Debian 9, APT, and “GPG error: … InRelease: The following signatures were invalid:”

aptdebianrepository

I publish a Debian repository. It was signed with a 4096-bit GPG key, and has been merrily in use from Debian 7 and Debian 8 systems for some time. Recently, one of my users reported that Debian 9 was having problems with it. Specifically, apt-get update was yielding:

Reading package lists... Done
   W: GPG error: http://Debian-repository.JdeBP.info. stable InRelease: The following signatures were invalid: A71733F3CEBD655CB25A0DDCE1E3A497555CE68F
   W: The repository 'http://Debian-repository.JdeBP.info. stable InRelease' is not signed.

Note that unlike the people at "Repo APT secure – apt-get update GPG signature were invalid" and "Frustrated with aptly and GPG signing" I am not using aptly. So clearly I am not suffering from an aptly bug of any kind. (-:

So what is the problem?

Best Answer

The cause of the problem is that with no update to the Debian wiki or other similar doco, and pretty much only a couple of largely Ubuntu-related announcements on a non-Debian personal WWW site, support for keys that state a preference for SHA-1 encryption has been turned off in APT as of Debian 9. (Specifically, it was turned off in APT version 1.4~beta1, and Debian 9 has version 1.4.7.)

So a repository publisher needs to do two things:

Adjust the personal-digest-preferences and personal-cipher-preferences in $HOME/.gnupg/gpg.conf to eliminate SHA-1 from one's GPG preferences. This prevents the problem coming back with new keys.
Adjust the preferences that are contained in the current repository signing key to eliminate SHA-1 from there too. For that one needs to:
- Run
```
gpg --edit-key "${key_fingerprint}"
```
  substituting the appropriate key fingerprint, then edit the key preferences with the pref and setpref commands, then save the key to the keyring.
- Export the public key of the updated key from the keyring to a file.
- Re-sign the repository with the modified signing key.
- Publish the updated signing key's public key file.

Note that it is not necessary to generate a new signing key, and that the updated key with SHA-1 removed will continue to interoperate with the older Debian 8 APT.

cd /var/lib/apt/lists/partial/
sudo mv us.archive.ubuntu.com_ubuntu_dists_precise_main_i18n_Index main_COPY
sudo mv us.archive.ubuntu.com_ubuntu_dists_precise_multiverse_i18n_Index multi_COPY
sudo mv us.archive.ubuntu.com_ubuntu_dists_precise_restricted_i18n_Index res_COPY
sudo mv us.archive.ubuntu.com_ubuntu_dists_precise_universe_i18n_Index uni_COPY

Update the signature:

gpg --keyserver keyserver.ubuntu.com --recv 40976EAF437D05B5

Rebuild the software cache:

cd /var/lib/apt
sudo mv lists lists.old
sudo mkdir -p lists/partial
sudo apt-get update

It is probably possible to skip the first step by simply moving the lists, but I figured it best to describe the entire process I used to remove the errors.

Debian Linux – Fix `apt update` Failed Issues

First of all, despite the last line start with E: (which indicates an error), apt didn't fail entirely; it's downloaded most of the updated package lists, it only skipped those for Opera and the Google Talk plugin. So apt upgrade should still offer to upgrade all the other packages.

The warnings give you some indication of what went wrong:

W: gpgv:/var/lib/apt/lists/dl.google.com_linux_talkplugin_deb_dists_stable_Release.gpg: The repository is insufficiently signed by key 4CCA1EAF950CEE4AB83976DCA040830F7FAC5991 (weak digest)
W: gpgv:/var/lib/apt/lists/deb.opera.com_opera_dists_stable_InRelease: The repository is insufficiently signed by key 419D0ACF314E8E993F7F92E563F7D4AFF6D61D45 (weak digest)
W: Failed to fetch http://dl.google.com/linux/talkplugin/deb/dists/stable/Release  No Hash entry in Release file /var/lib/apt/lists/dl.google.com_linux_talkplugin_deb_dists_stable_Release, which is considered strong enough for security purposes

The first two mean that the repository descriptors were signed with an old digest algorithm, which apt now complains about. The third is caused by apt's recent switch to SHA-256 or SHA-512 hashes only; the Talk plugin repository only provides MD5 and SHA-1 hashes, which are now ignored by apt.

To fix this, you can either remove the repositories for the time being, or wait for Opera and Google to fix them...

Debian 9, APT, and “GPG error: … InRelease: The following signatures were invalid:”

Best Answer

Further reading

Related Question

Best Answer

Further reading

Related Solutions

Ubuntu – Failing on apt-get update: The following signatures were invalid

Debian Linux – Fix `apt update` Failed Issues

Related Question