[MDEV-11492] Repository configuration tool - debian jessie - wrong GPG key Created: 2016-12-06  Updated: 2016-12-07  Resolved: 2016-12-07

Status: Closed
Project: MariaDB Server
Component/s: Platform Debian
Affects Version/s: 10.1.19
Fix Version/s: 10.1.20

Type: Bug Priority: Major
Reporter: Tadashi Assignee: Daniel Bartholomew
Resolution: Not a Bug Votes: 0
Labels: packaging
Environment:

Debian 8 Jessie


Issue Links:
Blocks
blocks MDEV-10537 repository configuration tool - for u... Closed

 Description   

Bonjour,

Je suis sous Linux Debian 8 Jessie.

J'ai suivi la procédure ci-dessous :
https://mariadb.com/kb/fr/comment-installer-mariadb-par-paquets-deb/

La clé publique 0xcbcb082a1bb943db a été ajouté avec succès et l'empreinte complète est correcte.

apt-key list
/etc/apt/trusted.gpg
--------------------
pub dsa1024 2010-02-02 [SC]
1993 69E5 404B D5FC 7D2F E43B CBCB 082A 1BB9 43DB
uid [ inconnue] MariaDB Package Signing Key <package-signing-key@mariadb.org>
uid [ inconnue] Daniel Bartholomew (Monty Program signing key) <dbart@askmonty.org>
sub elg4096 2010-02-02 [E]

Tout fonctionnait très bien mais depuis quelques jours (2 ou 3 jours) il n'est plus possible de pouvoir mettre à jour les paquets MariaDB 10.1 pour Debian Jessie depuis n'importe quel repository indiqué sur le site de MariaDB.

Le message d'erreur est toujours identique :

apt update
Réception de:5 http://mariadb.biz.net.id//repo/10.1/debian jessie InRelease [2 488 B]
Err:5 http://mariadb.biz.net.id//repo/10.1/debian jessie InRelease
Les signatures suivantes ne sont pas valables : 199369E5404BD5FC7D2FE43BCBCB082A1BB943DB
Lecture des listes de paquets... Fait
W: Erreur de GPG : http://mariadb.biz.net.id//repo/10.1/debian jessie InRelease : Les signatures suivantes ne sont pas valables : 199369E5404BD5FC7D2FE43BCBCB082A1BB943DB
E: The repository 'http://mariadb.biz.net.id//repo/10.1/debian jessie InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

A la vue du message "Les signatures suivantes ne sont pas valables : 199369E5404BD5FC7D2FE43BCBCB082A1BB943DB" je suppose qu'il y a un problème avec la signature des paquets disponible dans les repository et la clé publique de signature.

De plus cela n'est que pour Debian 8 Jessie (Stable).

Car en faisant le même test pour Debian 8 Sid (expérimentale), la clé publique étant différente, nous n'avons pas de soucis à mettre à jour les paquets MariaDB via apt update.

apt-key list
/etc/apt/trusted.gpg
--------------------
pub rsa4096 2016-03-30 [SC]
177F 4010 FE56 CA33 3630 0305 F165 6F24 C74C D1D8
uid [ inconnue] MariaDB Signing Key <signing-key@mariadb.org>
sub rsa4096 2016-03-30 [E]

apt update
Atteint:5 http://mariadb.biz.net.id//repo/10.1/debian sid InRelease
Lecture des listes de paquets... Fait
Construction de l'arbre des dépendances
Lecture des informations d'état... Fait
10 packages can be upgraded. Run 'apt list --upgradable' to see them.

J'ai cherché auparavant sur divers forums Linux et sur Help de MariaDB mais ne voyant rien sur le sujet, j'ouvre ce JIRA en espérant que cela aide d'autres personnes rencontrant le même soucis (J'ai pu reproduire le même problème sur 2 serveurs Debian 8 Jessie).

Cordialement,
Tadashi



 Comments   
Comment by Daniel Bartholomew [ 2016-12-06 ]

I am unable to reproduce this on my end. I tested on a Jessie machine that hadn't been upgraded in a while, and one that had the latest updates installed from the Debian Jessie repositories. In both cases I followed the instructions displayed on https://downloads.mariadb.org/mariadb/repositories/ when selecting {{ Debian > Debian 8 "Jessie" > 10.1 [Stable]}}

If the signing key is not imported then I see the following error:

W: GPG error: http://mariadb.biz.net.id jessie InRelease:
The following signatures couldn't be verified because the 
public key is not available: NO_PUBKEY CBCB082A1BB943DB

But after I run the suggested command to import the key:

sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 0xcbcb082a1bb943db

...then all is well. Apt doesn't complain and I can install MariaDB successfully.

Here is the full output from when I import the key:

buildbot@debian-jessie-amd64:~$ sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 0xcbcb082a1bb943db
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/tmp.7TTP5iQve1 --no-auto-check-trustdb --trust-model always --primary-keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-squeeze-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-squeeze-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-wheezy-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-wheezy-stable.gpg --recv-keys --keyserver keyserver.ubuntu.com 0xcbcb082a1bb943db
gpg: requesting key 1BB943DB from hkp server keyserver.ubuntu.com
gpg: key 1BB943DB: public key "MariaDB Package Signing Key <package-signing-key@mariadb.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
buildbot@debian-jessie-amd64:~$

FYI: If the key is already imported then the output will say "unchanged: 1" instead of "imported: 1".

If the server is not actually running Jessie and is instead running Stretch or Sid, then importing the key we use for our Jessie repositories won't help because the version of APT in Stretch and Sid (apt 1.2.x and above I think) rejects the old key even if it is imported (this is why we have a new key for Sid, Stretch, and Ubuntu Xenial). This error could happen if you are running a version of APT backported (from Sid or Stretch) on Jessie. I don't see a newer version of apt in the jessie-backports repository, but a newer version could have been locally compiled or installed from a different repo.

I tested with APT version 1.0.9.8 and 1.0.9.8.3 on Jessie using two different mirrors (one of which was the biz.net.id mirror listed above). What version of apt are you using?

Comment by Tadashi [ 2016-12-07 ]

Hello,

After your message, i check my log and apt version and i can seen that i have a mistake in my apt source because few preference had upgraded some package with Stretch repository and not Jessie :/

My apt is now in version in 1.4 (amd64).

So, after some change, i use now apt 1.0.9.8 for amd64 compiled on Apr 13 2015 12:50:11.

After new test, it's ok, GPG Key is verified and validated.

apt update is ok and for MariaDB repository is ok too.

The problem was with my version of apt, appologize.

Thanks to your reactivity and reply.

You can close this ticket with "Not a bug" status.

Best regards,
Tadashi

Generated at Thu Feb 08 07:50:22 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.