[Pkg-openssl-devel] Bug#1007808: openssl: can't check signature of orig tarball at build time

[Hiroyuki YAMAMORI]

Source: openssl
Version: 1.1.1n-1
Severity: minor
Tags: upstream

Dear Maintainer,

$ debuild -us -uc
   ...
 dpkg-source -b .
dpkg-source: info: using source format '3.0 (quilt)'
dpkg-source: info: building openssl using existing ./openssl_1.1.1n.orig.tar.gz
dpkg-source: info: building openssl using existing ./openssl_1.1.1n.orig.tar.gz.asc
gpgv: Signature made Tue Mar 15 23:37:53 2022 JST
gpgv:                using RSA key 8657ABB260F056B1E5190839D9C4D26D0E604491
gpgv: Note: signatures using the SHA1 algorithm are rejected
gpgv: Can't check signature: Bad public key
dpkg-source: warning: cannot verify signature ./openssl_1.1.1n.orig.tar.gz.asc
   ...

Thank you,
Hiroyuki YAMAMORI

-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 5.10.0-12-686-pae (SMP w/3 CPU threads)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)
LSM: AppArmor: enabled