4.1 contrib issues

Debian hits me with this error

Hit:1 Index of /debian bullseye InRelease
Hit:2 https://deb.debian.org/debian-security bullseye-security InRelease
Get:3 Index of /deb/r4.1/vm/ bullseye InRelease [2,150 B]
Err:3 Index of /deb/r4.1/vm/ bullseye InRelease
The following signatures were invalid: EXPKEYSIG A8F7A1DC99F29DAA Qubes OS Contrib Release 4 Signing Key
Hit:4 Index of /r4.1/vm/ bullseye InRelease
Hit:5 Index of /r4.1/vm/ bullseye-testing InRelease
Hit:6 Index of /r4.1/vm/ bullseye-securitytesting InRelease
Reading package lists… Done
W: GPG error: Index of /deb/r4.1/vm/ bullseye InRelease: The following signatures were invalid: EXPKEYSIG A8F7A1DC99F29DAA Qubes OS Contrib Release 4 Signing Key
E: The repository ‘Index of /deb/r4.1/vm/ bullseye InRelease’ is not signed.
N: Updating from such a repository can’t be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

sudo gpg -v /etc/blablablabla … key expired on the 25th of this month

Hi @windwhisperer ,
I don’t see this issue with my host (same context: Qubes-OS-4.1 with Debian-11 templates).

Please provide more information:

  • are you trying to update a TemplateVM, a StandaloneVM (HVM), other?
  • Is it a Debian-11 which comes from a Debian-10 upgrade or a new install (new template)?
  • which CLI command or UI action did you use for this update request?
  • did you add manually some repositories ?

its the default debian 10 template that i updated to debian 11 and i used sudo apt update to get this. i added the contrib repos through the CLI commands that the documentation tells

works fine for debian buster and bullseye repos works fine for fedora34 repos and works fine for dom0 repos
contrib repos work fine in fedora34 and dom0 templates
only thing that isn’t working is the contrib repos for debian , both the buster and bullseye repos say the same thing for the contrib repos… that they’re unsigned
when i check wthe gpg key for them it says the key expired on september 25

and yes im trying to use sudo apt update in the temple vm

2 Likes

How do I correctly update the keys for contrib repo?

I downloaded the new qubesos-contrib-release-4-debian.asc. key, and gpg imported the file to /etc/apt/trusted.gpg.d/qubesos-contrib-release-4.0-debian.gpg. When running sudo apt-get update (even though I know not recommended in Template Debain-11), I get the following error:

W: https://deb.debian.org/debian/dists/bullseye/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/qubesos-contrib-release-4-debian.gpg are ignored as the file has an unsupported filetype.
W: https://deb.debian.org/debian-security/dists/bullseye-security/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/qubesos-contrib-release-4-debian.gpg are ignored as the file has an unsupported filetype.
W: https://deb.qubes-os.org/r4.0/vm/dists/bullseye/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/qubesos-contrib-release-4-debian.gpg are ignored as the file has an unsupported filetype.
W: https://contrib.qubes-os.org/deb/r4.0/vm/dists/bullseye/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/qubesos-contrib-release-4-debian.gpg are ignored as the file has an unsupported filetype.
W: GPG error: Index of /deb/r4.0/vm/ bullseye InRelease: The following signatures were invalid: EXPKEYSIG A8F7A1DC99F29DAA Qubes OS Contrib Release 4 Signing Key
E: The repository ‘Index of /deb/r4.0/vm/ bullseye InRelease’ is not signed

Apologies for being such a noob but Im learning. This is definitely much more challenging than my intro to whatever sophomore math class.

With the bullseye-testing repository enabled in /etc/apt/sources.list.d/qubes-r4.list, you can run sudo apt update; sudo apt install qubes-repo-contrib to install the new key. (Then bullseye-testing can be disabled again.)

I do not have “bullseye-testing” repository by default because I am running Debian-10. Does this mean that either…

a. I am supposed to upgrade to Debian-11 or
b. use the bullseye-testing repository in the buster template?

did you know that Debian 11 (not qubes version) is released