Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to create a .DEB package which will install a number of certificates and keys onto a system.

To do this, i've gone through the standard package creation process, and thrown two files, debsigning.gpg and webupd8.gpg into /opt/keys. (This is specified by the install file.)

The package drops the files, and executes a script which invokes apt-key install on each installed keyfile to load it into the keyring. However, I'm finding that, despite the apt-key command reporting success, the keys are not being installed properly.

If, post install, I execute the exact same apt-key command manually, the keys then work.

Here's what the session looks like:

$ apt-get install company-keyring
Reading package lists... Done
Building dependency tree
Reading state information... Done

The following extra packages will be installed:
The following NEW packages will be installed:
   add-apt-key company-keyring

0 upgraded, 2 newly installed, 0 to remove and 40 not upgraded.
Need to get 10.2 kB of archives.
After this operation, 129 kB of additional disk space will be used.
Do you want to continue [Y/n]? y
WARNING: The following packages cannot be authenticated!
Install these packages without verification [y/N]? y
-snip download lines-
Setting up company-keyring (1.0) ...

Installing Keys...
Webupd8 Key (Java): OK
DEB Signing Key: OK
Company CA key: Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:company-ca.pem.pem

Everything appears to be in order. I should be able to now run an apt-get update without any errors..

$ apt-get update
W: GPG error: http://updateserver precise InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 37AF244665CC67C4

Darn. Okay, but if I go and manually run the script command..

$ apt-key add /opt/keys/debkey.gpg
$ apt-key add /opt/keys/webupd8.gpg

Then try to update..

$ apt-get update
Fetched 2,180 B in 0s (15.6 kB/s)
Reading package lists... Done

All is well.

I'm stumped, here. This is exactly what my .deb postinst script was supposed to do:

echo "Installing keys.."
echo "Webupd8 Key (Java): `apt-key add /opt/keys/webupd8.gpg`" 
echo "DEB Signing Key: `apt-key add /opt/keys/debkey.gpg`"
echo "Company CA key: `echo 'company-ca.pem' >> /etc/ca-certificates.conf && update-ca-certificates`"
echo "Done."

And the "OK" output would seem to indicate success. What am I missing?

share|improve this question
Instead of putting them in /opt/keys/ for some reason, why not put them in /etc/apt/trusted.gpg.d/ and simply run apt-key update? Related: askubuntu.com/questions/31286/… –  Zoredache Apr 18 '13 at 22:12
I'll be..... When I do it this way, it works :D If you make this an answer, i'll credit you for it. –  Mikey T.K. Apr 19 '13 at 15:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.