Apt key for Debian Package is expiring on 16.02.2024 #2074
Comments
|
Could you try installing I'll automate it later, but I need more people to confirm that installing that package works fine. |
|
The key is used on a lot of machines. |
And I rather not break "a lot of machines" by automating something that will then need manual intervention, so I need confirmation that: |
|
@oerdnj is We'll need to do a release of DDEV so people will have the new key using the official technique, and it sounds like all apt updates will be broken before that? Please give the full new suggested technique. Right now my testing is blocked by the intermittent which is happening consistently right now. I'm absolutely not sure where that comes from and when it happens. |
|
I am not sure yet about the bootstrapping. The |
|
I guess the primary request in this issue is to update the apt.gpg ASAP, that alone would solve things for me.
|
|
I’ll probably upload the keyring package to the repository root and update the instructions to install the deb by hand first. I’ll keep the apt.gpg for the next 2 years. |
|
This is quite urgent, right, as reported by the OP? Both techniques (but especially the traditional technique) need to work right away, or all |
|
I see that the apt key has been updated, thank you very much. Initial situation: After |
|
Can confirm that installing |
|
Thanks a lot for updating the key. |
|
Just added this to our build. All good. 👍 For reference, the full URL is - name: apt | Add the deb.sury.org key(s) and repo
tags: apt
block:
- name: apt | Remove old key
ansible.builtin.file:
path: /usr/share/keyrings/deb.sury.org-php.gpg
state: absent
- name: apt | Install the debsuryorg-archive-keyring.deb package
ansible.builtin.apt:
deb: https://packages.sury.org/debsuryorg-archive-keyring.deb
- name: apt | Remove the old Sury PHP repo
ansible.builtin.apt_repository:
repo: deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ {{ ansible_distribution_release }} main
state: absent
- name: apt | Add Sury PHP repo
ansible.builtin.apt_repository:
repo: deb https://packages.sury.org/php/ {{ ansible_distribution_release }} main
state: present
# Packages are now available to install.@michizubi-SRF check out Ansible. Super helpful for stuff like this. |
|
@brenc Thanks for the hint :) We're using Puppet for all our servers. |
|
Are there any plans to include/update/replace the PPA signing key as well? |
|
If you updated recently, the new keyring package should have been installed. |
|
Thanks for this thread, I can confirm that executing |
|
FTR it might be required to remove the old (expired) key out of the This should work for both old (using global keyring) and new installations (using |
|
Agreed, would this be implemented in the debsuryorg-archive-keyring.deb ? I see that https://packages.sury.org/php/README.txt has been updated with the new approach, thanks |
What you mean by "this"? |
I was responding to your
It (might be) cool for the debsuryorg-archive-keyring.deb to do this cleanup? |
|
Even i ran it still showed up apt-key
THEN I exec I guess I lost my apt |
where does this come from? |
|
Hi, ${SUDO} apt-get update shouldn't it be ${SUDO} apt-get update || true at first line? |
|
I have tried sudo apt install debsuryorg-archive-keyring with no luck. I have deleted everything sury I can find.
|
|
You need to download the package manually and install it by hand if you hadn’t managed to update the repository in time. |
I have done so and got the following error. Even though rebooting is rarely required in Debian, I have done so and tried again. ` debsuryorg-archive-keyring.deb 100%[=======================================================================================================================================>] 4.31K --.-KB/s in 0s 2024-02-29 17:56:32 (88.9 MB/s) - ‘debsuryorg-archive-keyring.deb’ saved [4416/4416] root@azure:~/sh# dpkg -i debsuryorg-archive-keyring.deb ` ` |
Thanks for the URL - i was doing dpkg -i on it and now all is back to normal again :) |
|
@oerdnj do the install instructions need to be updated now that you've done a packaged install for the key? https://packages.sury.org/php/README.txt |
The instructions are fine. Do you have any specific line on mind? |
|
Ah, I see the debsuryorg-archive-keyring.deb is there. I just skimmed over it We will change the DDEV install technique in https://github.com/ddev/ddev/blob/5ec62754dcf86ffa6a6c3447e35d2e361eb1a349/containers/ddev-php-base/Dockerfile#L62-L63 to use debsuryorg-archive-keyring.deb Does that help prevent future key expiration trouble? |
Yep, that was the whole point of introducing the package. |
|
Hi, I, too, ran into the problem with the expired gpg.key. So I installed debsuryorg-archive-keyring as per the above advice. But this doesn't change anything for me. I keep getting the error message about the signatures being invalid. And after @RaidOpe's experience ("I guess I lost my apt"), I am a bit hesitant to delete files in my /etc/apt/trusted.gpg.d folder. But even if I wanted to, there is only one sury-related file there: debsuryorg-archive.gpg And it seems to be the new key. But I still get the apt update error. So what to do now? Thanks! |
|
I wanted to know what was doing the file Sorry if noob question, but why do we need to have all those gpg, if we only need to put (I'm using Ansible too and this new method creates 10 files instead of the only one Thanks in advance. |
|
There's a single package for all the repositories, and for the legacy system. It's not feasible to have a separate keyring package for each of the repositories. |
Frequently asked questions
Describe the bug
Apt key for the Debian package is expiring on 16.02.2024, see the following output:
To Reproduce
Steps to reproduce the behavior:
Your understanding of what is happening
The key should be updated to extend expiration
What steps did you take to resolve issue yourself before reporting it here
See section "To Reproduce"
Expected behavior
Key is not expiring in the next 2 weeks
Distribution (please complete the following information):
The text was updated successfully, but these errors were encountered: