Forum: >>> Magnum BBS <<<

The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB Debia

From Philipp Klaus Krause@21:1/5 to All on Thu Feb 10 17:10:01 2022

I just downloaded debian-hurd-20210812.img, and started it in kvm.
apt-get update then failed:

oot@debian:/home/demo# apt-get update
Get:1 http://snapshot.debian.org/archive/debian-ports/20210812T100000Z
sid InRelease [55.3 kB]
Get:2 http://snapshot.debian.org/archive/debian-ports/20210812T100000Z unreleased InRelease [56.6 kB]
Get:3 http://snapshot.debian.org/archive/debian/20210812T100000Z sid
InRelease [165 kB]
Err:1 http://snapshot.debian.org/archive/debian-ports/20210812T100000Z
sid InRelease
The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB
Debian Ports Archive Automatic Signing Key (2021) <[email protected]>
Err:2 http://snapshot.debian.org/archive/debian-ports/20210812T100000Z unreleased InRelease
The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB
Debian Ports Archive Automatic Signing Key (2021) <[email protected]>
Get:4 http://snapshot.debian.org/archive/debian/20210812T100000Z
sid/main Sources [9094 kB]
Reading package lists... Done

W: GPG error:
http://snapshot.debian.org/archive/debian-ports/20210812T100000Z sid
InRelease: The following signatures were invalid: EXPKEYSIG
5A88D659DCB811BB Debian Ports Archive Automatic Signing Key (2021) <[email protected]>
E: The repository 'http://snapshot.debian.org/archive/debian-ports/20210812T100000Z sid InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is
therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user
configuration details.
W: GPG error:
http://snapshot.debian.org/archive/debian-ports/20210812T100000Z
unreleased InRelease: The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB Debian Ports Archive Automatic Signing Key (2021) <[email protected]>
E: The repository 'http://snapshot.debian.org/archive/debian-ports/20210812T100000Z
unreleased InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is
therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user
configuration details.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

From Samuel Thibault@21:1/5 to All on Sat Feb 12 18:20:01 2022

Hello,

Philipp Klaus Krause, le jeu. 10 févr. 2022 17:09:26 +0100, a ecrit:

I just downloaded debian-hurd-20210812.img, and started it in kvm. apt-get update then failed:

Yes, the problem is that the debian-ports archive key is updated every
year, and thus its liveness doesn't span the whole timespan of a
release. A way to fix this is to avoid checking the gpg signature, and
rely only on https:

deb [trusted=yes] https://snapshot.debian.org/archive/debian-ports/20210812T100000Z/ sid main
deb [trusted=yes] https://snapshot.debian.org/archive/debian-ports/20210812T100000Z/ unreleased main
deb-src [trusted=yes check-valid-until=no] http://snapshot.debian.org/archive/debian/20210812T100000Z/ sid main

I have now updated the images accordingly.

I don't know a way to tell apt to tell gpg to ignore the expired key
issue.

Samuel

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

From Jeffrey Walton@21:1/5 to [email protected] on Sat Feb 12 21:00:02 2022

On Thu, Feb 10, 2022 at 11:09 AM Philipp Klaus Krause <[email protected]> wrote:

I just downloaded debian-hurd-20210812.img, and started it in kvm.
apt-get update then failed:
...
Get:3 http://snapshot.debian.org/archive/debian/20210812T100000Z sid InRelease [165 kB]
Err:1 http://snapshot.debian.org/archive/debian-ports/20210812T100000Z
sid InRelease
The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB
Debian Ports Archive Automatic Signing Key (2021) <[email protected]>

You might consider filing a bug against Debian or Apt. There's no such
thing as an expired signature.

For those who desire a key to have attributes, either (1) the key was
valid at the time and applied the signature or (2) the key was not
valid.
A valid signature does not transition to invalid after the signature
has been applied.

The only way to invalidate signatures is to revoke the key. There's no
reason to revoke the key here.

This is just more Debian key mismanagement. They have a chronic problem.

Jeff

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Who's Online
Recent Visitors
- Rixter
  Fri Jul 31 19:41:16 2026
  from Madison, Nc via Telnet
- Rixter
  Fri Jul 31 19:29:50 2026
  from Madison, Nc via Telnet
- Rixter
  Fri Jul 31 19:18:30 2026
  from Madison, Nc via Telnet
- Bob Worm
  Fri Jul 31 15:23:30 2026
  from Wales, Uk via Telnet
- Rixter
  Fri Jul 31 12:17:09 2026
  from Madison, Nc via Telnet
- Krenn
  Fri Jul 31 10:41:58 2026
  from Sydney, Nsw via Telnet
- Krenn
  Fri Jul 31 10:34:35 2026
  from Sydney, Nsw via Telnet
- Shift
  Fri Jul 31 06:46:34 2026
  from Leeds, England via SSH

System Info

Sysop:	Keyop
Location:	Huddersfield, West Yorkshire, UK
Users:	741
Nodes:	16 (2 / 14)
Uptime:	120:57:13
Calls:	12,468
Calls today:	10
Files:	15,200
Messages:	6,538,307

The following signatures were invalid: EXPKEYSIG 5A88D659DCB811BB Debia

Who's Online

Recent Visitors

System Info