dl.yarnpkg.com/debianv is missing GPG NO_PUBKEY

[dotnetCarpenter]

Reporting it here since https://github.com/yarnpkg/releases does not have an issue list.

Possible duplicate of #4453 and #6865. But I just got this error, I wouldn't call it fixed.

An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 23E7166788B63E1EFailed to fetch https://dl.yarnpkg.com/debian/dists/stable/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 23E7166788B63E1ESome index files failed to download. They have been ignored, or old ones used instead.

[Daniel15]

You're missing the public key. Run this to get it:

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -

Please let me know if you still encounter issues after doing that.

[dotnetCarpenter]

Following the commands described here: #4453 (comment) Seem to fix the issue.

[dotnetCarpenter]

@Daniel15 does apt not have an auto update GPG key feature? I can't believe I have to fix all expiring keys manually.

[Daniel15]

I don't think there is, unfortunately. 😢

Debian distribute all their keys in a package (https://packages.debian.org/buster/debian-archive-keyring) so whenever they need to roll out a new key (eg. for a new Debian release, or if they rotate them for some other reason), they add it to that package, but keep signing with the old key for a while such that most people will have the new key by the time they switch across.

That's not really doable in our case though, as the problem with having the keys in a package is that the repo that package is in also needs to be signed. In Debian's case they include the package on the installation CD, which bootstraps the initial version. For custom repos, you always need some custom steps to get the signing key.

[dotnetCarpenter]

Wow. I thought at least you had a field in a debian package that could point to a key server to auto update key close to expiring. I guess I see the security flaw in pointing to the Internet for a public key but it would not be much different than apt-key adv --keyserver keys.yarnpkg.com --recv-keys.

Gonna write down your one-liner for next time.
curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -

[Daniel15]

You can also find that command on the installation page (https://yarnpkg.com/en/docs/install#debian-stable) if you ever need it again 😃

[dotnetCarpenter]

You're right but I would probably just copy/paste the 2 lines and get duplicates in my sources.. until I actually read the 2 lines and now can see that it would just overwrite my existing yarn.list. 🤔😕😟

[ohmer1]

You could still distribute your keys with a package. You would still need to install the current key first when adding the repository but the day you decide to change your signing key, everything is handled automatically by the package. Right now, apt complain your repo is not safe because the key changed and need manual (re)configuration.

[r4co0n]

Do the same using only apt-key:

apt-key adv --fetch-keys https://dl.yarnpkg.com/debian/pubkey.gpg

or (currently):

apt-key adv --keyserver keyserver.ubuntu.com --recv 1646B01B86E50310

[x-yuri]

Debian distribute all their keys in a package (https://packages.debian.org/buster/debian-archive-keyring) so whenever they need to roll out a new key (eg. for a new Debian release, or if they rotate them for some other reason), they add it to that package, but keep signing with the old key for a while such that most people will have the new key by the time they switch across.

That's not really doable in our case though, as the problem with having the keys in a package is that the repo that package is in also needs to be signed. In Debian's case they include the package on the installation CD, which bootstraps the initial version. For custom repos, you always need some custom steps to get the signing key.

@Daniel15 I've noticed pgdg-keyring package on one of my servers. And decided to notify you. Just in case they've found a way to work around it.

$ curl -sS http://apt.postgresql.org/pub/repos/apt/dists/jessie-pgdg/main/binary-amd64/Packages.bz2 | bzip2 -d | egrep -A23 '^Package: pgdg-keyring'
    Package: pgdg-keyring
    Version: 2018.2
    Architecture: all
    Maintainer: Debian PostgreSQL Maintainers <pkg-postgresql-public@lists.alioth.debian.org>
    Installed-Size: 22
    Depends: apt
    Homepage: https://apt.postgresql.org/
    Priority: optional
    Section: database
    Filename: pool/main/p/pgdg-keyring/pgdg-keyring_2018.2_all.deb
    Size: 10666
    SHA256: 48c435aeff4a9a9949bcfac639505a5ba050fd1439e2ee5de3af1a942dd97c74
    SHA1: d396ab84600e2c066e648394554a0d44160e4098
    MD5sum: f066cbb798b19550edab9c58c7726bb1
    Description: keyring for apt.postgresql.org
     The PostgreSQL Global Development Group (PGDG) provides an archive of
     PostgreSQL server and extension modules packages for various Debian and Ubuntu
     releases at http://apt.postgresql.org/pub/repos/apt/. It complements the
     packages in those distributions by offering all PostgreSQL server versions
     supported by the PGDG compiled for all releases, as well as server extension
     modules for a broad range of server version/distribution combinations.
     .
     This package contains the public key used for signing the repository. It
     should be installed on all hosts using the repository.

Now that I think about it, you've still got to install their key manually the first time. But then it gets updated automatically. Or so I think.

[r4co0n]

@x-yuri, that is the way to go if you want to automatically keep your repository keys updated. Having such a package for this repo, dl.yarnpkg.com/debian, would be really good. Here's some more info on the architecture and Debian's own implementation.

[x-yuri]

@r4co0n Could you file an issue? You seem to better understand how it works, and what exact benefits it would bring.

[r4co0n]

@x-yuri: I have filed an issue. Please check it and see if you have anything to add. G'day

[neelesh198787]

You're missing the public key. Run this to get it:

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -

Please let me know if you still encounter issues after doing that.

It resolved the issue for me. Many thanks.

[ahmed-alamer]

I am unable to fix this following the suggestions here on Ubuntu 20.04

[sarahkha90]

I am unable to fix this following the suggestions here on Ubuntu 20.04

Same here