1

I made own repository, signed by my gpg key. I have at home 3 pc; the new Debian 9, and 2 upgraded Debians from 8 to 9. On my one computer (8->9) - I don't know why (the other 2 installs correct my packet) I got this error (see below). My question is: how to clean apt cache - but not .deb files, only list which I get after calling # apt-get update?

my errors:

at first: a lot of lines (not shown on my other computers)

> ...
> Ign:24 https://aaa.com/debian stretch/non-free all DEP-11 Metadata
> Ign:25 https://aaa.com/debian stretch/non-free DEP-11 64x64 Icons
> Ign:13 https://aaa.com/debian stretch/non-free all Packages Błąd:17
> https://aaa.com/debian stretch/non-free amd64 Packages  
> gnutls_handshake() failed: Public key signature verification has
> failed. Ign:18 https://aaa.com/debian stretch/non-free Translation-pl
> Ign:20 https://aaa.com/debian stretch/non-free Translation-en Ign:22
> https://aaa.com/debian stretch/non-free Translation-pl_PL Ign:23
> https://aaa.com/debian stretch/non-free amd64 DEP-11 Metadata Ign:24
> https://aaa.com/debian stretch/non-free all DEP-11 Metadata Ign:25
> https://aaa.com/debian stretch/non-free DEP-11 64x64 Icons ...

and then at the end:

W: The repository 'https://aaa.com/debian stretch Release' does not have a Release file.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Nie udało się pobrać https://aaa.com/debian/dists/stretch/non-free/binary-amd64/Packages  gnutls_handshake() failed: Public key signature verification has failed.

in my sources.list I have:

deb https://aaa.com/debian stretch non-free

How I do my repo? :

#!/bin/bash

cd repoX
rm -r ./debian
rm -r ./repo/dists
rm -r ./repo/pool
rm -r ./repo/db


mkdir -p debian
debsigs --sign=origin -k XXXXXXXX  ../DebianR/debian.deb
debsigs --sign=maint -k XXXXXXXX  ../DebianR/debian.deb
debsigs --sign=archive -k XXXXXXXX  ../DebianR/debian.deb
mv ../DebianR/debian.deb debian/debian-1.0_amd64.deb
reprepro --confdir ./repo/conf/ includedeb stretch ./debian/debian-1.0_amd64.deb
0

You must import the gpg key of your repository into apt:

gpg --keyserver keyring.debian.org --recv-keys XXXXXXXX
gpg -a --export XXXXXXXX | sudo apt-key add -

the XXXXXXXX should really be your long fingerprint (40 chars, rather than 8), as there are the short (8 char) fingerprints can easily be spoofed. This is not a theoretical problem; there are already fake networks with spoofed short fingerprints, e.g. evil32. If your short fingerprint has been spoofed and you happen to add the short fingerprint to your apt-keys, you are basically allowing somebody else to sign your packages.

Also make sure, that your key has not expired. (i was recently bitten by that myself :-))

|improve this answer|||||
  • thanks, i did IT (for future), but its doesent solve my problem, btw. key is pretty new and expires after 10 years – blackmoon Dec 25 '17 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.