I am setting up an OPKG feed on an embedded system and am encountering issues with GPG signature verification. Here’s the setup and the problem:

Setup Details:
Generated a GPG key using:

gpg --quick-generate-key "Name  <mail id>" rsa4096 sign

Signed Packages.gz using:

gpg --detach-sign --armor Packages.gz
mv Packages.gz.asc Packages.asc

Added the public key to /etc/opkg/gpg/pubring.gpg:

gpg --no-default-keyring --keyring /etc/opkg/gpg/pubring.gpg --import <public_key_file>

Verified the signature manually:

gpg --no-default-keyring --keyring /etc/opkg/gpg/pubring.gpg --verify Packages.asc Packages.gz

The output confirms a valid signature:

gpg: Good signature from "GivEnergy <[email protected]>" [ultimate]

Configured opkg.conf:

option check_signature 1
src/gz local-feed http://<server _ip of ipk files>:8000/armv8a
option signature_type gpg-asc

Problem:
When I run opkg update, OPKG fails to verify the GPG signature:

root@imx93-var-som:/etc/opkg# opkg update
Downloading http://192.168.1.19:8000/armv8a/Packages.gz.
Downloading http://192.168.1.19:8000/armv8a/Packages.asc.
 * opkg_verify_gpg_signature: Signature status returned error: Bad signature
 * pkg_src_verify: Signature verification failed for local-feed.
root@imx93-var-som:/etc/opkg#

Steps Tried:

1. Verified the signature manually using GPG outside of OPKG — works
   fine.
2. Set the key to “ultimate trust” via gpg –edit-key.
3. Cleared /var/lib/opkg/lists/ and retried opkg update.
4. Verified file permissions (e.g., chmod 644
   /etc/opkg/gpg/pubring.gpg).
5. Exported trust explicitly using gpg –export-ownertrust and imported
   it.
6. Tested GPGME installation (opkg info gpgme) — it is installed.