22

I've got the problem, that the "apt-get update" produced a KEYEXPIRED 1587841717 error:

# apt-get update
...
W: GPG error: http://archive.debian.org jessie Release: The following signatures were invalid: KEYEXPIRED 1587841717

Here my sources.list:

# cat /etc/apt/sources.list.d/sources.list
deb http://http.debian.net/debian jessie main
deb http://http.debian.net/debian jessie contrib
deb http://archive.debian.org/debian jessie main
deb http://archive.debian.org/debian jessie contrib

Here the expired keys found by apt-key (it seems that the key 46925553 expired on 2020-04-25):

apt-key list | grep expired -A1
pub   4096R/46925553 2012-04-27 [expired: 2020-04-25]
uid                  Debian Archive Automatic Signing Key (7.0/wheezy) <[email protected]>
--
pub   4096R/65FFB764 2012-05-08 [expired: 2019-05-07]
uid                  Wheezy Stable Release Key <[email protected]>
--
pub   4096R/B98321F9 2010-08-07 [expired: 2017-08-05]
uid                  Squeeze Stable Release Key <[email protected]>
--
pub   4096R/473041FA 2010-08-27 [expired: 2018-03-05]
uid                  Debian Archive Automatic Signing Key (6.0/squeeze) <[email protected]>
--
pub   4096R/65FFB764 2012-05-08 [expired: 2019-05-07]
uid                  Wheezy Stable Release Key <[email protected]>
--
pub   4096R/46925553 2012-04-27 [expired: 2020-04-25]
uid                  Debian Archive Automatic Signing Key (7.0/wheezy) <[email protected]>

Now i tried to renew the keys:

apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 46925553
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 65FFB764
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys B98321F9
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 473041FA

But the keys are not changed:

# apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 46925553
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/tmp.Ue8AFETZOi --no-auto-check-trustdb --trust-model always --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-wheezy-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-wheezy-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian.gpg --keyring /etc/apt/trusted.gpg.d/php.gpg --keyring /etc/apt/trusted.gpg.d/turnkey.gpg --keyring /etc/apt/trusted.gpg.d/ubuntuzilla.firefox.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 46925553
gpg: requesting key 46925553 from hkp server keyserver.ubuntu.com
gpg: key 46925553: "Debian Archive Automatic Signing Key (7.0/wheezy) <[email protected]>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

A new "apt-get update" get the same error like above.

Can anybody help to solve the problem?

7 Answers 7

Reset to default
17

At the time of this writing (August 2023), there are (at least!) two things worth noting about this question:

  1. Jessie is only available on the Debian Archive site archive.debian.org.

  2. The signing keys for Jessie have both expired and have not been replaced. As such, the (currently) highest-ranked answer of downloading 'debian-archive-keyring' will not help. These expired keys are what is causeing the KEYEXPIRED 1587841717 error listed in the OP's question.

While the safest answer is certainly to upgrade to something supported in the current decade, you probably found this question because you are using hardware that has not been supported past Jessie (looking at you ReadyNAS).

In the situation where you cannot upgrade the distro, the next safest solution I can see is to set the specific entries in sources.list to be trusted by adding [trusted=yes] after the archive type (i.e. deb). So your sources.list file may look something like this:

# Keys Expired But I ~~Want~~ Need To Hold On To The Past
deb [trusted=yes] http://archive.debian.org/debian jessie main
deb [trusted=yes] http://archive.debian.org/debian-security jessie/updates main

apt-get will still throw the warning about the expired signing key, but it will no longer error from it.

If you've come this far, you know that running such equipment outside of the Smithsonian is a terrible idea, and that you are just asking to be compromised. But here we are.

2
  • The problem with this approach is, that the keys are no more checked at all. As the download is http, it is extremely easy to alter the download on the fly and put a trojan (horse) into the .deb. So you are better advised to download archive.debian.org to a local repo on a trusted machine, verify it (I have not the slightest idea how!) and then use that.
    – Tino
    Commented Aug 31, 2023 at 12:47
  • @Tino technically you can use https but it I am not sure whether trusted=yes also disable SSL certificate checks.
    – grin
    Commented Nov 6, 2023 at 10:30
8

You'll need to download the latest debian-archive-keyring package for Debian jessie by hand and install it using dpkg -i. You can find a link to it on packages.debian.org. You could also use the stretch package.

