2

I am trying to download an update for a piece of software, and my package manager says that the key is invalid and thus warns me.

W: Failed to fetch https://deb.torproject.org/torproject.org/dists/buster/InRelease The following signatures were invalid: EXPKEYSIG 74A941BA219EC810 deb.torproject.org archive signing key

Then the output after listing the key in GPG.

pub   rsa2048/0xEE8CBC9E886DDD89 2009-09-04 [SC] [expires: 2022-08-05]
      Key fingerprint = A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89
uid                   [ unknown] deb.torproject.org archive signing key
sub   rsa2048/0x74A941BA219EC810 2009-09-04 [S] [expires: 2020-11-23]
      Key fingerprint = 2265 EB4C B2BF 88D9 00AE  8D1B 74A9 41BA 219E C810

As you can see, the subkey has expired recent to writing this post.

I went to the developer's website and the signing key is unchanged. How do I continue the software update without skipping the signing process?

Improve this question

2 Answers 2

Reset to default
5

From 2019.www.torproject.org/docs/debian.html.en, you can run these commands to add the key to the trusted apt keys, I only added sudo:

curl https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -

After that sudo apt-key list (or gpg --list-keys) should list the updated key:

pub   rsa2048 2009-09-04 [SC] [expires: 2024-11-17]
      A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89
uid           [ unknown] deb.torproject.org archive signing key
sub   rsa2048 2009-09-04 [S] [expires: 2022-06-11]

Now you can install the keyring package if you wish to keep the key current:

sudo apt update
sudo apt install deb.torproject.org-keyring

The deb.torproject.org-keyring package contains the current version of the archive signing key (/etc/apt/trusted.gpg.d/deb.torproject.org-keyring.gpg) to validate the authenticity of tor packages.

If you install the package, you'll automatically update the key next time you run sudo apt update; sudo apt upgrade whenever there is an updated version of the key available (assuming the currently installed key is not expired to fetch the package via apt).

Improve this answer
3
  • This sort of worked on a RaspberryPi but I am unsure what it actually does. Maybe somebody can elaborate what key we are importing and why it solves the problem. Also, it would be interesting to know, what org-keyring does or what "keeping the key current" means. Thanks! ("sort of worked" because I got N: Skipping acquire of configured file 'main/binary-armhf/Packages' as repository 'https://deb.torproject.org/torproject.org buster InRelease' doesn't support architecture 'armhf' but I was able to upgrade other packages.)
    – bomben
    Dec 30, 2020 at 8:52
  • 1
    The deb.torproject.org-keyring package contains the current version of the archive signing key (/etc/apt/trusted.gpg.d/deb.torproject.org-keyring.gpg, the key you just manually imported) to validate the authenticity of tor packages. If you install the package, you'll automatically update the key next time you run sudo apt update; sudo apt upgrade whenever there is an updated version of the key available (assuming the currently installed key is not expired to fetch the package via apt).
    – Freddy
    Dec 30, 2020 at 9:45
  • Thanks! I added your comment to the answer.
    – bomben
    Dec 31, 2020 at 15:12
0

For me this worked:

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 74A941BA219EC810
Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.