I publish a Debian repository. It was signed with a 4096-bit GPG key, and has been merrily in use from Debian 7 and Debian 8 systems for some time. Recently, one of my users reported that Debian 9 was having problems with it. Specifically,
apt-get update was yielding:
Reading package lists... Done W: GPG error: http://Debian-repository.JdeBP.info. stable InRelease: The following signatures were invalid: A71733F3CEBD655CB25A0DDCE1E3A497555CE68F W: The repository 'http://Debian-repository.JdeBP.info. stable InRelease' is not signed.
Note that unlike the people at "Repo APT secure - apt-get update GPG signature were invalid" and "Frustrated with aptly and GPG signing" I am not using
aptly. So clearly I am not suffering from an
aptly bug of any kind. (-:
So what is the problem?