[MDEV-20221] Key / signing errors on Debian and Ubuntu repositories Created: 2019-07-30  Updated: 2019-08-01  Resolved: 2019-08-01

Status: Closed
Project: MariaDB Server
Component/s: Packaging
Affects Version/s: 10.3.16, 10.4.6
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Hartmut Holzgraefe Assignee: Daniel Bartholomew
Resolution: Fixed Votes: 0
Labels: download
Environment:

Debian Stretch, Ubuntu Trusty, Ubuntu Bionic

Issue Links:
Relates

 Description   

Since some time yesterday (July 31st, 2019) evening, setting up MariaDB apt repositories fails with key / signing related errors. The problem occurs on Debian Stretch, Ubuntu Trusty, Ubuntu Bionic, so probably all apt repositories. On CentOS yum doesn't seem to have the same problem.

The problem occurs with the mariadb.org download sites repository instructions, and also when using the mariadb.com repository setup script.

$ curl -sS https://downloads.mariadb.com/MariaDB/mariadb_repo_setup | sudo bash -s -- --mariadb-server-version=10.4
 
 
 
[warning] Adjusting given --mariadb-server-version ('10.4') to have the correct prefix ('mariadb-10.4')
 
[info] Repository file successfully written to /etc/apt/sources.list.d/mariadb.list
 
[info] Adding trusted package signing keys...
 
Executing: /tmp/apt-key-gpghome.ufa8XajvG2/gpg.1.sh --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 0x8167EE24 0xE3C94F49 0xcbcb082a1bb943db 0xF1656F24C74CD1D8 0x135659e928c12247
 
gpg: key 135659E928C12247: public key "MariaDB Maxscale <maxscale@googlegroups.com>" imported
 
gpg: Total number processed: 1
 
gpg:               imported: 1
 
Hit:1 http://archive.canonical.com/ubuntu bionic InRelease
 
Get:2 http://downloads.mariadb.com/Tools/ubuntu bionic InRelease [1.437 B]                                                                                                      
Get:3 http://security.ubuntu.com/ubuntu bionic-security InRelease [88,7 kB]                                                                                                     
Hit:4 http://de.archive.ubuntu.com/ubuntu bionic InRelease                                                                                                                      
Get:5 http://downloads.mariadb.com/MariaDB/mariadb-10.4/repo/ubuntu bionic InRelease [3.901 B]                                                                                  
Hit:6 http://download.virtualbox.org/virtualbox/debian bionic InRelease                                                                                                         
Ign:7 http://downloads.mariadb.com/MaxScale/2.3/ubuntu bionic InRelease                                                                                                         
Get:8 http://de.archive.ubuntu.com/ubuntu bionic-updates InRelease [88,7 kB]                                                                                                    
Hit:9 https://repo.skype.com/deb stable InRelease                                                                                                                               
Err:2 http://downloads.mariadb.com/Tools/ubuntu bionic InRelease                                                                                                                
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY CE1A3DD5E3C94F49
 
Get:10 http://downloads.mariadb.com/MaxScale/2.3/ubuntu bionic Release [2.835 B]                                                                                                
Hit:11 https://josm.openstreetmap.de/apt cosmic InRelease                                                                                                                       
Get:12 http://downloads.mariadb.com/MaxScale/2.3/ubuntu bionic Release.gpg [833 B]                                                                                             
Get:13 http://de.archive.ubuntu.com/ubuntu bionic-backports InRelease [74,6 kB]                                                                          
Err:5 http://downloads.mariadb.com/MariaDB/mariadb-10.4/repo/ubuntu bionic InRelease                                                           
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F1656F24C74CD1D8
 
Get:14 http://de.archive.ubuntu.com/ubuntu bionic-updates/universe Sources [253 kB]
 
Get:16 http://de.archive.ubuntu.com/ubuntu bionic-updates/multiverse Sources [4.612 B]
 
Get:17 http://de.archive.ubuntu.com/ubuntu bionic-updates/main Sources [288 kB]         
Get:18 http://de.archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages [694 kB]
 
