Singapore repo update issue

[ethoms]

Hi MX community. I have a spare laptop running MX Linux to keep an eye on it, being a big KDE user MX is not for me but I find it very interesting and impressive.

So I did an update/upgrade today after my last one was a couple months ago (maybe a bit longer). The update failed due to an MX repo mirror not working well. I tried both the GUI from the green box in system tray and from terminal using 'sudo apt get update/upgrade'. Below is the error message from terminal output. I fixed it by switching from Singapore to Taiwan repo. I'm living in Singapore currently, but if I was a full time MX Linux user, I'd probably use a more well maintained repo at the cost of download speed, since the Taiwan repo had issue a little while back too.

Anyways, just though I'd give the feedback. Keep up the great work!

$ sudo apt update
[sudo] password for euan:
Get:1 https://mirror.0x.sg/mx-workspace/antix/stretch stretch InRelease [27.4 kB]
Hit:2 https://mirror.0x.sg/mx-workspace/mx/repo stretch InRelease
Hit:3 http://security.debian.org stretch/updates InRelease
Get:4 http://ftp.sg.debian.org/debian stretch-updates InRelease [91.0 kB]
Ign:5 http://ftp.sg.debian.org/debian stretch InRelease
Hit:6 http://ftp.sg.debian.org/debian stretch Release
Err:1 https://mirror.0x.sg/mx-workspace/antix/stretch stretch InRelease
The following signatures were invalid: EXPKEYSIG DB36CDF3452F0C20 antiX (antix repo) <antix@daveserver.info>
Fetched 118 kB in 1s (109 kB/s)
Reading package lists... Done
Building dependency tree
Reading state information... Done
200 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://mirror.0x.sg/mx-workspace/antix/stretch stretch InRelease: The following signatures were invalid: EXPKEYSIG DB36CDF3452F0C20 antiX (antix repo) <antix@daveserver.info>
W: Failed to fetch https://mirror.0x.sg/mx-workspace/antix ... /InRelease The following signatures were invalid: EXPKEYSIG DB36CDF3452F0C20 antiX (antix repo) <antix@daveserver.info>
W: Some index files failed to download. They have been ignored, or old ones used instead.

[asqwerth]

For this region, Hong Kong mirrors are good.

HOwever, the gpg key issue will arise whichever mirror you are on, because since the last time you updated, the gpg key expired for that repo. Open Synaptic, reload, search for "keyring". There should be an updatable package. Update just that package, then reload package lists again in Synaptic and do a full upgrade of all updates.

[ethoms]

@asqwerth: Thanks for the info about Hong Kong mirror, I'll try that in future. Whilst I understand what gpg keys are and why they are needed for repos, I don't understand the whole process around their use. I remember in the past, in the early days of repo keyrings, having to add the keys myself for additional repos. Switching to a different mirror was all I had to do to fix it. I just though I'd mention it so that these things can get better in the future. I am a well seasoned linux user, but I don't think we should expect new user and potential converts to experience this or have to go and find this workaround. I've found MX Linux to be one of the nicer distros with a small tightly-knit developer community, hyper focused on a great out-the-box experience. MX Linux is pushing the boat out in the user friendliness frontier. But these kind of upgrade issues are not good for normal users.

[Dennis-TW]

+1 for Hong Kong

I actually live in Taiwan, but although working most of the time, both Taiwanese mirrors tend be quite slow once in a while, so I also switched to Hong Kong.

Concerning gpg key issue ... it's more of a one-time thing due to an expired certificate after MX 18 has already been made public. It is already fixed in the latest snapshot (18.2)

[fehlix]

Whilst I understand what gpg keys are and why they are needed for repos, I don't understand the whole process around their use.

Normaly it should not happend. And we all hope it will be an exception.
To fix it on the command line:
Re-fresh the package list, ignore the errors:

Code: Select all

sudo apt update

Install the updated signature key

Code: Select all

sudo apt install antix-archive-keyring

Re-fresh the package list again, hopefully this time without error:

Code: Select all

sudo apt update