Bug#1100867: gpgv: Can't check signature: No public key

Package: dupload
Version: 2.13.2
Severity: important

dupload now fails for me with the error:

$ LANG=C dupload *_source.changes --no
dupload note: no announcement will be sent.
Checking OpenPGP signatures on ccid_1.6.2-1_source.changes...
  Using keyring: /usr/share/keyrings/debian-keyring.gpg
  Using keyring: /usr/share/keyrings/debian-nonupload.gpg
  Using keyring: /usr/share/keyrings/debian-maintainers.gpg
gpgv: Signature made Wed Mar 19 17:58:20 2025 CET
gpgv:                using RSA key F5E11B9FFE911146F41D953D78A1B4DFE8F9C57E
gpgv:                issuer "[email protected]"
gpgv: Note: signatures using the SHA1 algorithm are rejected
gpgv: Can't check signature: No public key
openpgp-check: error: cannot verify OpenPGP signature for ccid_1.6.2-1_source.changes: no acceptable signature found

dupload: error: Pre-upload '/usr/share/dupload/openpgp-check %1' failed for ccid_1.6.2-1_source.changes


I use the default configuration file /etc/dupload.conf and I have no
~/.dupload.conf file.


My key F5E11B9FFE911146F41D953D78A1B4DFE8F9C57E is present in the debian
keyring file:
$ LANG=C gpg --show-keys /usr/share/keyrings/debian-keyring.gpg | grep -B1 rousseau
gpg: 100 keys processed so far
gpg: 200 keys processed so far
gpg: 300 keys processed so far
gpg: 400 keys processed so far
      F5E11B9FFE911146F41D953D78A1B4DFE8F9C57E
uid                              Ludovic Rousseau <[email protected]>
uid                              Ludovic Rousseau <[email protected]>
gpg: 500 keys processed so far
gpg: 600 keys processed so far
gpg: 700 keys processed so far
gpg: 800 keys processed so far
gpg: 900 keys processed so far


I signed the package using:
$ debsign *_source.changes

This bug looks similar to #1099178 but in my case I see that the Debian
keyring is (should be) used.

I don't know what I am doing wrong.


As expected, downgrading to dupload 2.9.12 solves the problem.

Thanks

-- System Information:
Debian Release: trixie/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.12-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages dupload depends on:
ii  libdpkg-perl  1.22.18
ii  perl          5.40.1-2

Versions of packages dupload recommends:
ii  debian-keyring         2024.09.22
ii  libio-socket-ssl-perl  2.089-1
ii  liburi-perl            5.30-1
ii  libyaml-libyaml-perl   0.903.0+ds-1
ii  openssh-client         1:9.9p2-1

Versions of packages dupload suggests:
ii  exim4-daemon-light [mail-transport-agent]  4.98.1-1
pn  libsecret-tools                            <none>
ii  lintian                                    2.121.1+nmu1

-- no debconf information