Note that jessie has reached end of life and is not being security supported further. Because unpatched systems are easy to compromise and compromised systems are often used to attack other systems, you should consider upgrading promptly to a supported version so as not to be a hazard to the Internet.

1
  • 1
    Hi, thanks for your help, but it dont work. I installed the package dpkg -i debian-archive-keyring_2017.5~deb8u1_all.deb but the same error occur. W: GPG error: http://archive.debian.org jessie Release: The following signatures were invalid: KEYEXPIRED 1587841717. Yes, you are right! I should upgrade to a newer version, but why expired the keyring in april of 2020 when the version reached end of live in june of 2020?
    – Gunnar Gläser
    Commented Jul 14, 2020 at 9:47
6

It looks like Debian Jessie has a new key now. I was able to import it with:

sudo apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com 7638D0442B90D010
1
  • I know this is old, but in 4/2024 this didn't work for me. ``` W: GPG error: archive.debian.org jessie-backports InRelease: The following signatures were invalid: KEYEXPIRED 1587841717 KEYEXPIRED 1668891673 W: GPG error: archive.debian.org jessie Release: The following signatures were invalid: KEYEXPIRED 1587841717 ```
    – Marc Pope
    Commented Apr 24 at 0:10
6

Debian ELTS (Extended Long Time Support) releases from freexian helped me, it gives support for jessie until 2025.

From https://www.freexian.com/lts/extended/docs/how-to-use-extended-lts/ :

manually install the freexian-archive-keyring package with

wget https://deb.freexian.com/extended-lts/pool/main/f/freexian-archive-keyring/freexian-archive-keyring_2022.06.08_all.deb && sudo dpkg -i freexian-archive-keyring_2022.06.08_all.deb

If you want all packages from Debian 8
Here’s what you should put in /etc/apt/sources.list.d/extended-lts.list:

deb http://deb.freexian.com/extended-lts jessie main contrib non-free
2
  • Lovely! this is so much more helpful!
    – Florian Heigl
    Commented Jul 25, 2023 at 5:57
  • 1
    not for powerpc
    – tinyfiledialogs
    Commented Sep 16, 2023 at 18:24
3

The following worked for me (upgrading an old system to Debian 8 on its way to Debian 9):

sed -i 's;http://archive.debian.org/debian;http://deb.debian.org/debian;' /etc/apt/sources.list
apt update
3
  • 3
    This won't work for an already unsupported architecture such as powerpc.
    – Low power
    Commented Jun 25, 2021 at 5:05
  • 1
    doesn't work. get command not found for apt, have to use apt-get, and get 404s when doing update.
    – Zayne S Halsall
    Commented Apr 2, 2022 at 15:48
  • Worked for me. Thanks!
    – ᴍᴇʜᴏᴠ
    Commented Sep 29, 2022 at 18:36
1

A possible solution that worked for me is this:

wget http://http.us.debian.org/debian/pool/main/d/debian-archive-keyring/debian-archive-keyring_2023.4_all.deb

sudo dpkg -i debian-archive-keyring_2023.4_all.deb

sudo apt-get update
sudo apt-get upgrade -y
1

I found @cjlittle's answer useful, but I wanted to see if it would be possible to go further and avoid using [trusted=yes], specifically, to verify packages using the expired keys.

apt-get uses gpgv for verification. One can override the exact program name by putting Dir::Bin::gpg "/usr/bin/gpgv-wrapper"; (yes, the name of the setting is a bit unfortunate) into, e.g., /etc/apt/apt/conf.d/50gpgv.

gpgv prints signing key status into a file descriptor specified using the --status-fd option. apt makes use of it as can be seen here and here. Its value is hardcoded to always be 3.

In gpgv's output, among other things, it looks for [GNUPG:] GOODSIG and [GNUPG:] KEYEXPIRED. So we can put the following code into /usr/bin/gpgv-wrapper:

#!/bin/sh
workdir=$(mktemp -d)
trap 'rm -r "$workdir"' EXIT
gpgv "$@" 3>"$workdir/status"
result=$?
sed -e 's/KEYEXPIRED/GOODSIG/g' <"$workdir/status" >&3
exit $result

This will hide the fact that keys have expired, sidestepping the problem.

Warning: strictly speaking, this is insecure, since keys expire for a reason: they could have been compromised in the meantime. However, I still find it a bit better than turning off the signature verification altogether.

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .