This question already has an answer here:
When installing a package using
apt-get install, the package is installed but gives the following warning:
W: GPG error: http://12.345.67.890/repo stretch InRelease: The following signatures were invalid: 789B6B7630E9396A52F4D467B646B1C0B99B99E4 W: The repository 'http://12.345.67.890/repo stretch InRelease' is not signed.
- I am the maintainer of the repository, and don't wish users to need implement workarounds on their side.
- The repository is being hosted on Centos7.
- reprepro.x86_64 4.17.0-3.el7 from epel is being used.
- The receiving machine is a RPi3.
- Both machine's
dateshow identical times.
Steps taken (mostly from SetupWithReprepro )
- I generated GnuPG keys using default values and a passphrase.
- I configured Apache
- I configured reprepro
- The Maintainer in repo/dists/stretch/main/binary-armhf/Packages lists the same name and email as was used with my GPG key.
- In conf/distributions, I've used "SignWith: default" as well as my main public and secondary public key, but no change. Note that the user I've implemented under has only one GPN key.
- I did not use overrides.
- I added packages to the repository
- I exported the public GnuPG key
- I've tested using both the main public and secondary public key, and they produce an identical key.
- I did not attempt to sign the Debian package using dpkg-sig as everything I've read states reprepro will automatically do so.
- I imported the public GnuPg key described by Step 6.
What can I do to prevent this warning? If no single answer, I also have sub-questions:
- Can the issue be related to installing on Centos7?
- Is the package’s changelog file the same as repo/dists/stretch/main/binary-armhf/Packages?
- Does my key somehow have to be sign or hosted by someone else due to web of trust?
- Do I need to also insert my email when exporting the public GnuPg key (i.e. step 6 above)? If so, how?
- How can I manually ensure the key is properly signed on a different machine?
dpkg-sigor equivalent available for Centos7?
dpkg-buildpackagealso need to be used? It isn't referenced by SetupWithReprepro .