GPG error: https://dl.google.com/linux/mod-pagespeed/deb stable Release: The following signatures were invalid

[vbaranovskiy-plesk]

Hello,

I'm trying to install mod-pagespeed on Ubuntu 16 according https://www.modpagespeed.com/doc/download:

wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
wget https://dl-ssl.google.com/dl/linux/direct/mod-pagespeed-stable_current_amd64.deb
dpkg -i mod-pagespeed-*.deb
apt-get -f install

apt update responses with the following content:

Ign:17 http://dl.google.com/linux/mod-pagespeed/deb stable InRelease
Get:18 http://dl.google.com/linux/mod-pagespeed/deb stable Release [2,154 B]
Get:19 http://dl.google.com/linux/mod-pagespeed/deb stable Release.gpg [819 B]
Ign:19 http://dl.google.com/linux/mod-pagespeed/deb stable Release.gpg
Reading package lists... Done
W: GPG error: http://dl.google.com/linux/mod-pagespeed/deb stable Release: The following signatures were invalid: KEYEXPIRED 1555048520 KEYEXPIRED 1579833932 KEYEXPIRED 1579833932 KEYEXPIRED 1555048520 KEYEXPIRED 1579833932 KEYEXPIRED 1555048520 KEYEXPIRED 1579833932
E: The repository 'http://dl.google.com/linux/mod-pagespeed/deb stable Release' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

I removed and install again google keys + i changed url http://dl.google.com/linux/mod-pagespeed/deb to https://dl.google.com/linux/mod-pagespeed/deb in /etc/apt/sources.list.d/mod-pagespeed.list but it didn't help.

[Lofesa]

Hi @vbaranovskiy-plesk
See the thread: https://groups.google.com/forum/#!topic/mod-pagespeed-discuss/Cy88SOHRWh0

[csmicfool]

Hi @vbaranovskiy-plesk
See the thread: https://groups.google.com/forum/#!topic/mod-pagespeed-discuss/Cy88SOHRWh0

@Lofesa Was this meant to be helpful? It's a 5-year-old dead thread which Google isn't monitoring and provides no assistance/resolution - only proof that Google lets these expire every 6 months or so.

We NEED an engineer from google to help resolve this problem. It's not a code issue, not a setup issue - it's purely an issue with their package server.

[Lofesa]

Last post of the thread is dated 28/01/2020
Pagespeed modules is not a Google proyect since 2018.

[csmicfool]

@Lofesa is there a new package repo? Any fix at all? The error we're seeing affects more than just pagespeed, FYI.

[Lofesa]

@csmicfool
Sorry, I don´t know nothing about deb packages.
Maybe @oschaaf or @jmarantz can do something about this, but I think is out of their hands.
You can see these issues from April 2019 #1872 #1875 and #1877

[csmicfool]

@Lofesa thanks. Google has no proper support process for their products so we can only look here to hopefully find someone with a contact on the inside. Normally they resolve it faster than this, but it happens every 6 months or so.

[Flole998]

I have contacted someone at Google who should be able to fix this or at least make sure it's fixed in a timely manner. Let's see if this helps.

[jmarantz]

Sorry about the delay on this. As announced in 2017 <https://groups.google.com/forum/#!searchin/mod-pagespeed-discuss/apache$20software$20foundation%7Csort:date/mod-pagespeed-discuss/SYx1nOS6HsE/4kkGpZ_3AgAJ>, mod_pagespeed is incubating in the Apache Software Foundation, which is working on building a new binary release (1.14) which should hopefully resolve the signature problem as well as fix a few bugs. We are always looking for more committers to help out add features and fix more bugs :)

…

On Mon, Feb 10, 2020 at 3:34 PM Flole998 ***@***.***> wrote: I have contacted someone at Google who should be able to fix this or at least make sure it's fixed in a timely manner. Let's see if this helps. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1979?email_source=notifications&email_token=AAO2IPJPO7E3BBCOSPIQ6RTRCG26XA5CNFSM4KL5JJL2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELKFKMI#issuecomment-584340785>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAO2IPIVXXHR2BNZA3NRX2TRCG26XANCNFSM4KL5JJLQ> .