Get:19 http://downloads.mariadb.com/MaxScale/2.3/ubuntu bionic/main amd64 Packages [879 B]                 
Get:20 http://de.archive.ubuntu.com/ubuntu bionic-updates/main i386 Packages [564 kB]                                                      
Get:21 http://de.archive.ubuntu.com/ubuntu bionic-updates/main amd64 DEP-11 Metadata [282 kB]                                       
Get:22 http://de.archive.ubuntu.com/ubuntu bionic-updates/main DEP-11 48x48 Icons [66,7 kB]                                                               
Get:23 http://de.archive.ubuntu.com/ubuntu bionic-updates/main DEP-11 64x64 Icons [134 kB]                                                                
Get:24 http://de.archive.ubuntu.com/ubuntu bionic-updates/universe i386 Packages [960 kB]                                                             
Get:25 http://de.archive.ubuntu.com/ubuntu bionic-updates/universe amd64 Packages [978 kB]                                                          
Get:26 http://security.ubuntu.com/ubuntu bionic-security/main Sources [117 kB]                                                                      
Get:27 http://de.archive.ubuntu.com/ubuntu bionic-updates/universe Translation-en [296 kB]                                                          
Get:28 http://de.archive.ubuntu.com/ubuntu bionic-updates/universe amd64 DEP-11 Metadata [250 kB]                 
Get:29 http://de.archive.ubuntu.com/ubuntu bionic-updates/universe DEP-11 48x48 Icons [197 kB]                          
Get:30 http://de.archive.ubuntu.com/ubuntu bionic-updates/universe DEP-11 64x64 Icons [435 kB]                      
Get:15 https://packagecloud.io/slacktechnologies/slack/debian jessie InRelease [23,5 kB]                           
Get:31 http://de.archive.ubuntu.com/ubuntu bionic-updates/multiverse amd64 DEP-11 Metadata [2.468 B]                   
Get:32 http://de.archive.ubuntu.com/ubuntu bionic-backports/universe amd64 DEP-11 Metadata [7.712 B]                          
Get:33 http://security.ubuntu.com/ubuntu bionic-security/universe Sources [150 kB]                                           
Get:34 http://security.ubuntu.com/ubuntu bionic-security/main i386 Packages [344 kB]       
Get:35 http://security.ubuntu.com/ubuntu bionic-security/main amd64 Packages [462 kB]                               
Get:36 http://security.ubuntu.com/ubuntu bionic-security/main Translation-en [159 kB]                     
Get:37 http://security.ubuntu.com/ubuntu bionic-security/main amd64 DEP-11 Metadata [22,7 kB]                   
Get:38 http://security.ubuntu.com/ubuntu bionic-security/main DEP-11 48x48 Icons [10,4 kB]                         
Get:39 http://security.ubuntu.com/ubuntu bionic-security/main DEP-11 64x64 Icons [31,7 kB]                      
Get:40 http://security.ubuntu.com/ubuntu bionic-security/universe i386 Packages [566 kB]                  
Get:41 http://security.ubuntu.com/ubuntu bionic-security/universe amd64 Packages [574 kB]                       
Get:42 http://security.ubuntu.com/ubuntu bionic-security/universe Translation-en [188 kB]                         
Get:43 http://security.ubuntu.com/ubuntu bionic-security/universe amd64 DEP-11 Metadata [41,3 kB]                
Get:44 http://security.ubuntu.com/ubuntu bionic-security/universe DEP-11 48x48 Icons [16,4 kB]                      
Get:45 http://security.ubuntu.com/ubuntu bionic-security/universe DEP-11 64x64 Icons [105 kB]                   
Get:46 http://security.ubuntu.com/ubuntu bionic-security/multiverse amd64 DEP-11 Metadata [2.464 B]           
Get:47 https://packagecloud.io/slacktechnologies/slack/debian jessie/main amd64 Packages [10,5 kB]
 
Reading package lists... Done          
W: GPG error: http://downloads.mariadb.com/Tools/ubuntu bionic InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY CE1A3DD5E3C94F49
 
E: The repository 'http://downloads.mariadb.com/Tools/ubuntu bionic InRelease' is not signed.
 
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
 
N: See apt-secure(8) manpage for repository creation and user configuration details.
 
N: Skipping acquire of configured file 'contrib/binary-i386/Packages' as repository 'http://download.virtualbox.org/virtualbox/debian bionic InRelease' doesn't support architecture 'i386'
 
W: GPG error: http://downloads.mariadb.com/MariaDB/mariadb-10.4/repo/ubuntu bionic InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F1656F24C74CD1D8
 
E: The repository 'http://downloads.mariadb.com/MariaDB/mariadb-10.4/repo/ubuntu bionic InRelease' is not signed.
 
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
 
N: See apt-secure(8) manpage for repository creation and user configuration details.
 
W: Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
W: Target Packages (main/binary-i386/Packages) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
W: Target Packages (main/binary-all/Packages) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
W: Target Translations (main/i18n/Translation-en_US) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
W: Target Translations (main/i18n/Translation-en) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
W: Target DEP-11 (main/dep11/Components-amd64.yml) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
W: Target DEP-11 (main/dep11/Components-all.yml) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
W: Target DEP-11-icons-small (main/dep11/icons-48x48.tar) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
W: Target DEP-11-icons (main/dep11/icons-64x64.tar) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
W: Target CNF (main/cnf/Commands-amd64) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
W: Target CNF (main/cnf/Commands-all) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/mariadb.list:11
 
[error] Failed to add trusted package signing keys.



 Comments   
Comment by Hartmut Holzgraefe [ 2019-07-31 ]

brute force workaround for now: mark the repositories as trusted in the sources file, e.g.:

    sed -i -e 's/^deb /deb [trusted=yes] /g' /etc/apt/sources.list.d/mariadb.list
 
    apt-get update

Comment by Daniel Bartholomew [ 2019-07-31 ]

From your output it looks like things are failing because the keys were not imported. First, during the import only the MaxScale key is actually imported. Then the 'signatures couldn't be verified because the public key is not available' error.

Maybe there was some sort of update to GPG that changed how it handles importing multiple keys. I'll investigate and see if there's something that needs to be adjusted. Thanks.

Comment by Daniel Bartholomew [ 2019-08-01 ]

I've narrowed the issue down to the `keyserver.ubuntu.com` server. It's only returning 1 key (the last one) instead of all the keys our scripts are requesting. Changing to the keys.gnupg.net keyserver appears to fix the issue.

Comment by Daniel Bartholomew [ 2019-08-01 ]

I've updated the mariadb_repo_setup script and uploaded it to the site. Tests appear to be working now. hholzgra can you confirm?

Comment by Hartmut Holzgraefe [ 2019-08-01 ]

Yes, works fine for me again now

Generated at Thu Feb 08 08:57:47 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.