Bug#772515: /usr/bin/uscan: uscan: pgp signature verification using .asc keyring fails with gnupg in experimental

[Tristan Seligmann]

Package: devscripts
Version: 2.14.11
Severity: normal
File: /usr/bin/uscan

When attempting to use uscan with a debian/upstream/signing-key.asc keyring, I
get a failure like this:

-- Downloading updated package mutagen-1.27.tar.gz
-- Downloading OpenPGP signature for package as mutagen-1.27.tar.gz.pgp
-- Verifying OpenPGP signature mutagen-1.27.tar.gz.pgp for mutagen-1.27.tar.gz
gpgv: keyblock resource `/tmp/BjrBPn_etd/pubring.gpg': file open error
gpgv: Signature made Fri 28 Nov 2014 17:23:12 SAST using DSA key ID 0C693B8F
gpgv: Can't check signature: public key not found
uscan warning: OpenPGP signature did not verify.

This ends up being because gpg 2.1.0 (currently in experimental) uses the new
pubring.kbx keyring by default, rather than pubring.gpg. Unfortunately I could
not find a way to make it write a new keyring in the old gpg keyring format, it
always seems to use the new keybox format when creating a new keyring, which is
not supported by gpgv.

-- Package-specific info:

--- /etc/devscripts.conf ---

--- ~/.devscripts ---
DEB_BUILD_OPTIONS="parallel=8"
DEBUILD_LINTIAN="yes"
DEBUILD_PRESERVE_ENVVARS="AGENT_SOCKET,GPG_AGENT_INFO,DH_VERBOSE,DEB_BUILD_OPTIONS"
DEBUILD_ROOTCMD="fakeroot"
DEBSIGN_PROGRAM="gpg2"
DEBSIGN_SIGNLIKE="gpg"
DEBSIGN_KEYID="DE3B7600!"
DEBCHANGE_RELEASE_HEURISTIC=changelog
DEBCHECKOUT_SOURCE=never

-- System Information:
Debian Release: 8.0
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.17.0-trunk-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_ZA.utf8, LC_CTYPE=en_ZA.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages devscripts depends on:
ii  dpkg-dev     1.17.22
ii  libc6        2.19-13
ii  perl         5.20.1-3
ii  python3      3.4.2-2
pn  python3:any  <none>

Versions of packages devscripts recommends:
ii  at                          3.1.16-1
ii  curl                        7.38.0-3
ii  dctrl-tools                 2.23
ii  debian-keyring              2014.08.31
ii  dput-ng [dput]              1.8
ii  equivs                      2.0.9
ii  fakeroot                    1.20.2-1
ii  file                        1:5.20-2
ii  gnupg                       1.4.18-6
ii  libdistro-info-perl         0.14
ii  libencode-locale-perl       1.03-1
ii  libjson-perl                2.61-1
ii  liblwp-protocol-https-perl  6.06-2
ii  libparse-debcontrol-perl    2.005-4
ii  libsoap-lite-perl           1.11-1
ii  liburi-perl                 1.64-1
ii  libwww-perl                 6.08-1
ii  lintian                     2.5.30+deb8u3
ii  man-db                      2.7.0.2-4
ii  patch                       2.7.1-6
ii  patchutils                  0.3.3-1
ii  python3-debian              0.1.25
ii  python3-magic               1:5.20-2
ii  sensible-utils              0.0.9
ii  strace                      4.9-2
ii  unzip                       6.0-12+b1
ii  wdiff                       1.2.2-1
ii  wget                        1.16-3
ii  xz-utils                    5.1.1alpha+20120614-2+b2

Versions of packages devscripts suggests:
ii  bsd-mailx [mailx]            8.1.2-0.20140825cvs-1
ii  build-essential              11.7
pn  cvs-buildpackage             <none>
pn  debbindiff                   <none>
pn  devscripts-el                <none>
pn  gnuplot                      <none>
ii  gpgv                         1.4.18-6
ii  libauthen-sasl-perl          2.1600-1
ii  libfile-desktopentry-perl    0.07-1
ii  libnet-smtp-ssl-perl         1.01-3
ii  libterm-size-perl            0.207-1+b2
ii  libtimedate-perl             2.3000-2
ii  libyaml-syck-perl            1.27-2+b2
ii  mutt                         1.5.23-3
ii  openssh-client [ssh-client]  1:6.7p1-3
ii  svn-buildpackage             0.8.5+nmu1
pn  w3m                          <none>

-- no debconf information