Invalid signature when upgrading on Ubuntu 18.04

PhilD · February 2, 2020, 5:41am

sudo apt update
…
Err:9 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_18.04 InRelease
The following signatures were invalid: EXPKEYSIG 4ABE1AC7557BEFF9 isv:ownCloud OBS Project isv:ownCloud@build.opensuse.org
…
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_18.04 InRelease: The following signatures were invalid: EXPKEYSIG 4ABE1AC7557BEFF9 isv:ownCloud OBS Project isv:ownCloud@build.opensuse.org
W: Failed to fetch http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_18.04/InRelease The following signatures were invalid: EXPKEYSIG 4ABE1AC7557BEFF9 isv:ownCloud OBS Project isv:ownCloud@build.opensuse.org
W: Some index files failed to download. They have been ignored, or old ones used instead.

I tried some “magic fu” from other Google results:
wget -qO - http://download.owncloud.org/download/repositories/stable/Ubuntu_18.04/Release.key | sudo apt-key add -

But that made no difference.

sudo apt-key list
…
pub rsa2048 2016-09-25 [SC] [expired: 2020-01-18]
1B07 204C D71B 690D 409F 57D2 4ABE 1AC7 557B EFF9
uid [ expired] isv:ownCloud OBS Project isv:ownCloud@build.opensuse.org
…

Maybe this expired key is the problem?

What is the correct “magic fu” to fetch a new key from soemwhere?

jnweiger · February 3, 2020, 12:28pm

Yes, your key is expired. The SUSE download page explicitly says you should fetch the key from their place to avoid using old keys. Some platforms do that automatically, but Ubuntu apparently does not(?)

The key you grabbed, seems to be a completely unrelated key. It does not seem to be coming from the openSUSE OBS at all. To me, it looks more like a key for server package signing, rather than desktop client – but also not expired at all.

gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2013-08-26 [SC] [expires: 2023-08-23]
      DDA2C105C4B73A6649AD2BBD47AE7F72479BC94B
uid           ownCloud build service <obsrun@localhost>
sub   rsa2048 2013-08-26 [E] [expires: 2023-08-23]
sub   dsa2048 2013-08-26 [S] [expires: 2023-08-23]
sub   elg2048 2013-08-26 [E] [expired: 2018-08-25]

.

The relevant key, (as advertised in https://software.opensuse.org//download.html?project=isv%3AownCloud%3Adesktop&package=owncloud-client -> Ubuntu)
is this one

curl -sL http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_18.04/Release.key | gpg -
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2016-09-25 [SC] [expires: 2022-04-02]
      1B07204CD71B690D409F57D24ABE1AC7557BEFF9
uid           isv:ownCloud OBS Project <isv:ownCloud@build.opensuse.org>

It looks all right to me…

Hmm. Do we need to push the extended key to some keyservers?

plettich · February 3, 2020, 2:12pm

Hi,
using the Release.key from OBS helps:

curl -sL http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_18.04/Release.key | apt-key add

This fixed it for me.

jnweiger · February 3, 2020, 5:37pm

@plettich Thanks for confirming!
I’ve done some web crawling, and it seems, indeed, the keyservers out there disagree, weather our key exists, is expired, or is valid:

./check_gpg_keyserver.sh 1B07204CD71B690D409F57D24ABE1AC7557BEFF9
##### remote keyservers
hkp://pool.sks-keyservers.net : pub   rsa2048 2016-09-25 [SC] [expires: 2021-04-18]
keys.gnupg.net                : pub   rsa2048 2016-09-25 [SC] [expires: 2021-04-18]
pgp.mit.edu                   : pub   rsa2048 2016-09-25 [SC] [expired: 2019-09-19]
uid           [ expired] isv:ownCloud OBS Project <isv:ownCloud@build.opensuse.org>
hkp://keyserver.ubuntu.com    : pub   rsa2048 2016-09-25 [SC] [expires: 2021-04-18]
hkp://keyring.debian.org      : --
zimmermann.mayfirst.org       : pub   rsa2048 2016-09-25 [SC] [expired: 2019-09-19]
uid           [ expired] isv:ownCloud OBS Project <isv:ownCloud@build.opensuse.org>
pgp.surfnet.nl                : pub   rsa2048 2016-09-25 [SC] [expires: 2021-04-18]
pgp.key-server.io             : pub   rsa2048 2016-09-25 [SC] [expires: 2021-04-18]

PhilD · February 4, 2020, 12:46am

Works, thanks:

wget http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_18.04/Release.key
sudo apt-key add Release.key

Now sudo apt update finds the new ownCloud client 2.6.1

jnweiger · February 4, 2020, 9:48am

I don’t have any information if Ubuntu apt-get would grab keys from the public key servers at all.
(I can see that e.g. Fedora is updating keys frequently.)

In case it does, I’ve pushed the updated key to the list of servers above. They now all report an expiry date of 2022-04-02 – hope that helps in the unattended update case, or somewhere else

TroubledGuy · April 18, 2022, 1:35pm

Hi @ jnweiger and everyone here,

In case it does, I’ve pushed the updated key to the list of servers above. They now all report an expiry date of 2022-04-02 – hope that helps in the unattended update case, or somewhere else

Apparently, it’s expired now.
curl -sL http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_18.04/Release.key | gpg -
gpg: WARNING: no command supplied. Trying to guess what you mean …
pub rsa2048 2016-09-25 [SC] [expired: 2022-04-02]
1B07204CD71B690D409F57D24ABE1AC7557BEFF9

Would you be able to push the updated key to the list of servers above?

Thank you!

4bob · April 18, 2022, 5:49pm

Hi, this repo looks quite old. Check this one, it’s up to date:
https://download.owncloud.com/desktop/ownCloud/stable/latest/linux/download/

curl -L https://download.owncloud.com/desktop/ownCloud/stable/latest/linux/Ubuntu_18.04/Release.key | gpg -
gpg: WARNING: no command supplied. Trying to guess what you mean …
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1412 100 1412 0 0 10537 0 --:–:-- --:–:-- --:–:-- 10537
pub rsa2048 2015-09-28 [SC] [ expired: 2023-04-05]
06D7EADE708A40FA136EB4540700205DFD41A71A
uid devel OBS Project devel@s2.owncloud.com

jnweiger · May 2, 2022, 3:06pm

The repository at Index of /repositories/isv:/ownCloud:/desktop is deprecated.
Please switch over to linux | download.owncloud.com

[ But also there, Ubuntu 18.04 is no longer updated, please also try one of the newer LTS releases 20.04 or 22.04]

And then … this issue has hit us again: As 2022-04-02 has passed, the key expired.

See Expired GPG key on ubuntu 20.04