dpkg-sig --verify fails on packages compressed with xz

[Dan Kegel]

On small packages, everything is hunky-dory:

$ apt-get download dpkg-sig
$ ar t dpkg-sig*deb
debian-binary
control.tar.gz
data.tar.gz
$ dpkg-sig --sign builder dpkg-sig_0.13.1+nmu1_all.deb
Processing dpkg-sig_0.13.1+nmu1_all.deb...
Signed deb dpkg-sig_0.13.1+nmu1_all.deb
$ dpkg-sig --verify dpkg-sig_0.13.1+nmu1_all.deb
Processing dpkg-sig_0.13.1+nmu1_all.deb...
GOODSIG _gpgbuilder 9B9AB05C20B3C823F2F4BE92B5CA465083E11B33 1405541567

But on large packages, it's a bit pear-shaped:

$ apt-get download perl
$ ar t perl*deb
debian-binary
control.tar.gz
data.tar.xz
$ dpkg-sig --sign builder perl*deb
Processing perl_5.18.2-2ubuntu1_amd64.deb...
Signed deb perl_5.18.2-2ubuntu1_amd64.deb
$ dpkg-sig --verify perl*deb
Processing perl_5.18.2-2ubuntu1_amd64.deb...
BADSIG _gpgbuilder

The following patch seems to fix the problem:

--- dpkg-sig-0.13.1+nmu1/dpkg-sig 2013-10-25 11:04:33.000000000 -0700
+++ dpkg-sig-0.13.1+nmu1.new/dpkg-sig 2014-07-16 13:03:15.103728779 -0700
@@ -634,7 +634,7 @@
  }

  return "FORCE_BAD" unless ($seen_files{"control.tar.gz"} &&
- $seen_files{"data.tar.gz"} &&
+ ($seen_files{"data.tar.gz"} || $seen_files{"data.tar.xz"}) &&
                       $seen_files{"debian-binary"});

  return "GOOD";

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: dpkg-sig 0.13.1+nmu1
ProcVersionSignature: Ubuntu 3.13.0-30.55-generic 3.13.11.2
Uname: Linux 3.13.0-30-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.14.1-0ubuntu3.2
Architecture: amd64
CurrentDesktop: Unity
Date: Wed Jul 16 13:04:46 2014
InstallationDate: Installed on 2014-04-07 (99 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Beta amd64 (20140326)
PackageArchitecture: all
SourcePackage: dpkg-sig
UpgradeStatus: No upgrade log present (probably fresh install)

[Dan Kegel (dank)]

That patch again, attached:

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Patch to accept data.tar.xz" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Dan Kegel (dank)]

Also affects packages compressed with bz2, like Ubuntu 12.04's kernel package.

The obvious new version of the patch seems to work:

--- dpkg-sig-0.13.1/dpkg-sig.old 2014-07-25 15:16:40.114016000 -0700
+++ dpkg-sig-0.13.1/dpkg-sig 2014-07-25 15:17:31.037320000 -0700
@@ -634,7 +634,7 @@
  }

  return "FORCE_BAD" unless ($seen_files{"control.tar.gz"} &&
- $seen_files{"data.tar.gz"} &&
+ ($seen_files{"data.tar.gz"} || $seen_files{"data.tar.bz2"} || $seen_files{"data.tar.xz"}) &&
                       $seen_files{"debian-binary"});

  return "GOOD"

[Dan Kegel (dank)]

This is a dup of
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703437
There is an (identical?) fix there.

Please pull 0.13.1+nmu2 from debian, it fixes this. Thanks!

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[stevenschlansker (stevenschlansker)]

Debian Stable fixed this bug almost two years ago. I just ran into it on Ubuntu again. Does anyone actually care that this OS works? :(

[Dan Kegel (dank)]

Those of us who care about it -- not many, given that dpkg-sig is not used by most folks --
may have to roll up our sleeves.