GoAccess Invalid deb signatures EXPKEYSIG - deb repo

[jonathanza]

The following command from https://goaccess.io/download#official-repo is failing:

sudo apt-get update
Hit:1 http://za.archive.ubuntu.com/ubuntu focal InRelease
Hit:2 http://za.archive.ubuntu.com/ubuntu focal-updates InRelease
Hit:3 http://za.archive.ubuntu.com/ubuntu focal-backports InRelease
Hit:4 http://ppa.launchpad.net/git-core/ppa/ubuntu focal InRelease
Hit:5 http://nginx.org/packages/ubuntu focal InRelease
Hit:6 http://security.ubuntu.com/ubuntu focal-security InRelease
Hit:7 http://ppa.launchpad.net/ondrej/php/ubuntu focal InRelease
Hit:8 https://esm.ubuntu.com/infra/ubuntu focal-infra-security InRelease
Get:9 https://deb.goaccess.io focal InRelease [2,345 B]
Hit:10 https://esm.ubuntu.com/infra/ubuntu focal-infra-updates InRelease
Err:9 https://deb.goaccess.io focal InRelease
  The following signatures were invalid: EXPKEYSIG 97BD1A0133449C3D Gerardo Orellana <goaccess@prosoftcorp.com>
Fetched 2,345 B in 4s (532 B/s)
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://deb.goaccess.io focal InRelease: The following signatures were invalid: EXPKEYSIG 97BD1A0133449C3D Gerardo Orellana <goaccess@prosoftcorp.com>
W: Failed to fetch https://deb.goaccess.io/dists/focal/InRelease  The following signatures were invalid: EXPKEYSIG 97BD1A0133449C3D Gerardo Orellana <goaccess@prosoftcorp.com>
W: Some index files failed to download. They have been ignored, or old ones used instead.

I downloaded the key again but the same error occurred.

[ahayes]

Thank you for creating this issue. I have been trying to find my way around the same problem for the last 30 minutes or so with no success. It looks like this issue comes up for various projects when the repo signing key changes.

[klosterbruder]

I can confirm this problem on Debian as well. The repository key needs to be renewed or replaced.

Adding trusted=yes to the repo definition is a very much not recommended workaround, if you really absolutely have to install goaccess via the Debian / Ubuntu repositories now.

[dariosusman]

The GPG key has indeed expired:

/etc/apt/trusted.gpg.d/goaccess.gpg
-----------------------------------
pub   rsa3072 2020-05-17 [SC] [expired: 2022-05-17]
      C03B 4888 7D5E 56B0 4671  5D32 97BD 1A01 3344 9C3D
uid           [ expired] Gerardo Orellana <goaccess@prosoftcorp.com>

[allinurl]

Thanks everyone for reporting this. The key has been renewed, please download it again, e.g.,

$ sudo apt-key del 97BD1A0133449C3D
$ sudo rm -rf /usr/share/keyrings/goaccess.gpg
$ wget -O - https://deb.goaccess.io/gnugpg.key | gpg --dearmor | sudo tee /usr/share/keyrings/goaccess.gpg >/dev/null

The key fingerprint is the same: C03B 4888 7D5E 56B0 4671 5D32 97BD 1A01 3344 9C3D

Please let me know if that solves the issue on your end.

[dariosusman]

Resolved!

Thank you!

[olstjos]

Thanks, however, in addition to the above instructions to avoid the "The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 97BD1A0133449C3D" I had to also do this:

cd /usr/share/keyrings;
sudo apt-key add goaccess.gpg

[AndrewCRichards]

That didn't quite work for me on an Ubuntu 20.04 LTS x86_64 system, some other steps may help,

• I wanted to verify the signature of the new key (look for signature ...9C3D showing up in output): wget -O - https://deb.goaccess.io/gnugpg.key | gpg --show-keys
• Then I was happy to download it as suggested to /usr/share/keyrings/goaccess.gpg
• apt-get update was failing with "N: Skipping acquisition of configured file 'main/binary-i386/Packages', as repository 'https://deb.goaccess.io focal InRelease' doesn't support architecture 'i386'"
• To fix this I edited the contents of /etc/apt/sources.list.d/goaccess.list to (adding the arch setting),
  deb [signed-by=/usr/share/keyrings/goaccess.gpg arch=amd64] https://deb.goaccess.io/ focal main
• This way the key doesn't have to be on my apt keyring, but it could be (apt-key add /usr/share/keyrings/goaccess.gpg), in which case I think that signed-by option can be removed.

[olstjos]

on a recent 20.04 LTS install I took steps from @allinurl and added two lines to it and it worked with the extra two lines, see below:

sudo apt-key del 97BD1A0133449C3D
sudo rm -rf /usr/share/keyrings/goaccess.gpg
wget -O - https://deb.goaccess.io/gnugpg.key | gpg --dearmor | sudo tee /usr/share/keyrings/goaccess.gpg >/dev/null
cd /usr/share/keyrings
sudo apt-key add goaccess.gpg