and add that option in the README.

I will take a look to see if it possible to do that, but I know next-to-nothing about deb package building.

[cornelinux]

In another project I added a no-sign build directive using the command parameters -uc -us.

See here: https://github.com/privacyidea/privacyidea/blob/master/Makefile#L123

I could do a similar directive:

builddeb:
    make debianize
    (cd DEBUILD/${SRC_DIR}; debuild -uc -us)