2

I was playing with my Debian install today and discovered an interesting thing. If I do for e.g.

$ apt-key list
/etc/apt/trusted.gpg
--------------------
pub   rsa4096 2019-04-15 [SC] [expires: 2024-04-13]
      12D4 CD60 0C22 40A9 F4A8  2071 D7B0 B669 41D0 1538
uid           [ unknown] riot.im packages <packages@riot.im>
sub   rsa3072 2019-04-15 [S] [expires: 2021-04-14]

pub   rsa4096 2019-04-15 [SC] [expires: 2024-04-13]
      AAF9 AE84 3A75 84B5 A3E4  CD2B CF45 A512 DE2D A058
uid           [ unknown] matrix.org packages <packages@matrix.org>
sub   rsa3072 2019-04-15 [S] [expires: 2021-04-14]

pub   rsa4096 2017-05-22 [SC] [expires: 2025-05-20]
      E1CF 20DD FFE4 B89E 8026  58F1 E0B1 1894 F66A EC98
uid           [ unknown] Debian Archive Automatic Signing Key (9/stretch) <ftpmaster@debian.org>
sub   rsa4096 2017-05-22 [S] [expires: 2025-05-20]

pub   rsa4096 2014-11-21 [SC] [expires: 2022-11-19]
      D211 6914 1CEC D440 F2EB  8DDA 9D6D 8F6B C857 C906
uid           [ unknown] Debian Security Archive Automatic Signing Key (8/jessie) <ftpmaster@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
----------------------------------------------------------
pub   rsa4096 2019-04-14 [SC] [expires: 2027-04-12]
      80D1 5823 B7FD 1561 F9F7  BCDD DC30 D7C2 3CBB ABEE
uid           [ unknown] Debian Archive Automatic Signing Key (10/buster) <ftpmaster@debian.org>
sub   rsa4096 2019-04-14 [S] [expires: 2027-04-12]

/etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
-------------------------------------------------------------------
pub   rsa4096 2019-04-14 [SC] [expires: 2027-04-12]
      5E61 B217 265D A980 7A23  C5FF 4DFA B270 CAA9 6DFA
uid           [ unknown] Debian Security Archive Automatic Signing Key (10/buster) <ftpmaster@debian.org>
sub   rsa4096 2019-04-14 [S] [expires: 2027-04-12]

/etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
-------------------------------------------------------
pub   rsa4096 2019-02-05 [SC] [expires: 2027-02-03]
      6D33 866E DD8F FA41 C014  3AED DCC9 EFBF 77E1 1517
uid           [ unknown] Debian Stable Release Key (10/buster) <debian-release@lists.debian.org>

I was curious as to why it has jessie and stretch keys when I am using debian-buster. In the above these are the two keys -

pub   rsa4096 2017-05-22 [SC] [expires: 2025-05-20]
      E1CF 20DD FFE4 B89E 8026  58F1 E0B1 1894 F66A EC98
uid           [ unknown] Debian Archive Automatic Signing Key (9/stretch) <ftpmaster@debian.org>
sub   rsa4096 2017-05-22 [S] [expires: 2025-05-20]

pub   rsa4096 2014-11-21 [SC] [expires: 2022-11-19]
      D211 6914 1CEC D440 F2EB  8DDA 9D6D 8F6B C857 C906
uid           [ unknown] Debian Security Archive Automatic Signing Key (8/jessie) <ftpmaster@debian.org>

