Bug#433091: [patch] possible fix

[Michael Vogt <mvo@debian.org>]

On Thu, Apr 09, 2009 at 08:42:14AM +0200, martin f krafft wrote:
> also sprach Michael Vogt <mvo@debian.org> [2009.04.09.0058 +0200]:
> > I merged the diff into the apt debian-sid tree and will upload soon. I
> > would love to have some positivie test feedback before I do the
> > upload.
> 
> I just tried in a chroot and it doesn't look good:

Thanks a lot for testing the patch!
 
> pulse:~# apt-cache policy apt
[..]
> pulse:~# apt-get update
> Get:1 http://debian.madduck.net sid Release.gpg [197B]
> Hit http://debian.madduck.net sid Release
> Err http://debian.madduck.net sid Release
[..]
> W: GPG error: http://debian.madduck.net sid Release: The following signatures were invalid: KEYEXPIRED 1182334739
> W: You may want to run apt-get update to correct these problems

Could you please run (preferably only with the debian.madduck.net url):
# apt-get update -o debug::acquire::gpgv=true 
and attach the output? I just tested it on my system and it seems to
be working (your clock was not off for some reason, e.g. to test
expiring keys?).
 
> But the key is not expired:
> 
> pulse:~# wget -q http://debian.madduck.net/repo/gpg/a4ba872bd5b9e51e.key.asc http://debian.madduck.net/repo/dists/sid/Release{,.gpg}
> pulse:~# gpg --import < a4ba872bd5b9e51e.key.asc
> gpg: /root/.gnupg/trustdb.gpg: trustdb created
> gpg: key D5B9E51E: public key "madduck's archive signing key (http://debian.madduck.net/repo) <archive@debian.madduck.net>" imported
> gpg: Total number processed: 1
> gpg:               imported: 1
> gpg: no ultimately trusted keys found
> pulse:~# gpg --verify Release.gpg Release
[..]

Could you please also run:
# gpgv --status-fd 1 Release.gpg Release

 
Thanks!
 Michael