Forum: >>> Magnum BBS <<<

The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB Debia

From Philipp Klaus Krause@21:1/5 to All on Thu Feb 10 17:10:01 2022

I just downloaded debian-hurd-20210812.img, and started it in kvm.
apt-get update then failed:

oot@debian:/home/demo# apt-get update
Get:1 http://snapshot.debian.org/archive/debian-ports/20210812T100000Z
sid InRelease [55.3 kB]
Get:2 http://snapshot.debian.org/archive/debian-ports/20210812T100000Z unreleased InRelease [56.6 kB]
Get:3 http://snapshot.debian.org/archive/debian/20210812T100000Z sid
InRelease [165 kB]
Err:1 http://snapshot.debian.org/archive/debian-ports/20210812T100000Z
sid InRelease
The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB
Debian Ports Archive Automatic Signing Key (2021) <[email protected]>
Err:2 http://snapshot.debian.org/archive/debian-ports/20210812T100000Z unreleased InRelease
The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB
Debian Ports Archive Automatic Signing Key (2021) <[email protected]>
Get:4 http://snapshot.debian.org/archive/debian/20210812T100000Z
sid/main Sources [9094 kB]
Reading package lists... Done

W: GPG error:
http://snapshot.debian.org/archive/debian-ports/20210812T100000Z sid
InRelease: The following signatures were invalid: EXPKEYSIG
5A88D659DCB811BB Debian Ports Archive Automatic Signing Key (2021) <[email protected]>
E: The repository 'http://snapshot.debian.org/archive/debian-ports/20210812T100000Z sid InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is
therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user
configuration details.
W: GPG error:
http://snapshot.debian.org/archive/debian-ports/20210812T100000Z
unreleased InRelease: The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB Debian Ports Archive Automatic Signing Key (2021) <[email protected]>
E: The repository 'http://snapshot.debian.org/archive/debian-ports/20210812T100000Z
unreleased InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is
therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user
configuration details.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

From Samuel Thibault@21:1/5 to All on Sat Feb 12 18:20:01 2022

Hello,

Philipp Klaus Krause, le jeu. 10 févr. 2022 17:09:26 +0100, a ecrit:

I just downloaded debian-hurd-20210812.img, and started it in kvm. apt-get update then failed:

Yes, the problem is that the debian-ports archive key is updated every
year, and thus its liveness doesn't span the whole timespan of a
release. A way to fix this is to avoid checking the gpg signature, and
rely only on https:

deb [trusted=yes] https://snapshot.debian.org/archive/debian-ports/20210812T100000Z/ sid main
deb [trusted=yes] https://snapshot.debian.org/archive/debian-ports/20210812T100000Z/ unreleased main
deb-src [trusted=yes check-valid-until=no] http://snapshot.debian.org/archive/debian/20210812T100000Z/ sid main

I have now updated the images accordingly.

I don't know a way to tell apt to tell gpg to ignore the expired key
issue.

Samuel

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

From Jeffrey Walton@21:1/5 to [email protected] on Sat Feb 12 21:00:02 2022

On Thu, Feb 10, 2022 at 11:09 AM Philipp Klaus Krause <[email protected]> wrote:

I just downloaded debian-hurd-20210812.img, and started it in kvm.
apt-get update then failed:
...
Get:3 http://snapshot.debian.org/archive/debian/20210812T100000Z sid InRelease [165 kB]
Err:1 http://snapshot.debian.org/archive/debian-ports/20210812T100000Z
sid InRelease
The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB
Debian Ports Archive Automatic Signing Key (2021) <[email protected]>

You might consider filing a bug against Debian or Apt. There's no such
thing as an expired signature.

For those who desire a key to have attributes, either (1) the key was
valid at the time and applied the signature or (2) the key was not
valid.
A valid signature does not transition to invalid after the signature
has been applied.

The only way to invalidate signatures is to revoke the key. There's no
reason to revoke the key here.

This is just more Debian key mismanagement. They have a chronic problem.

Jeff

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Who's Online
Recent Visitors
- Skreek
  Sat Oct 31 01:26:37 2026
  from Leeds, England via Telnet
- Ashenfieldx
  Sat Oct 31 00:53:18 2026
  from Guelph, Ontario via Telnet
- Rixter
  Fri Oct 30 23:01:34 2026
  from Madison, Nc via Telnet
- Brianm
  Fri Oct 30 22:44:03 2026
  from Glasgow via Raw
- Amstrad Ppc
  Fri Oct 30 21:43:10 2026
  from Wiltshire via SSH
- Amstrad Ppc
  Fri Oct 30 19:12:25 2026
  from Wiltshire via SSH
- Amstrad Ppc
  Fri Oct 30 18:31:19 2026
  from Wiltshire via SSH
- Amstrad Ppc
  Fri Oct 30 18:10:34 2026
  from Wiltshire via SSH

System Info

Sysop:	Keyop
Location:	Huddersfield, West Yorkshire, UK
Users:	794
Nodes:	16 (2 / 14)
Uptime:	136:16:20
Calls:	13,179
Calls today:	2
Files:	15,481
Messages:	6,578,970
Posted today:	2

The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB Debia

Who's Online

Recent Visitors

System Info