[oschaaf]

For those who like to track release progess, the final VOTE for shipping 1.14.36.1 (incubating) is over at https://lists.apache.org/thread.html/r480c38ee965f80baa6357dd919d5f14438bc9e4772a66fa514dd17d6%40%3Cgeneral.incubator.apache.org%3E

If that gets approved for shipping, the offered .deb could be hosted in a package repository for an easy upgrade path (e.g. a launchpad could probably work short term?).

[Flole998]

I have contacted someone at Google who should be able to fix this or at least make sure it's fixed in a timely manner. Let's see if this helps.

I just got Feedback that it should be fixed now. I tested it and indeed it's working for me.

[jmarantz]

Yes, big shout-out to the Google/Chrome binaries release team (which is what mod_pagespeed used for all binary releases through today) for doing one more binary re-spin. Hopefully we'll be able to take it forward via the Apache flow going forward.

…

On Tue, Feb 11, 2020 at 12:52 PM Flole998 ***@***.***> wrote: I have contacted someone at Google who should be able to fix this or at least make sure it's fixed in a timely manner. Let's see if this helps. I just got Feedback that it should be fixed now. I tested it and indeed it's working for me. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1979?email_source=notifications&email_token=AAO2IPKKIB2X5T3CB5FOY3DRCLQWFA5CNFSM4KL5JJL2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELNNEVA#issuecomment-584766036>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAO2IPPCVAVSHGBNL4D4U73RCLQWFANCNFSM4KL5JJLQ> .

[MrBenGriffin]

This seems to still be an issue on Ubuntu 22.04

W: GPG error: http://dl.google.com/linux/mod-pagespeed/deb stable Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 78BD65473CB3BD13
E: The repository 'http://dl.google.com/linux/mod-pagespeed/deb stable Release' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.

[Lofesa]

Have you tried this
https://www.modpagespeed.com/doc/download#2_mod_pagespeed_apache_incubating_beta_1_14_36_1_r0_amd64_deb

[Zoey2936]

Fehl:13 http://dl.google.com/linux/mod-pagespeed/deb stable Release.gpg                                                                             
  Die folgenden Signaturen waren ungültig: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>   
W: Während der Überprüfung der Signatur trat ein Fehler auf. Das Depot wurde nicht aktualisiert und die vorherigen Indexdateien werden verwendet. GPG-Fehler: http://dl.google.com/linux/mod-pagespeed/deb stable Release: Die folgenden Signaturen waren ungültig: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>
W: Fehlschlag beim Holen von http://dl.google.com/linux/mod-pagespeed/deb/dists/stable/Release.gpg Die folgenden Signaturen waren ungültig: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>
W: Einige Indexdateien konnten nicht heruntergeladen werden. Sie wurden ignoriert oder alte an ihrer Stelle benutzt.

Where can I find the newest Key file?

[stideswell]

Hello, I'm seeing the same key error as mentioned above (Ubuntu 20).

Err:8 http://dl.google.com/linux/mod-pagespeed/deb stable Release.gpg The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com> Reading package lists... Done W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://dl.google.com/linux/mod-pagespeed/deb stable Release: The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com> W: Failed to fetch http://dl.google.com/linux/mod-pagespeed/deb/dists/stable/Release.gpg The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com> W: Some index files failed to download. They have been ignored, or old ones used instead.

[7underlines]

Where can I find the newest Key file?

There is no new key file.

Google is no longer officially driving the mod_pagespeed effort, the old download's signature has expired.

This means that we can no longer update mod_pagespeed with apt.

# comment out the existing apt source entry (I'm on Debian, might be slightly different on Ubuntu)
nano /etc/apt/sources.list.d/mod-pagespeed.list
# before: deb http://dl.google.com/linux/mod-pagespeed/deb/ stable main
# after: #deb http://dl.google.com/linux/mod-pagespeed/deb/ stable main

The good news is that you can easily upgrade your installed mod_pagespeed package with the new one, but you need to download and install that manually.

# check for updated download links at https://www.modpagespeed.com/doc/download
wget https://dlcdn.apache.org/incubator/pagespeed/1.14.36.1/x64/mod-pagespeed-apache-incubating-beta_1.14.36.1-r0_amd64.deb
dpkg -i mod-pagespeed-apache-incubating-beta_1.14.36.1-r0_amd64.deb
systemctl restart apache2

I'm answering here because this get's found by Google search. #2094 is the same.