Subject: bug#705: Update failed due to an invalide signature

From: Klaus Ethgen <[email-masked]>
Date: Mon, 5 Sep 2022 08:19:08 +0100

Package: devuan
Severity: critical

Today the update failed with the following error:
   Holen:13 http://deb.devuan.org/merged ceres InRelease [33,9 kB]
   Fehl:13 http://deb.devuan.org/merged ceres InRelease
     Die folgenden Signaturen waren ungültig: EXPKEYSIG BB23C00C61FC752C Devuan Repository (Amprolla3 on Nemesis) <[email-masked]>
   ...
   W: Während der Überprüfung der Signatur trat ein Fehler auf. Das Depot wurde nicht aktualisiert und die vorherigen Indexdateien werden verwendet. GPG-Fehler: http://deb.devuan.org/merged ceres InRelease: Die folgenden Signaturen waren ungültig: EXPKEYSIG BB23C00C61FC752C Devuan Repository (Amprolla3 on Nemesis) <[email-masked]>
   W: Fehlschlag beim Holen von http://deb.devuan.org/merged/dists/ceres/InRelease Die folgenden Signaturen waren ungültig: EXPKEYSIG BB23C00C61FC752C Devuan Repository (Amprolla3 on Nemesis) <[email-masked]>

So, the whole update is broken!

-- System Information:
Distributor ID:	Devuan
Description:	Devuan GNU/Linux 5 (daedalus/ceres)
Release:	5
Codename:	daedalus ceres
Architecture: x86_64

Kernel: Linux 5.16.17 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_FIRMWARE_WORKAROUND, TAINT_OOT_MODULE
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
Gruß
   Klaus
-- 
Klaus Ethgen                                       http://www.ethgen.ch/
pub  4096R/4E20AF1C 2011-05-16            Klaus Ethgen <[email-masked]>
Fingerprint: 85D4 CA42 952C 949B 1753  62B3 79D0 B06F 4E20 AF1C

---

From: Klaus Ethgen <[email-masked]>
Date: Mon, 5 Sep 2022 08:53:37 +0100

Hi,

The reason seems to be that the key is expired.

The mitigation might be difficult. But you might have the way to do so.
Just sign the repository with the key
72E3CB773315DFA2E464743D94532124541922FB instead of
E032601B7CA10BC3EA53FA81BB23C00C61FC752C.

72E3CB773315DFA2E464743D94532124541922FB is in
/etc/apt/trusted.gpg.d/devuan-keyring-2016-archive.gpg and never expire.

After some months, just create a new key which never expire or expire
far in the future and use that for the repository.

Regards
   Klaus

---

From: Daniel Reurich <[email-masked]>
Date: Tue, 6 Sep 2022 09:29:26 +1200

Yes the key expired, and I probably noticed first by virtue of living in 
the future compared to everyone else.

We should be adding a new signing key each release for the next future 
release, and ensuring it will endure for at least 2 future release. 
This should be done immediately following a release.

This should be part of our "New Release - Devuan Devs guide to managing 
the new release process." - if such a document should exist.  (If it 
doesn't maybe we should create it.)

Regards,
	Daniel

On 5/09/22 19:53, Klaus Ethgen wrote:
> _______________________________________________
> devuan-dev internal mailing list
> [email-masked]
> https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/devuan-dev

-- 
Daniel Reurich
Centurion Computer Technology (2005) Ltd.
021 797 722

---

From: Olaf Meeuwissen <[email-masked]>
Date: Tue, 06 Sep 2022 19:02:32 +0900

Hi,

> This should be done immediately following a release.

ACK, but predicting how long it will take for the next two releases to
see the light of day is not exactly easy because Debian/Devuan release
when ready.

How about uploading a new devuan-keyring package to stable-updates and
unstable when the key's validity period has reached roughly 1/3 of its
initial value?  So if you start with a key that's valid for the next 3
years, you would upload that new devuan-keyring package 2 years later.
This is completely independent of the release cycle and should work if
I'm not badly mistaken.