I removed the keys using -

$ sudo apt-key del E1CF20DDFFE4B89E802658F1E0B11894F66AEC98

as well as -

$ sudo apt-key del D21169141CECD440F2EB8DDA9D6D8F6BC857C906

when both the keys were deleted I got pub keys errors

$ sudo apt update
Hit:1 http://cdn-fastly.deb.debian.org/debian buster InRelease                                               
Err:1 http://cdn-fastly.deb.debian.org/debian buster InRelease                           
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Hit:2 http://cdn-fastly.deb.debian.org/debian-security buster/updates InRelease         
Err:2 http://cdn-fastly.deb.debian.org/debian-security buster/updates InRelease         
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D6D8F6BC857C906 NO_PUBKEY AA8E81B4331F7F50
Hit:3 http://cdn-fastly.deb.debian.org/debian unstable InRelease                         
Err:3 http://cdn-fastly.deb.debian.org/debian unstable InRelease                         
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Hit:4 http://cdn-fastly.deb.debian.org/debian experimental InRelease                     
Err:4 http://cdn-fastly.deb.debian.org/debian experimental InRelease                     
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Hit:5 http://debug.mirrors.debian.org/debian-debug buster-debug InRelease
Err:5 http://debug.mirrors.debian.org/debian-debug buster-debug InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Hit:6 http://debug.mirrors.debian.org/debian-debug unstable-debug InRelease
Hit:7 http://debug.mirrors.debian.org/debian-debug experimental-debug InRelease
Err:6 http://debug.mirrors.debian.org/debian-debug unstable-debug InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Err:7 http://debug.mirrors.debian.org/debian-debug experimental-debug InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Hit:8 https://packages.riot.im/debian buster InRelease
Reading package lists... Done
Building dependency tree       
Reading state information... Done
3 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://cdn-fastly.deb.debian.org/debian buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://cdn-fastly.deb.debian.org/debian-security buster/updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D6D8F6BC857C906 NO_PUBKEY AA8E81B4331F7F50
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://cdn-fastly.deb.debian.org/debian unstable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://cdn-fastly.deb.debian.org/debian experimental InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://debug.mirrors.debian.org/debian-debug buster-debug InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://debug.mirrors.debian.org/debian-debug unstable-debug InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://debug.mirrors.debian.org/debian-debug experimental-debug InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://cdn-fastly.deb.debian.org/debian/dists/buster/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://cdn-fastly.deb.debian.org/debian-security/dists/buster/updates/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D6D8F6BC857C906 NO_PUBKEY AA8E81B4331F7F50
W: Failed to fetch http://cdn-fastly.deb.debian.org/debian/dists/unstable/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://cdn-fastly.deb.debian.org/debian/dists/experimental/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://debug.mirrors.debian.org/debian-debug/dists/buster-debug/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://debug.mirrors.debian.org/debian-debug/dists/unstable-debug/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://debug.mirrors.debian.org/debian-debug/dists/experimental-debug/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453E

My /etc/apt/sources.list is -

$ cat /etc/apt/sources.list

                               #### Debian buster #########
        deb http://cdn-fastly.deb.debian.org/debian/ buster main contrib non-free
    deb-src http://cdn-fastly.deb.debian.org/debian buster main contrib non-free
        deb http://cdn-fastly.deb.debian.org/debian-security buster/updates main
    deb-src http://cdn-fastly.deb.debian.org/debian-security buster/updates main


                              #### Debian unstable #########
        deb http://cdn-fastly.deb.debian.org/debian unstable main contrib non-free
    deb-src http://cdn-fastly.deb.debian.org/debian unstable main contrib non-free


                           #### Debian experimental #########
       deb http://cdn-fastly.deb.debian.org/debian experimental main contrib
   deb-src http://cdn-fastly.deb.debian.org/debian experimental main contrib

                         ##### Debian Debug packages #######
       deb http://debug.mirrors.debian.org/debian-debug/ buster-debug main
       deb http://debug.mirrors.debian.org/debian-debug/ unstable-debug main
       deb http://debug.mirrors.debian.org/debian-debug/ experimental-debug main


                    ######## Third party repos #######
      deb https://riot.im/packages/debian/ buster main

and had to import them using gpg ( I know it's insecure but had to do -)

# gpg --recv-keys AA8E81B4331F7F50
gpg: key EDA0D2388AE22BA9: 11 signatures not checked due to missing keys
gpg: key EDA0D2388AE22BA9: public key "Debian Security Archive Automatic Signing Key (9/stretch) <ftpmaster@debian.org>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1

and then -

# gpg --export AA8E81B4331F7F50 | apt-key add
OK

I am curious to know when did apt start supporting signatures of old releases alongwith the newest keys ? Is it somewhat of a recent phenomena or a really old phenomena ? I mean whether it was done in Etch (4.0) or later ?

