Ubuntu – I’ve signed a deb package multiple times, now how can I remove a signature

aptdebdpkg

How can I remove signatures from a deb package signed with a gpg key by dpkg-sig?

I have a particular apt repository that I've set up, which through research and testing led me to manually sign my deb packages.

I've tested it out on a package and signed it multiple times with the same key. Now there are three signatures wrapped around the deb package.

The command used for signing the package was:

dpkg-sig -k ######## --sign bulder xul-ext-ubufox_3.0-0ubuntu0.14.10.1_all.deb

Best Answer

I'm not sure if there's a better way, but at the very least you could remove the signature "manually" with ar:

ar d "$yourpackage.deb" _gpgbuilder

(or additional things besides _gpgbuilder if you accomplished having "three signatures" by giving role names other than "builder").

This works because .deb files, at the outermost layer, are essentially just "ar" archives, and embedded deb sigs are stored in that outermost layer. There is a small difference between .debs created with dpkg and those created with ar, so normally it's a good idea to stick to real dpkg tools when manipulating deb files, but all modern tools (afaik) can handle both just fine.

Related Question