FTR, this idea is shamelessly stolen from the way cert-manager handles
TLS certificates in Kubernetes clusters by default, be it that uses 90
days for the certificate's validity period.

---

From: Daniel Reurich <[email-masked]>
Date: Tue, 6 Sep 2022 22:36:16 +1200

> see the light of day is not exactly easy because Debian/Devuan release

I agree, so we err on the side of caution and plan for atleast 2 release 
cycles that way there should always be a working key in every release, 
but the old key carries through long enough if the release cycle time 
suddenly doubles.
> This is completely independent of the release cycle and should work if

I'd been thinking 5 years expiry so it's not really about prediction at 
all.  I'm more concerned about making it a part of the standard release 
cycle rather then letting it be forgotten about causing this current hiccup.
Daniel Reurich

---

From: Mark Hindley <[email-masked]>
Date: Fri, 9 Sep 2022 18:05:38 +0100

Control: reassign -1 amprolla
Control: merge -1 704

Klaus,

On Mon, Sep 05, 2022 at 08:19:08AM +0100, Klaus Ethgen wrote:
>      Die folgenden Signaturen waren ungültig: EXPKEYSIG BB23C00C61FC752C
>    Devuan Repository (Amprolla3 on Nemesis) <[email-masked]

Thanks. The key used by amprolla has now been changed and upgrades are working
normally again.

Thanks.

Mark

---

From: "Devuan bug Tracking System" <[email-masked]>
Date: Fri, 09 Sep 2022 17:16:03 +0000

This is an automatic notification regarding your bug report
which was filed against the amprolla package:

#705: Update failed due to an invalide signature

It has been closed by Mark Hindley <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Mark Hindley <[email-masked]> by
replying to this email.

-- 
705: https://bugs.devuan.org/cgi/bugreport.cgi?bug=705
Devuan Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#705: Update failed due to an invalide signature
From: Mark Hindley <[email-masked]>
To: Klaus Ethgen <[email-masked]>, [email-masked]
Date: Fri, 9 Sep 2022 18:14:39 +0100

> Thanks. The key used by amprolla has now been changed and upgrades are working

Closing as resolved.

Thanks

Mark

Subject: Update failed due to an invalide signature
From: Klaus Ethgen <[email-masked]>
To: Devuan Bug Tracking System <[email-masked]>
Date: Mon, 5 Sep 2022 08:19:08 +0100

Package: devuan
Severity: critical

-- System Information:
Distributor ID:	Devuan

---

From: "Devuan bug Tracking System" <[email-masked]>
Date: Fri, 09 Sep 2022 17:16:08 +0000

#704: vlc troubles with the gpg signatura

Closing as resolved.

Thanks

Mark

Subject: vlc troubles with the gpg signatura
From: Alter Kim <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Sun, 4 Sep 2022 03:53:41 +0000

Package: VLC
Version: 3.0.17.3

Typing sudo apt-get install vlc
to install the vlc player i get this message:

The following signatures were invalid: EXPKEYSIG BB23C00C61FC752C Devuan Repository (Amprolla3 on Nemesis) <[email-masked]>
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.devuan.org/merged chimaera InRelease: The following signatures were invalid: EXPKEYSIG BB23C00C61FC752C Devuan Repository (Amprolla3 on Nemesis) <[email-masked]>
W: Failed to fetch http://deb.devuan.org/merged/dists/chimaera/InRelease  The following signatures were invalid: EXPKEYSIG BB23C00C61FC752C Devuan Repository (Amprolla3 on Nemesis) <[email-masked]>
W: Some index files failed to download. They have been ignored, or old ones used instead

I suggest to try to update the gpg signature, thanks in advance

Cheers

---

From: Olaf Meeuwissen <[email-masked]>
Date: Sat, 10 Sep 2022 14:30:47 +0900

Hi,

> cycle rather then letting it be forgotten about causing this current hiccup.

Which is why I suggested putting key renewal on a fixed schedule.  With
5 years (60 months), you'd put out a new key 40 months later.  You could
even put it, or at least a reminder to do so, in a cron job ;-)

--
Olaf Meeuwissen