I've inadvertently stepped into "update hell".
I updated a number of dependencies trying to install the Gerbera media server. In the process several existing services stopped running, including mariadb.
Then, when I tried to update/upgrade my mariadb install I hit the following error on the UKFast mirror I had been using:
apt-get update ... Err:4 http://mirrors.ukfast.co.uk/sites/mariadb/repo/10.3/debian jessie InRelease The following signatures were invalid: 199369E5404BD5FC7D2FE43BCBCB082A1BB943DB Reading package lists... Done
now, i've tried several recipes for updating GPG keys, including installing the debian-archive-keyring package. I also switched to a different mirror for mariadb, but still the same error:
GPG error: http://mirrors.coreix.net/mariadb/repo/10.2/debian jessie InRelease: The following signatures were invalid: 199369E5404BD5FC7D2FE43BCBCB082A1BB943DB
Searching the web for clues I'm beginning to think this is actually a problem with the way the mirror has their content signed, per this posting- Debian 9, APT, and "GPG error: ... InRelease: The following signatures were invalid:"
assuming this is the problem (the mirrors using obsolete SHA1 signatures), until the mirrors update their sigs, is there a way for me to persuade apt to process the package?
This seems to have been caused by my choosing an incorrect / unsupported combination of version names.
After trying a lot of combinations, I ended up using the following in /etc/sources.list.d/mariadb.list:
deb [arch=amd64,i386] http://mirrors.coreix.net/mariadb/repo/10.3/debian stretch main deb-src http://mirrors.coreix.net/mariadb/repo/10.3/debian stretch main
Now Stretch isn't my current version (I'm on Buster), but I'm guessing Stretch is the latest release supported by MariaDB.
I'm wondering of the key error was a red herring, but at least it works now, without any further updates to the release keys.
Thanks to those who responded with suggestions.