1

I have a Sipeed Lichee RV that runs a Debian image, but I cannot install software due to missing key.

I have followed the Package Authentication Instructions but am getting this error:

root@sipeed:/etc/apt# gpg --keyserver hkps://keys.openpgp.org --recv-keys 0xE852514F5DF312F6
gpg: key E852514F5DF312F6: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg:           w/o user IDs: 1

My sources.list file contains:

deb http://ftp.ports.debian.org/debian-ports/ sid main

The apt update command returns

The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E852514F5DF312F6

2 Answers 2

1

If you can't import the gpg key, you can install the debian-ports-archive-keyring manually.

wget http://ftp.us.debian.org/debian/pool/main/d/debian-ports-archive-keyring/debian-ports-archive-keyring_2022.02.15_all.deb
sudo dpkg -i debian-ports-archive-keyring_2022.02.15_all.deb

Or use:

 wget -O - https://www.ports.debian.org/archive_2022.key |sudo  apt-key add -

As montionned in the debian ports webpage.

1
  • 1
    I didn't have wget intsalled on the system, but scp from another host of this deb worked. Thanks.
    – Bram
    May 17, 2022 at 19:19
1

Packages authentication

If you want apt to verify the downloaded packages, you can either install the debian-ports-archive-keyring package or manually import the Debian ports archive key into apt [...]

Rather than trying to see how the GPG key is incorrectly handled and also considering that using apt-key is deprecated and might disappear soon, an alternate method requiring also a separate running Debian system (of any architecture because the package has no architecture, and at least of stable release) can be used. I'd rather install the package providing the authentication method for the repository: debian-ports-archive-keyring without having to know how it's exactly implemented or could change in the future.

To bootstrap the source of trust and avoid a chicken-and-egg trust problem, one can ask an other Debian system to give information for the valid package. So, the command below should be run on an other Debian system that is correctly validating its repository sources (no need to be root, but root should have performed apt update recently):

$ apt-get --print-uris --reinstall install debian-ports-archive-keyring
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  debian-ports-archive-keyring
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 29.7 kB of archives.
After this operation, 52.2 kB of additional disk space will be used.
'http://deb.debian.org/debian/pool/main/d/debian-ports-archive-keyring/debian-ports-archive-keyring_2022.02.15%7edeb11u1_all.deb' debian-ports-archive-keyring_2022.02.15~deb11u1_all.deb 29692 MD5Sum:698ade2c82f6319d63a491231c4f0417

This provides the location where to retrieve the package rather than attempt to download and install it, and along this a size and checksum validating this is the correct package. It will have itself validated this information by verifying the GPG signature of the ..._bullseye_InRelease (or an other release rather than bullseye) file which covers the validity of the ..._main_binary-XXX_Packages file (with XXX the architecture of the other Debian system and which doesn't matter for a package without architecture) providing the information on the target package. Both files are present in /var/lib/apt/lists/.

This allows to download by any mean and in any place (by altering slightly the URL) the package debian-ports-archive-keyring_2022.02.15~deb11u1_all.deb and then verify its size and checksum using for this case md5sum.

Once downloaded and verified , this package can be installed on the target system using dpkg -i ... (it depends on nothing which conveniently avoids having to recursively do this method for every dependency which would be more difficult if there were packages having an architecture), and then the system upgraded as usual. debian-ports-archive-keyring will likely be upgraded in the process.

7
  • Thank you. When you say "any debian system" would it be possible to do this from an Ubuntu host?
    – Bram
    May 17, 2022 at 18:31
  • @Bram Luckily, the answer is... yes, but it shouldn't be taken for granted: packages.ubuntu.com/jammy/debian-ports-archive-keyring . There's also packages.ubuntu.com/focal/debian-ports-archive-keyring
    – A.B
    May 17, 2022 at 18:33
  • Likewise, Debian provides ubuntu-archive-keyring to add Ubuntu repositories (which is usually a bad idea: wiki.debian.org/DontBreakDebian#Don.27t_make_a_FrankenDebian . I guess it's acceptable for downloading sources and rebuilding when not for this specific case)
    – A.B
    May 17, 2022 at 18:39
  • When installing: dpkg-deb: error: archive 'debian-ports-archive-keyring_2022.02.15_all.deb' uses unknown compression for member 'control.tar.zst', giving up
    – Bram
    May 17, 2022 at 18:49
  • You got an incompatibility between Ubuntu and Debian here: the compression implemented in the package. You could decompress (using ar x, zstd -d and tar -xf) and "force install" it by hand but this becomes increasingly difficult. So it appears this is limited to Debian until Debian uses zstd compression too.
    – A.B
    May 17, 2022 at 18:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .