Your xUbuntu 22.04 key has expired. #1390

kaderud · 2024-05-01T12:47:06Z

kaderud
May 1, 2024

ManuelSchneid3r
May 2, 2024
Maintainer

when have you installed this key? please post the output of cat /etc/apt/trusted.gpg.d/home_manuelschneid3r.gpg |gpg --list-packets. also please provide the output of the error you get. I talked to the guys at OBS. They need more info.


curl https://download.opensuse.org/repositories/home:/manuelschneid3r/xUbuntu_22.04/Release.key |gpg --list-packets
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1117  100  1117    0     0   8292      0 --:--:-- --:--:-- --:--:--  8335
# off=0 ctb=99 tag=6 hlen=3 plen=269
:public key packet:
	version 4, algo 1, created 1509111945, expires 0
	pkey[0]: [2048 bits]
	pkey[1]: [17 bits]
	keyid: 1488EB46E192A257
# off=272 ctb=b4 tag=13 hlen=2 plen=74
:user ID packet: "home:manuelschneid3r OBS Project <home:[email protected]>"
# off=348 ctb=89 tag=2 hlen=3 plen=318
:signature packet: algo 1, keyid 1488EB46E192A257
	version 4, created 1645243197, md5len 0, sigclass 0x13
	digest algo 8, begin of digest 0e 53
	hashed subpkt 2 len 4 (sig created 2022-02-19)
	hashed subpkt 27 len 1 (key flags: 03)
	hashed subpkt 9 len 4 (key expires after 6y185d14h14m)
	hashed subpkt 11 len 5 (pref-sym-algos: 9 8 7 3 2)
	hashed subpkt 21 len 5 (pref-hash-algos: 8 2 9 10 11)
	hashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)
	hashed subpkt 30 len 1 (features: 01)
	hashed subpkt 23 len 1 (keyserver preferences: 80)
	subpkt 16 len 8 (issuer key ID 1488EB46E192A257)
	data: [2048 bits]
# off=669 ctb=88 tag=2 hlen=2 plen=70
:signature packet: algo 17, keyid 3B3011B76B9D6523
	version 4, created 1509111945, md5len 0, sigclass 0x13
	digest algo 2, begin of digest 65 c2
	hashed subpkt 2 len 4 (sig created 2017-10-27)
	subpkt 16 len 8 (issuer key ID 3B3011B76B9D6523)
	data: [155 bits]
	data: [160 bits]

On a ubuntu test system:

 cat /etc/apt/trusted.gpg.d/home_manuelschneid3r.gpg |gpg --list-packets
# off=0 ctb=99 tag=6 hlen=3 plen=269
:public key packet:
	version 4, algo 1, created 1509111945, expires 0
	pkey[0]: [2048 bits]
	pkey[1]: [17 bits]
	keyid: 1488EB46E192A257
# off=272 ctb=b4 tag=13 hlen=2 plen=74
:user ID packet: "home:manuelschneid3r OBS Project <home:[email protected]>"
# off=348 ctb=89 tag=2 hlen=3 plen=318
:signature packet: algo 1, keyid 1488EB46E192A257
	version 4, created 1645243197, md5len 0, sigclass 0x13
	digest algo 8, begin of digest 0e 53
	hashed subpkt 2 len 4 (sig created 2022-02-19)
	hashed subpkt 27 len 1 (key flags: 03)
	hashed subpkt 9 len 4 (key expires after 6y185d14h14m)
	hashed subpkt 11 len 5 (pref-sym-algos: 9 8 7 3 2)
	hashed subpkt 21 len 5 (pref-hash-algos: 8 2 9 10 11)
	hashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)
	hashed subpkt 30 len 1 (features: 01)
	hashed subpkt 23 len 1 (keyserver preferences: 80)
	subpkt 16 len 8 (issuer key ID 1488EB46E192A257)
	data: [2048 bits]
# off=669 ctb=88 tag=2 hlen=2 plen=70
:signature packet: algo 17, keyid 3B3011B76B9D6523
	version 4, created 1509111945, md5len 0, sigclass 0x13
	digest algo 2, begin of digest 65 c2
	hashed subpkt 2 len 4 (sig created 2017-10-27)
	subpkt 16 len 8 (issuer key ID 3B3011B76B9D6523)
	data: [155 bits]
	data: [160 bits]

0 replies

kaderud · 2024-05-02T08:07:57Z

kaderud
May 2, 2024
Author

I don't remember when I first downloaded the key, probably a couple of years ago, I updated it a few days ago since APT then started displaying errors about it having expired.

