[Pkg-rust-maintainers] Bug#1092459: Failed to resolve key, cannot be authenticated at the required level (0 of 120) running dpkg-buildpackage

[Guillem Jover]

Control: forwarded -1 https://gitlab.com/sequoia-pgp/sequoia-sq/-/issues/517

Hi!

On Wed, 2025-01-08 at 08:28:49 +0100, Aurélien COUDERC wrote:
> Package: sq
> Version: 0.40.0-1+b1
> Severity: important

> running dpkg-buildpackage -S -d on the breeze source today gives me the
> following :
> 
>   Error: Failed to resolve --signer-userid "Aurélien COUDERC <coucouf at debian.org>"
> because: 216FFF40001A0E070E283B1F71A7E533F291A324, "Aurélien COUDERC <coucouf at debian.org>" cannot be authenticated at the required level (0 of 120). After checking that Aurélien COUDERC <coucouf at debian.org> really controls 216FFF40001A0E070E283B1F71A7E533F291A324, you could certify their certificate by running `sq pki link add 216FFF40001A0E070E283B1F71A7E533F291A324 "Aurélien COUDERC <coucouf at debian.org>"`.
> 
>   Error: Failed to resolve certificates
> dpkg-buildpackage: erreur: échec de la signature du fichier ../breeze_6.2.5-2.dsc : la clé ne permet pas la signature

This is because the dpkg OpenPGP sq backend was made aware that sq has
now (secret) keystore support, so it can be autoselected when the
user specifies a keyhandle by fingerprint or keyid (instead of
previously where only keyfiles were available to sq). And sq is used
as a preferential OpenPGP implementation among the available ones.

> On the contrary, running
>   debsign ../breeze_6.2.5-2_source.changes
> did work.

debsign does not currently have sq or SOP support.

> I did non experience this error previously although I’m building
> packages daily.

See above. Although I think whenever sq transparently uses the GnuPG
keystore, it might be better to probably treat any private key found
there equivalent as --own-key, so I've filed that upstream as
https://gitlab.com/sequoia-pgp/sequoia-sq/-/issues/517.

To make this work right away, you could (if you have not done that
already) follow the hint from the sq message, which should make the
dpkg-buildpackage command work again as before, while not needing to
remove sq from the system. :)

Thanks,
Guillem