Преглед на файлове

dpkg-source: ensure trustedkeys.gpg is used to check signatures

Raphael Hertzog преди 17 години
родител
ревизия
0a3d3fe21b
променени са 2 файла, в които са добавени 6 реда и са изтрити 0 реда
  1. 3 0
      debian/changelog
  2. 3 0
      scripts/Dpkg/Source/Package.pm

+ 3 - 0
debian/changelog

@@ -31,6 +31,9 @@ dpkg (1.15.3) UNRELEASED; urgency=low
     normally blacklisted. This can be useful for libgcc to include symbols
     that the toolchain allows to be shared but that are often static (and
     hence are blacklisted for this reason). Closes: #533642
+  * In dpkg-source, explicitely pass --keyring ~/.gnupg/trustedkeys.gpg to
+    gpgv as it does not use it if other --keyring parameters are given.
+    Closes: #530769
 
   [ Joachim Breitner ]
   * Warn about unused substvars in dpkg-gencontrol. Closes: #532760

+ 3 - 0
scripts/Dpkg/Source/Package.pm

@@ -283,6 +283,9 @@ sub check_signature {
         push @exec, "gpg", "--no-default-keyring", "-q", "--verify";
     }
     if (scalar(@exec)) {
+        if (-r "$ENV{'HOME'}/.gnupg/trustedkeys.gpg") {
+            push @exec, "--keyring", "$ENV{'HOME'}/.gnupg/trustedkeys.gpg";
+        }
         foreach my $vendor_keyring (run_vendor_hook('keyrings')) {
             if (-r $vendor_keyring) {
                 push @exec, "--keyring", $vendor_keyring;