Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Installation on Linux fails ("Public key signature verification has failed", "... does not have a Release file.") #2483

Closed
dietmar opened this issue Jun 22, 2018 · 7 comments

Comments

@dietmar
Copy link

commented Jun 22, 2018

  • [x ] I have searched open and closed issues for duplicates

Bug description

The installation instructions for Linux on https://www.signal.org/download/ (below) fail at the apt update step ...

curl -s https://updates.signal.org/desktop/apt/keys.asc | sudo apt-key add -
echo "deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main" | sudo tee -a /etc/apt/sources.list.d/signal-xenial.list
sudo apt update && sudo apt install signal-desktop

... with this error message:

Err:10 https://updates.signal.org/desktop/apt xenial Release
  gnutls_handshake() failed: Public key signature verification has failed.
Reading package lists... Done
E: The repository 'https://updates.signal.org/desktop/apt xenial Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

I then tried to see what dists are available at https://updates.signal.org/desktop/apt which gave a 404, i.e., the entire apt repository seems to be down!

Platform info

Operating System: Debian stretch

@scottnonnenberg-signal

This comment has been minimized.

Copy link
Member

commented Jun 22, 2018

@dietmar I was just able to do an sudo apt-get update && sudo apt-get upgrade on my Ubuntu 18.04 machine to update to the latest linux version released yesterday. Perhaps it was a momentary blip?

@dietmar

This comment has been minimized.

Copy link
Author

commented Jun 25, 2018

@scottnonnenberg-signal Thanks for your reply. Indeed, on a different machine (running Debian jessie, i.e., oldstable) it works fine.

I assumed that I should see a listing when I browse to https://updates.signal.org/desktop/apt (similar to http://ftp.at.debian.org/debian/ for example) and since that gave a 404, I concluded the repository must be down or something. But the server just doesn't do directory listings, and I can confirm that I can download a Release file from https://updates.signal.org/desktop/apt/dists/xenial/Release

I'll remove the "apt repository down" part from the title of this issue.

However, I still don't know why it doesn't work on the first machine (Debian stretch, i.e., current stable) . apt-get update gives a little more details than apt update:

[...]
Err:11 https://updates.signal.org/desktop/apt xenial/main amd64 Packages
  gnutls_handshake() failed: Public key signature verification has failed.
[...]
Reading package lists... Done
W: The repository 'https://updates.signal.org/desktop/apt xenial Release' does not have a Release file.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Failed to fetch https://updates.signal.org/desktop/apt/dists/xenial/main/binary-amd64/Packages  gnutls_handshake() failed: Public key signature verification has failed.
E: Some index files failed to download. They have been ignored, or old ones used instead.

I can download https://updates.signal.org/desktop/apt/dists/xenial/main/binary-amd64/Packages using wget or a browser, so the file is there, but for some reason the signature verification in apt-get fails.

The first step of the download instructions (adding the apt key) worked fine:

$ curl -s https://updates.signal.org/desktop/apt/keys.asc | sudo apt-key add -
OK

I also tried the following, but it didn't help:

sudo apt-get clean
sudo mv /var/lib/apt/lists /tmp
sudo mkdir -p /var/lib/apt/lists/partial
sudo apt-get clean
sudo apt-get update

Any pointers would be appreciated.

@dietmar dietmar changed the title apt repository down, installation on Linux fails ("... does not have a Release file.") Installation on Linux fails ("Public key signature verification has failed", "... does not have a Release file.") Jun 25, 2018

@scottnonnenberg-signal

This comment has been minimized.

Copy link
Member

commented Jun 25, 2018

It does seem like your Debian Stretch machine is caching something somehow. Seems like you have already tried a number of techniques to force things to refresh. Sadly, I've got no other ideas, aside from completely undoing all of our install steps and trying again.

@dietmar

This comment has been minimized.

Copy link
Author

commented Jun 25, 2018

I tried the installation inside a fresh docker container running Debian stretch: It worked fine.

Apparently I have something weird going on on my machine. I'll close the issue now. I'll come back if I ever figure out what's going on.

@dietmar dietmar closed this Jun 25, 2018

@dietmar

This comment has been minimized.

Copy link
Author

commented Jun 28, 2018

I figured out the problem and was able to install signal-desktop successfully. It turned out that my system was in a weird state after upgrading from Debian jessie to stretch. So nothing was or is wrong with signal-desktop and I'm sorry for the noise.

In case someone runs into a similar problem, here's what had happened and how I fixed it:

Similar to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834724#15 I had an old package libgnutls-deb0-28 installed, which seemed to cause the above error. However, when I tried to remove it, it would have also removed half of all my packages, many of which seemed totally unrelated (similar to what was reported here: https://superuser.com/questions/1334780/git-clone-and-apt-error-gnutls-handshake-failed).

According to https://packages.debian.org/search?searchon=names&keywords=libgnutls-deb0-28 that package shouldn't even exist in stretch, but it turned out that I had librtmp1 version 2.4~20160119.gitfa8646dae-dmo3~bpo8+2 installed, which depended on libgnutls-deb0-28. That particular version of librtmp1 was left over from deb-multimedia (http://www.deb-multimedia.org/dists/oldstable-backports/main/binary-mips/package/librtmp1.php) which I had used while still on jessie. Because that version of librtmp1 was newer than the one in the official Debian repos for stretch, (version 2.4+20151223.gitfa8646d.1-1 according to https://packages.debian.org/stretch/librtmp1), it wasn't upgraded with apt-get upgrade or apt-get dist-upgrade.

So the solution was to downgrade librtmp1 to the version number from the official Debian repos:

apt-get install librtmp1=2.4+20151223.gitfa8646d.1-1+b1

After that I could remove libgnutls-deb0-28 without too many things removed together with it, like this:

apt-get remove libgnutls-deb0-28

With libgnutls-deb0-28 gone, the installation instructions for signal-desktop went through without problems.

@alex0005

This comment has been minimized.

Copy link

commented Mar 15, 2019

what the hell... thanks a lot for your solution, got the same problem

@golightlyb

This comment has been minimized.

Copy link

commented Sep 13, 2019

I had to use a different version number. To anyone else with the same problem, pick your distro codename on this page then a version number:

https://packages.debian.org/buster/librtmp1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
4 participants
You can’t perform that action at this time.