Update - It started as an Strech Install i.e 9 and now has buster.

As far as the other question is concerned /etc/apt/trusted.gpg.d/ has -

/etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
----------------------------------------------------------
pub   rsa4096 2019-04-14 [SC] [expires: 2027-04-12]
      80D1 5823 B7FD 1561 F9F7  BCDD DC30 D7C2 3CBB ABEE
uid           [ unknown] Debian Archive Automatic Signing Key (10/buster) <ftpmaster@debian.org>
sub   rsa4096 2019-04-14 [S] [expires: 2027-04-12]

/etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
-------------------------------------------------------------------
pub   rsa4096 2019-04-14 [SC] [expires: 2027-04-12]
      5E61 B217 265D A980 7A23  C5FF 4DFA B270 CAA9 6DFA
uid           [ unknown] Debian Security Archive Automatic Signing Key (10/buster) <ftpmaster@debian.org>
sub   rsa4096 2019-04-14 [S] [expires: 2027-04-12]

/etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
-------------------------------------------------------
pub   rsa4096 2019-02-05 [SC] [expires: 2027-02-03]
      6D33 866E DD8F FA41 C014  3AED DCC9 EFBF 77E1 1517
uid           [ unknown] Debian Stable Release Key (10/buster) <debian-release@lists.debian.org>
  • 2
    " I got pub keys errors" what errors, specifically? What's in your sources.list{,.d}? – muru Apr 28 at 4:00
  • I fixed the errors, I am/was interested to know the history rather than how to fix it. – shirish Apr 28 at 7:12
  • fwiw, apt-list on my Debian 9 (stable) install has keys going back to Debian 7. However they are all from named files in trusted.gpg.d/*, I have no keys in /etc/trusted.gpg. The system was originally installed as Debian 6. etckeeper shows that debian-archive-squeeze-*.gpg were removed, it looks like this happened when I was still running Debian 8 as oldstable but Debian 7 was no longer supported. See also tracker.debian.org/pkg/debian-archive-keyring/news , ver 2017.5~deb8u1. It's possible I also did some manual key cleanup, but I don't remember it specifically. – sourcejedi Apr 28 at 9:46
  • At the same time the squeeze (Debian 6) keys were removed, the stretch (Debian 9) keys were added, even though I was still running Debian 8. So it can go in both directions, although I'm not sure if that was deliberate. I don't have Debian 10 testing keys on my Debian 9 stable install. – sourcejedi Apr 28 at 9:51
  • The way Debian package signing works, I think Debian Testing / Unstable always needs to have the key from the last stable release. Although that doesn't explain why you have it in /etc/trusted.gpg as opposed to trusted.gpg.d/*. Which questions are you specifically interested in? Is it that you have any of the older keys, or that you have the old key from two releases ago, that I suspect you don't really need? Plus, did this system start off as a jessie (Debian 8) or stretch (Debian 9) install, or did you use the installer straight from Debian 10 testing? – sourcejedi Apr 28 at 9:57
1

The signing once per release by ftp-master is described at ftp-master.debian.org:

Which release should be signed with which key?

Stable releases are signed by both the ftp-master automatic archive signing key in use at the time of the release, and a per-release stable key. Release files for other releases (proposed-updates, testing, testing-proposed-updates, unstable and experimental) are signed only by the ftp-master automatic key.

The security archive is signed by the ftp-master key only.

The current procedure is that there is one ftp-master key per release (former procedure introduced a new key once per year).

As far as archive.org can go back (2009), this has been the case, including the etch release:

The current procedure is that there is one ftp-master key per release (former procedure introduced a new key once per year).

Archive Keys

Active Signing Keys

The current (2007/etch) key can be downloaded here

It seems related to the creation of the package debian-archive-keyring for etch, which includes the files you deleted, on which apt depends upon since etch:

apt (0.6.46.2) unstable; urgency=low

* debian/control:
- depend on debian-archive-keyring to offer clean upgrade path
(closes:#386800)
[...]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.