Err:7 http://download.opensuse.org/repositories/home:/manuelschneid3r/xUbuntu_22.04 InRelease
The following signatures were invalid: EXPKEYSIG 1488EB46E192A257 home:manuelschneid3r OBS Project home:[email protected]

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://download.opensuse.org/repositories/home:/manuelschneid3r/xUbuntu_22.04 InRelease: The following signatures were invalid: EXPKEYSIG 1488EB46E192A257 home:manuelschneid3r OBS Project home:[email protected]
W: Failed to fetch http://download.opensuse.org/repositories/home:/manuelschneid3r/xUbuntu_22.04/InRelease The following signatures were invalid: EXPKEYSIG 1488EB46E192A257 home:manuelschneid3r OBS Project home:[email protected]
W: Some index files failed to download. They have been ignored, or old ones used instead.

So I tried it again today, downloaded the key from http://download.opensuse.org/repositories/home:/manuelschneid3r/xUbuntu_22.04

gpg --show-keys /etc/apt/keyrings/manuelschneid3r.gpg
pub   rsa2048 2017-10-27 [SC] [expired: 2024-04-29]
      A4B83CD05FDF5C5178482D4A1488EB46E192A257
uid                      home:manuelschneid3r OBS Project <home:[email protected]>


gpg --list-packets /etc/apt/keyrings/manuelschneid3r.gpg
# off=0 ctb=99 tag=6 hlen=3 plen=269
:public key packet:
	version 4, algo 1, created 1509111945, expires 0
	pkey[0]: [2048 bits]
	pkey[1]: [17 bits]
	keyid: 1488EB46E192A257
# off=272 ctb=b4 tag=13 hlen=2 plen=74
:user ID packet: "home:manuelschneid3r OBS Project <home:[email protected]>"
# off=348 ctb=89 tag=2 hlen=3 plen=318
:signature packet: algo 1, keyid 1488EB46E192A257
	version 4, created 1645243197, md5len 0, sigclass 0x13
	digest algo 8, begin of digest 0e 53
	hashed subpkt 2 len 4 (sig created 2022-02-19)
	hashed subpkt 27 len 1 (key flags: 03)
	hashed subpkt 9 len 4 (key expires after 6y185d14h14m)
	hashed subpkt 11 len 5 (pref-sym-algos: 9 8 7 3 2)
	hashed subpkt 21 len 5 (pref-hash-algos: 8 2 9 10 11)
	hashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)
	hashed subpkt 30 len 1 (features: 01)
	hashed subpkt 23 len 1 (keyserver preferences: 80)
	subpkt 16 len 8 (issuer key ID 1488EB46E192A257)
	data: [2048 bits]
# off=669 ctb=88 tag=2 hlen=2 plen=70
:signature packet: algo 17, keyid 3B3011B76B9D6523
	version 4, created 1509111945, md5len 0, sigclass 0x13
	digest algo 2, begin of digest 65 c2
	hashed subpkt 2 len 4 (sig created 2017-10-27)
	subpkt 16 len 8 (issuer key ID 3B3011B76B9D6523)
	data: [155 bits]
	data: [160 bits]


cat manuelschneid3r.list 
deb [arch=amd64 signed-by=/etc/apt/keyrings/manuelschneid3r.gpg] http://download.opensuse.org/repositories/home:/manuelschneid3r/xUbuntu_22.04/ /

0 replies

kaderud · 2024-05-02T08:21:14Z

kaderud
May 2, 2024
Author

I did a simple test by downloading all the keys from https://software.opensuse.org/download.html?project=home:manuelschneid3r&package=albert and then doing a gpg --show-keys home_manuelschneid3r.gpg on them, and the ONLY key that doesn't seem to be expired, is xUbuntu_24.04/Release.key

APT error: (the key I'm using is xUbuntu_22.04/Release.key)
The following signatures were invalid: EXPKEYSIG 1488EB46E192A257 home:manuelschneid3r OBS Project home:[email protected]

$ curl -fsSL https://download.opensuse.org/repositories/home:manuelschneid3r/xUbuntu_24.04/Release.key | gpg --dearmor | tee home_manuelschneid3r.gpg > /dev/null
$ gpg --show-keys home_manuelschneid3r.gpg
pub rsa2048 2017-10-27 [SC] [expires: 2026-06-24]
A4B83CD05FDF5C5178482D4A1488EB46E192A257

$ curl -fsSL https://download.opensuse.org/repositories/home:manuelschneid3r/xUbuntu_23.10/Release.key | gpg --dearmor | tee home_manuelschneid3r.gpg > /dev/null
$ gpg --show-keys home_manuelschneid3r.gpg
pub rsa2048 2017-10-27 [SC] [expired: 2024-04-29]
A4B83CD05FDF5C5178482D4A1488EB46E192A257

