PGP key mismatch

[ulricvbs]

Attempting to follow the INSTALL.md, however, the signature on the repo does not match the public key retrieved.

[neolynx]

I cannot reproduce this on Debian/buster:

before key is added:

host:~$ sudo apt update
Hit:1 http://molior.info/1.4/buster stable InRelease
Err:1 http://molior.info/1.4/buster stable InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 763F8F0085BF681E
Reading package lists... Done
Building dependency tree       
Reading state information... Done
All packages are up to date.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://molior.info/1.4/buster stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 763F8F0085BF681E
W: Failed to fetch http://molior.info/1.4/buster/dists/stable/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 763F8F0085BF681E
W: Some index files failed to download. They have been ignored, or old ones used instead.

add key:

host:~$ wget -q -O- http://molior.info/archive-keyring.asc | sudo apt-key add -
OK

now it works:

host:~$ sudo apt update
Hit:1 http://molior.info/1.4/buster stable InRelease
Reading package lists... Done
Building dependency tree       
Reading state information... Done
All packages are up to date.

host:~$ apt-cache search molior
molior-client-http - Molior build node client
molior-node-amd64 - molior build node ISO installer for testing
molior-node-amd64-efi - molior build node ISO installer for testing
molior-node-arm64-efi - molior build node ISO installer for testing
molior-os-config - Molior base OS configuration
molior-server - Debian Build System
molior-tools - molior development and deployment tools
molior-tools-doc - molior tools documentation
molior-vbox - molior development virtual machine
molior-web - Molior Web UI

did you pipe the wget into "apt-ket add -" ?

[ulricvbs]

Hi, I utilized signed-by in sources list method to download and reference the key. I'll try this method, but for the most part we moved away from using apt-key since it is being deprecated for security reasons. I didn't realize this is a keyring, so I believe I missed a step to extract the public signing key?

…

On Tue, Jan 18, 2022, 14:47 André Roth ***@***.***> wrote: I cannot reproduce this on Debian/buster: *before key is added:* host:~$ sudo apt update Hit:1 http://molior.info/1.4/buster stable InRelease Err:1 http://molior.info/1.4/buster stable InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 763F8F0085BF681E Reading package lists... Done Building dependency tree Reading state information... Done All packages are up to date. W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://molior.info/1.4/buster stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 763F8F0085BF681E W: Failed to fetch http://molior.info/1.4/buster/dists/stable/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 763F8F0085BF681E W: Some index files failed to download. They have been ignored, or old ones used instead. *add key:* host:~$ wget -q -O- http://molior.info/archive-keyring.asc | sudo apt-key add - OK *now it works:* ` host:~$ sudo apt update Hit:1 http://molior.info/1.4/buster stable InRelease Reading package lists... Done Building dependency tree Reading state information... Done All packages are up to date. host:~$ apt-cache search molior molior-client-http - Molior build node client molior-node-amd64 - molior build node ISO installer for testing molior-node-amd64-efi - molior build node ISO installer for testing molior-node-arm64-efi - molior build node ISO installer for testing molior-os-config - Molior base OS configuration molior-server - Debian Build System molior-tools - molior development and deployment tools molior-tools-doc - molior tools documentation molior-vbox - molior development virtual machine molior-web - Molior Web UI ` did you pipe the wget into "apt-ket add -" ? — Reply to this email directly, view it on GitHub <#33 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AM6ZBGLALTGQOSXQT3R7EBLUWXUZNANCNFSM5GMPF3SA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you authored the thread.Message ID: ***@***.***>