1

On my bionic 'clients' I get:

GPG error: http://repo.localpod/Dml/ldom-debs/ubuntu bionic InRelease: The following signatures were invalid: ADE541A20ACF8997C01BDCF7090678A30132048A

Note that it says "invalid", not missing!

These are my own .deb packages, collected in a repo. ( this works fine for trusty & xenial )

I have signed the repo with something like: ( called via reprepro: conf/distributions )

gpg --batch --yes --keyring $KeyP --secret-keyring $KeyS -a --no-permission-warning   --detach-sign --default-key 'ldom install service' --output $3 $1
$1 = .../Release
$2 = .../InRelease

ok, so i tried:

 wget  http://repo.localpod/Dml/ldom-debs/ubuntu/dists/bionic/InRelease
 and: 
 # gpgv --keyring /etc/apt/trusted.gpg "InRelease"
 gpgv: Signature made Thu 24 May 2018 12:20:29 PM CEST
 gpgv:                using DSA key 090678A30132048A
 gpgv: Good signature from "ldom install service <tbuunix@...dk>"

Is this not, more or less, how apt-get checks signatures? Or is key too old? wrong type ?

full error:

 apt-key list
 pub   rsa2048 2014-06-24 [SC]
      754A 1A7A E731 F165 D5E6  D4BD 0E08 A149 DE57 BFBE
uid           [ unknown] SaltStack Packaging Team <packaging@saltstack.com>
sub   rsa2048 2014-06-24 [E]

pub   dsa1024 2013-06-10 [SCA]
      ADE5 41A2 0ACF 8997 C01B  DCF7 0906 78A3 0132 048A
uid           [ unknown] LDOM install service <tbuunix@....dk>
sub   elg1024 2013-06-10 [E]

root@ubu18:~# apt-get update
 Get:1 http://repo.localpod/Dml/ldom-debs/ubuntu bionic InRelease [1,154 B]
 Err:1 http://repo.localpod/Dml/ldom-debs/ubuntu bionic InRelease
   The following signatures were invalid:  ADE541A20ACF8997C01BDCF7090678A30132048A
 Reading package lists... Done
 W: GPG error: http://repo.localpod/Dml/ldom-debs/ubuntu bionic InRelease: The  following signatures were invalid: ADE541A20ACF8997C01BDCF7090678A30132048A
 E: The repository 'http://repo.localpod/Dml/ldom-debs/ubuntu bionic InRelease'  is not signed.
 N: Updating from such a repository can't be done securely, and is therefore disabled by default.
 N: See apt-secure(8) manpage for repository creation and user configuration details.

Any clue as to that I am missing, would be welcome... Thanks,

/holger

workaround:

I ended up following a guide ( https://www.digitalocean.com/community/tutorials/how-to-use-reprepro-for-a-secure-package-repository-on-ubuntu-14-04 ) ----> more or less. ---> still a bit 'work in progress', but here are some hints:

using a (fresh) docker image:

docker run -it -v /your/packages:/debs ubuntu:18.04
apt update
apt install -y vim inetutils-ping curl wget netcat telnet aptitude man manpages bash-completion rng-tools reprepro iproute2

rebuild your packages:

cd  /debs/src
ls -d */DEBIAN  | xargs -n1 dirname | xargs -n1 dpkg-deb -vD --build

time for key stuff. to use an existing key :

    gpg --import /debs/.../secring.gpg

for a new key:

gpg --full-generate-key
#rsa 4
#bits  4096
#your_key_name
#passphrase

#
gpg --edit-key your_key_name
#addkey
#(4) RSA (sign only)
#4096
#0
#yes
#yes
#save

gpg --list-secret
gpg --list-key


gpg --export .....your..key.....number............... > keyfile
apt-key add keyfile

ok, time for reprepro setup:

mkdir /debs/u18repo
cd /debs/u18repo
cat <<END >conf/options
ask-passphrase
END

cat <<END >conf/distributions
Codename: bionic
Components: main
Architectures: amd64
SignWith: .....your..key.....number...............
END
reprepro -b /debs/u18repo includedeb bionic /debs/src/*.deb

gpg --export .....your..key.....number............... > keyfile

to test:

apt-key add keyfile
echo "deb file:////debs/u18repo/ bionic main" >> "/etc/apt/sources.list"
apt update

now, if you share /debs/u18repo on your clients ( httpd ), and import the key with : apt-key add http:/.../keyfile apt update should work...

  • Did you manage to figure this one out? I'm experiencing the same issue with my private repository in bionic. – Kenny Rasschaert Jun 27 '18 at 8:25
  • 2
    Well yes ( and no ... ) - see my 'update' about workaround. I will keep it open, in hopes, some Ubuntu/Debian packet-super-user, provides an explanation, to my failure. :) – Holger Morgen Jul 12 '18 at 9:44
1

I had the same issue. In InRelease file there is PGP signed message and it should contain:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

That means SHA256 is used for signing. SHA1 is weak algorithm and shouldn't be used. So if SHA1 is there You need to update your gnupg configuration to use sha256

In my case:

echo "personal-digest-preferences SHA256 SHA384 SHA512 SHA224 RIPEMD160" >> ~/.gnupg/gpg.conf

and then resign InRelease file using gpg as usual.

0

I had faced the exact same issue.

Make sure that all the keys you use are in binary format, not in ASCII armored format. If any of the keys are in ASCII armored format, convert them to binary using -

gpg --dearmor

According to this -

...The reason why we avoid ASCII-armored files is that they cannot be used directly by SecureApt..

Also, make sure that you the following lines or something similar in your ~/.gnupg/gpg.conf file -

cert-digest-algo SHA256
digest-algo SHA256

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.