Release signature does not verify 意味着什么？

fmying

我用debmirror维护Ubuntu源，但是每Getting Release 后总会出现
Release signature does not verify.
请问出现这个语句意味着什么？是不是说我的源无法更新？
我的命令：
/usr/bin/debmirror --method=http -v --progress --ignore-release-gpg --skippackages --ignore-missing-release --section=$SECTION --host=$HOST --dist=$DISTS --arch=$ARCHS $OPTIONS -r $MIRROR_ROOT $LOCAL

其中的$开头的都是一些变量

输出信息如下：
Processing standard using ubuntu.cn99.com
Ubuntu mirror Started update at Thu Jan 4 20:35:30 HKT 2007
Mirroring to /var/ftp/ubuntu from http://anonymous:ubuntu.cn99.com//ubuntu/
Arches: i386,amd64
Dists: dapper,dapper-backports,dapper-proposed,dapper-security,dapper-updates,edgy,edgy-backports,edgy-proposed,edgy-security,edgy-updates
Sections: main,multiverse,restricted,universe
Including source.
Attempting to get lock, this might take 2 minutes before it fails.
Get Release files.
[0%] Getting: dists/dapper/Release... ok
[0%] Getting: dists/dapper/Release.gpg... ok
Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
[0%] Getting: dists/dapper-backports/Release... ok
[0%] Getting: dists/dapper-backports/Release.gpg... ok
Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
[0%] Getting: dists/dapper-proposed/Release... ok
[0%] Getting: dists/dapper-proposed/Release.gpg... ok
Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
[0%] Getting: dists/dapper-security/Release... ok
[0%] Getting: dists/dapper-security/Release.gpg... ok
Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
[0%] Getting: dists/dapper-updates/Release... ok
[0%] Getting: dists/dapper-updates/Release.gpg... ok
Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
[0%] Getting: dists/edgy/Release... ok
[0%] Getting: dists/edgy/Release.gpg... ok
Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
[0%] Getting: dists/edgy-backports/Release... ok
[0%] Getting: dists/edgy-backports/Release.gpg... ok
Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
[0%] Getting: dists/edgy-proposed/Release... ok
[0%] Getting: dists/edgy-proposed/Release.gpg... ok
Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
[0%] Getting: dists/edgy-security/Release... ok
[0%] Getting: dists/edgy-security/Release.gpg... ok
Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
[0%] Getting: dists/edgy-updates/Release... ok
[0%] Getting: dists/edgy-updates/Release.gpg... ok
Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
Get Packages and Sources files and other miscellany.
Parse Packages and Sources files and add to the file list everything therein.
Cleanup mirror.
Download all files that we need to get (140 MiB).
Downloaded 140 MiB in 917s at 155.82 kiB/s
Errors:
Release signature does not verify.
Release signature does not verify.
Release signature does not verify.
Release signature does not verify.
Release signature does not verify.
Release signature does not verify.
Release signature does not verify.
Release signature does not verify.
Release signature does not verify.
Release signature does not verify.
Everything OK. Moving meta files.
All done.
Ended at:  Thu Jan 4 20:52:30 HKT 2007

谢谢～

fmying

大家没人知道么？谢谢了～～

FireMeteor

Can't exec "gpg": No such file or directory at /usr/bin/debmirror line 586.
Release signature does not verify.
你是不是没装gnupg包？

fmying

请问一下，gnupg包的作用是什么？

fmying

装了gnupg，发现出现这个提示的原因是：
gpg: Signature made Tue 19 Dec 2006 03:22:43 HKT using DSA key ID 437D05B5
gpg: Can't check signature: public key not found
Release signature does not verify.

想问一下，对于这种因为没有公钥而导致的错误，debmirror能否使用这些Release和Package更新mirror？

FireMeteor

估计是没有etch的公匙
有个包里面有的，名字忘了

FireMeteor

debian-archive-keyring
应该是这个

fmying

我们的服务器是跑Gentoo的，没有debian-archive-keyring
请问是需要导入公钥还是需要安装什么软件包？

FireMeteor

汗,Gentoo上的debmirror，这想法倒也别致
其实就是导入一个公钥吧
附件里面是etch的公钥，自己导入吧

FireMeteor

等等，你维护的是ubuntu的镜像？
那就无视我发的key吧，我没注意，发的是debian Etch的……
也许能从这里找到
http://subkeys.pgp.net/