For ages (since woody, IIRC), I have been administering(=install some packages) all my servers with the use of a private Debian repository.

Recently, I switched from jessie to stretch. Ever since then, Release.gpg has not been accepted any more.

Before, the following was working very well: sudo apt-key adv --keyserver keys.gnupg.net--search-keys C9384E910F2B8604

On https://wiki.debian.org/DebianRepository/UseThirdParty I read that this approach MUST NOT be used anymore -- why?

Hence, I tried the approach mentioned there: Types: deb URIs: http://debian.consecom.org/debian64/ Suites: consecom Architectures: i386 amd64 Components: config Signed-By: /etc/consecom/consecom-archive-keyring.gpg

I get then the following error messages: Ign:1 http://debian.consecom.org/debian64 consecom InRelease Get:2 http://debian.consecom.org/debian64 consecom Release [3,365 B] Get:3 http://debian.consecom.org/debian64 consecom Release.gpg [836 B] Get:4 http://security.debian.org stretch/updates InRelease [62.9 kB] Err:3 http://debian.consecom.org/debian64 consecom Release.gpg The following signatures couldn't be verified because the public key is not available: NO_PUBKEY C9384E910F2B8604 ... W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://debian.consecom.org/debian64 consecom Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY C9384E910F2B8604 W: Failed to fetch http://debian.consecom.org/debian64/dists/consecom/Release.gpg The following signatures couldn't be verified because the public key is not available: NO_PUBKEY C9384E910F2B8604 W: Some index files failed to download. They have been ignored, or old ones used instead.

Without success (pleaes note: I do not make use of httpS and I put my settings in /etc/consecom).

Hence my question: What is the easiest way of migrating a private repository from jessie to stretch? Moreover, since the packages do not contain binaries and are debian release independent, I'd need to serve jessie and stretch from one repository.

  • 2
    Could you edit your question to add the exact error message you’re getting? The solution could be as simple as increasing the size of the GPG key you use to sign your repository’s artifacts. – Stephen Kitt Aug 2 '17 at 7:49

Solving the problem turned out to be quite easy:

  • Re-sign the Release file with a digest considered trustworthy by apt-key (e.g. SHA-256)

Identifying the cause of the problem was a pain....


It depends on how you set your mirror up to begin with.

I use debmirror and a shell script to set the variables, etc. and then actually call it. When I wanted to add stretch (as the release candidate days started) I simply added references to stretch to my shell script variables. I've had to import gnupg keys on the mirror server to fix issues with Mint clients (I mirror Mint, Debian and Ubuntu for some lab use, and because I can) but no issues with Debian. Note that you have to manually create (and update when releases change) the symlinks from stable -> stretch etc.

  • Thanks. However, I do not run a mirror. – luke Aug 3 '17 at 8:26
  • @luke not sure what a "private debian repository" could be aside from a mirror. perhaps a partial one (like I run, only 2 archs) but... – ivanivan Aug 3 '17 at 13:28
  • Pardon my impreciseness: by "private debian repository" I refer to a repository of DEB-Packages following the Debian structure and format. This repository contains only about 16 or so DEB-packages which I created myself. – luke Aug 3 '17 at 14:06
  • Ahh... that changes just about everything. – ivanivan Aug 3 '17 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.