[solved] another expired key (not one of ours), dl.google.com - Chrome

[kmathern]

Today there's another expired key warning when updating, not for one of our keys this time, but the key for the Google Chrome repo.

Code: Select all

Reading package lists... Done
W: GPG error: http://dl.google.com stable Release: The following signatures were invalid: KEYEXPIRED 1555048520 KEYEXPIRED 1555048520 KEYEXPIRED 1555048520 KEYEXPIRED 1555048520

Don't really see a fix for it yet, though I did find these askubuntu topics:
https://askubuntu.com/questions/1133273 ... ect=1&lq=1
https://askubuntu.com/questions/1133199 ... 53640db551

[Adrian]

Why is the "Fix GPG keys" script not fixing this? Can we make it work? (Oh google didn't release yet a update key?)

[kmathern]

Why is the "Fix GPG keys" script not fixing this? Can we make it work?

It (checkaptgpg) was created to fix NO_PUBKEY errors, not expired key errors.

[Adrian]

Why is the "Fix GPG keys" script not fixing this? Can we make it work?

It (checkaptgpg) was created to fix NO_PUBKEY errors, not expired key errors.

Can we add this functionality, sounds like a good idea (obviously it would work only once Google release a new key).

[kmathern]

Can we add this functionality, sounds like a good idea (obviously it would work only once Google release a new key).

I could have it check for & remove expired key(s) when checkaptgpg starts up, and then have it can try downloading the now missing key(s). But like you said a fresh updated key needs to be on the keyservers or it just reloads the expired one.

[rokytnji.1]

Made me look. Yep.

Code: Select all

harry@biker:~
$ sudo apt-get update
[sudo] password for harry: 
Get:1 http://ftp.us.debian.org/debian stretch-updates InRelease [91.0 kB]
Get:2 http://security.debian.org stretch/updates InRelease [94.3 kB]                     
Ign:3 http://dl.google.com/linux/chrome/deb stable InRelease                             
Get:4 http://dl.google.com/linux/chrome/deb stable Release [943 B]                       
Hit:5 http://repo.antixlinux.com/stretch stretch InRelease                               
Get:6 http://dl.google.com/linux/chrome/deb stable Release.gpg [819 B]                   
Ign:7 http://ftp.us.debian.org/debian stretch InRelease                                  
Hit:8 http://ftp.us.debian.org/debian stretch Release
Err:6 http://dl.google.com/linux/chrome/deb stable Release.gpg
  The following signatures were invalid: EXPKEYSIG 1397BC53640DB551 Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>
Get:9 http://security.debian.org stretch/updates/main i386 Packages [486 kB]
Get:11 http://security.debian.org stretch/updates/main amd64 Packages [484 kB]
Get:12 http://security.debian.org stretch/updates/main Translation-en [215 kB]
Fetched 1,372 kB in 4s (309 kB/s)                             
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://dl.google.com/linux/chrome/deb stable Release: The following signatures were invalid: EXPKEYSIG 1397BC53640DB551 Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>
W: Failed to fetch http://dl.google.com/linux/chrome/deb/dists/stable/Release.gpg  The following signatures were invalid: EXPKEYSIG 1397BC53640DB551 Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>
W: Some index files failed to download. They have been ignored, or old ones used instead.

[rokytnji.1]

Google is ususally quick on the uptake and fixes these things. I'll just wait.

[dolphin_oracle]

Fix gpg key actually spit out the command to do the update in the text output. Of course we can't help it if Google doesn't have one yet.

[kmathern]

Seems to be fixed now, I don't get the warning anymore when running a `apt-get update'.

I didn't do anything to fix it, the first answer/comment here: https://askubuntu.com/questions/1133273 ... ect=1&lq=1 says Google fixed it on their end.

edit: found this too: https://support.google.com/chrome/threa ... ed-answers

[Stevo]

The Google Earth repo is still throwing the same expired key error for me, though.