Pathvector repository invalid

[rapdodge]

Dear Nate,

This day when I'm running apt-get update, it seems that Pathvector repository signature invalid

Hit:1 http://mirrors.linode.com/debian bookworm InRelease
Get:2 http://mirrors.linode.com/debian bookworm-updates InRelease
Get:4 http://mirrors.linode.com/debian bookworm-backports InRelease
Hit:5 https://pkg.labs.nic.cz/bird2 bookworm InRelease
Hit:3 https://packagecloud.io/fdio/release/debian bookworm InRelease
Hit:6 https://repo.pathvector.io/apt stable InRelease
Err:6 https://repo.pathvector.io/apt stable InRelease
  The following signatures were invalid: EXPKEYSIG CF9AAE63E5517864 Pathvector Code Signing Key <info@pathvector.io>
Get:7 http://mirrors.linode.com/debian-security bookworm-security InRelease [48.0 kB]
Fetched 163 kB in 2s (68.6 kB/s)
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://repo.pathvector.io/apt stable InRelease: The following signatures were invalid: EXPKEYSIG CF9AAE63E5517864 Pathvector Code Signing Key <info@pathvector.io>
W: Failed to fetch https://repo.pathvector.io/apt/dists/stable/InRelease  The following signatures were invalid: EXPKEYSIG CF9AAE63E5517864 Pathvector Code Signing Key <info@pathvector.io>
W: Some index files failed to download. They have been ignored, or old ones used instead.

Thank you,

[AVSISP]

Can confirm reproducable:

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://repo.pathvector.io/apt stable InRelease: The following signatures were invalid: EXPKEYSIG CF9AAE63E5517864 Pathvector Code Signing Key <info@pathvector.io>
W: Failed to fetch https://repo.pathvector.io/apt/dists/stable/InRelease  The following signatures were invalid: EXPKEYSIG CF9AAE63E5517864 Pathvector Code Signing Key <info@pathvector.io>
W: Some index files failed to download. They have been ignored, or old ones used instead.

@natesales : this is a live issue - your repo is being signed by a different key now than what is listed on the pathvector.io site for import. Please fix.

[natesales]

Thanks - try refetching the key for 0983AC667B4F0B54F69D1EA7CF9AAE63E5517864 and running apt update again.

[rapdodge]

Thanks - try refetching the key for 0983AC667B4F0B54F69D1EA7CF9AAE63E5517864 and running apt update again.

For now, it's still hasn't updated yet, I will try it again later :)

[rweir]

where did you update they key? it still seems to be the old key on the pathvector.io site, and on the ubuntu keyserver.

[AVSISP]

Thanks - try refetching the key for 0983AC667B4F0B54F69D1EA7CF9AAE63E5517864 and running apt update again.

root@anushka:~# gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0983AC667B4F0B54F69D1EA7CF9AAE63E5517864
gpg: key CF9AAE63E5517864: "Pathvector Code Signing Key <info@pathvector.io>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

The key is the same - issue seems to be EXPIRED KEY not that it's changed. You need to renew or extend the key - or issue a new one and re-sign the repo. Then update it pgp.asc to the new file. Then everyone will have to update to the new one.

[sam13142023]

root@sam1314:~# apt -y update 
Hit:1 http://deb.debian.org/debian bookworm InRelease
Hit:2 http://deb.debian.org/debian-security bookworm-security InRelease
Hit:3 http://deb.debian.org/debian bookworm-updates InRelease
Get:5 https://repo.pathvector.io/apt stable InRelease [3,349 B]                                              
Hit:4 https://packagecloud.io/ookla/speedtest-cli/debian bookworm InRelease
Err:5 https://repo.pathvector.io/apt stable InRelease
  The following signatures were invalid: EXPKEYSIG CF9AAE63E5517864 Pathvector Code Signing Key <info@pathvector.io>
Reading package lists... Done
W: GPG error: https://repo.pathvector.io/apt stable InRelease: The following signatures were invalid: EXPKEYSIG CF9AAE63E5517864 Pathvector Code Signing Key <info@pathvector.io>
E: The repository 'https://repo.pathvector.io/apt stable InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

The Debian 12 repository's key is still invalid.

[Craftzman7]

A full month later and still no updated key :/
Anyone have a better solution?

[rapdodge]

A full month later and still no updated key :/
Anyone have a better solution?

Maybe just installing it directly from .deb files on GitHub release :)

[AVSISP]

A full month later and still no updated key :/ Anyone have a better solution?

I will throw up an "unofficial repo mirror" shortly with a properly signed key. Not sure why he isn't updating the key. At least until he updates the key, I'll mirror the repo and re-sign it.

Edit - Done - Try this:

mv /etc/apt/sources.list.d/pathvector.list /etc/apt/sources.list.d/pathvector.list.bak
curl https://www.avsisp.com/apt/pgp.asc > /usr/share/keyrings/avsisp.asc
echo "deb [signed-by=/usr/share/keyrings/avsisp.asc] https://www.avsisp.com/apt/ stable main" > /etc/apt/sources.list.d/avsisp.list
apt update && apt install -y pathvector

Note: This is a temporary solution to allow people to install, update, and use until @natesales re-signs the repo and updates the gpg key on the mirror url...

[natesales]

Hi all, so sorry for the delay here. I've bumped it on my end so let's try this again, how's this look?

The default install instructions uses a pinned key file at /usr/share/keyrings/pathvector.asc so you may need to refetch it:

curl https://repo.pathvector.io/pgp.asc -o /usr/share/keyrings/pathvector.asc

[rapdodge]

Can confirm, already fixed 👍

Thank you @natesales 😄 🙏