$ curl -fsSL https://download.opensuse.org/repositories/home:manuelschneid3r/xUbuntu_23.04/Release.key | gpg --dearmor | tee home_manuelschneid3r.gpg > /dev/null
$ gpg --show-keys home_manuelschneid3r.gpg
pub rsa2048 2017-10-27 [SC] [expired: 2024-04-29]
A4B83CD05FDF5C5178482D4A1488EB46E192A257

$ curl -fsSL https://download.opensuse.org/repositories/home:manuelschneid3r/xUbuntu_22.10/Release.key | gpg --dearmor | tee home_manuelschneid3r.gpg > /dev/null
$ gpg --show-keys home_manuelschneid3r.gpg
pub rsa2048 2017-10-27 [SC] [expired: 2024-04-29]
A4B83CD05FDF5C5178482D4A1488EB46E192A257

$ curl -fsSL https://download.opensuse.org/repositories/home:manuelschneid3r/xUbuntu_22.04/Release.key | gpg --dearmor | tee home_manuelschneid3r.gpg > /dev/null
$ gpg --show-keys home_manuelschneid3r.gpg
pub rsa2048 2017-10-27 [SC] [expired: 2024-04-29]
A4B83CD05FDF5C5178482D4A1488EB46E192A257

$ curl -fsSL https://download.opensuse.org/repositories/home:manuelschneid3r/xUbuntu_20.04/Release.key | gpg --dearmor | tee home_manuelschneid3r.gpg > /dev/null
$ gpg --show-keys home_manuelschneid3r.gpg
pub rsa2048 2017-10-27 [SC] [expired: 2024-04-29]
A4B83CD05FDF5C5178482D4A1488EB46E192A257

$ curl -fsSL https://download.opensuse.org/repositories/home:manuelschneid3r/xUbuntu_18.04/Release.key | gpg --dearmor | tee home_manuelschneid3r.gpg > /dev/null
$ gpg --show-keys home_manuelschneid3r.gpg
pub rsa2048 2017-10-27 [SC] [expired: 2024-04-29]
A4B83CD05FDF5C5178482D4A1488EB46E192A257

$ curl -fsSL https://download.opensuse.org/repositories/home:manuelschneid3r/xUbuntu_16.04/Release.key | gpg --dearmor | tee home_manuelschneid3r.gpg > /dev/null
$ gpg --show-keys home_manuelschneid3r.gpg
pub rsa2048 2017-10-27 [SC] [expired: 2022-03-05]
A4B83CD05FDF5C5178482D4A1488EB46E192A257

4 replies

ManuelSchneid3r May 2, 2024
Maintainer

I talked to the guys at OBS. OBS does not implicitly update keys in any way for deb systems. seems like yum handles key updates implicitly. Thats horrible because probably every user will unfortunately notice it. Looking for a solution now. Probably a keyring package can help. This is absolutely frustrating. I just spent months trying to go with flatpak because distribution on linux is such a pain. However it is pretty invasive (the project itself has to be flatpak aware which is a huge amount of work).

ManuelSchneid3r May 2, 2024
Maintainer

The distro specific keys are updated only on a publish and only if expired.

To fix the key issue for now importing an updated version should help:

curl -fsSL https://build.opensuse.org/projects/home:manuelschneid3r/signing_keys/download?kind=gpg | gpg --dearmor > /etc/apt/trusted.gpg.d/home_manuelschneid3r.gpg

Please let me know if this works for you.

kaderud May 2, 2024
Author

Your fix with the new signing keys worked great on my Linux Mint 21.3 (Ubuntu 22.04-based), now APT works and no more errors! Thanks for the quick fix!

ManuelSchneid3r May 2, 2024
Maintainer

Great! the guys at OBS made expiration user configurable. openSUSE/open-build-service#16082. I guess setting the expirations to like 6 years should suffice for like 99% of the users.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Albert

Your xUbuntu 22.04 key has expired. #1390

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 4 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Albert

Your xUbuntu 22.04 key has expired. #1390

kaderud May 1, 2024

Replies: 3 comments · 4 replies

ManuelSchneid3r May 2, 2024 Maintainer

kaderud May 2, 2024 Author

kaderud May 2, 2024 Author

ManuelSchneid3r May 2, 2024 Maintainer

ManuelSchneid3r May 2, 2024 Maintainer

kaderud May 2, 2024 Author

ManuelSchneid3r May 2, 2024 Maintainer

kaderud
May 1, 2024

Replies: 3 comments 4 replies

ManuelSchneid3r
May 2, 2024
Maintainer

kaderud
May 2, 2024
Author

kaderud
May 2, 2024
Author

ManuelSchneid3r May 2, 2024
Maintainer

ManuelSchneid3r May 2, 2024
Maintainer

kaderud May 2, 2024
Author

ManuelSchneid3r May 2, 2024
Maintainer