apt updates from apt.freedom.press silently failing due to key expiry

[eloquence]

Steps to reproduce

1. Ensure your workstation is provisioned to prod
2. Run sudo apt update in sd-small-buster-template

Expected behavior

Package index is updated

Actual behavior

apt prints an error:

The following signatures were invalid: EXPKEYSIG 310F561200F4AD77 SecureDrop Release Signing Key
...
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://apt.freedom.press buster Release: ...

The repo is dual-signed, but one of the keys expiring appears to be sufficient for apt to no longer consider the signature valid. apt exits 0, and our updater (which triggers updates via Salt) does not error out. However, given the output above, I am assuming updates we issue will no longer be successfully fetched or applied until we switch to the single valid signing key.

[sssoleileraaa]

I just want to note that the updater runs successfully without error on prod and the client seems to work fine, but still looking into reproing by following your steps. I can also verify this assumption after some more testing and report back here:

However, given the output above, I am assuming updates we issue will no longer be successfully fetched or applied until we switch to the single valid signing key.

[eloquence]

I'm still getting the EXPKEYSIG failure when running sudo apt update in sd-small-buster-template.

[eloquence]

Removing stale copies in /var/lib/apt/lists resolved. Not sure why it did not fetch the new version automatically :/

[eloquence]

@zenmonkeykstop pushed a re-signed Release file (with a tiny modification to the Valid-Until field) to the release branch here:
https://github.com/freedomofpress/securedrop-debian-packages-lfs/tree/release

That means it's now available via apt-qa: https://apt-qa.freedom.press/

Switching my template to apt-qa, I can successfully run apt update and install packages; this is not a 100% valid test as it doesn't tell us that apt will correctly replace the stale Release file and signature once this change is live on apt.freedom.press, but since the timestamp on both files is now changed, I would expect so.

I would suggest opening a PR from release to main with this change.

[eloquence]

I can confirm that this was resolved via https://github.com/freedomofpress/securedrop-debian-packages-lfs/pull/56 ; templates that previously failed to update apt.freedom.press are now re-fetching the index and installing packages.