BAD signature error on AdoptOpenJDK Debian buster Repository
- Dominant language
- Jinja
- Stars
- 168
- Forks
- 77
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 12
Description
We are using the Debian repository
```
deb https://adoptopenjdk.jfrog.io/adoptopenjdk/deb buster main
```
and are monitoring the signatures of all signed repository files in /var/lib/apt/lists (everything that contains a BEGIN PGP SIGNATURE).
Today we are getting the error
```
# apt-key adv --verify /var/lib/apt/lists/adoptopenjdk.jfrog.io_adoptopenjdk_deb_dists_buster_InRelease
Executing: /tmp/apt-key-gpghome.NEgE1ccd7p/gpg.1.sh --verify /var/lib/apt/lists/adoptopenjdk.jfrog.io_adoptopenjdk_deb_dists_buster_InRelease
gpg: Signature made Thu 16 Jul 2020 04:34:39 PM CEST
gpg: using RSA key 8AC3B29174885C03
gpg: BAD signature from "AdoptOpenJDK (used for publishing RPM and DEB files) " [unknown]
zsh: exit 1 apt-key adv --verify
```
We have the key installed and it is not expired (which would give different errors anyway)
```
# apt-key list "8ED1 7AF5 D7E6 75EB 3EE3 BCE9 8AC3 B291 7488 5C03"
pub rsa4096 2019-04-30 [SC]
8ED1 7AF5 D7E6 75EB 3EE3 BCE9 8AC3 B291 7488 5C03
uid [ unknown] AdoptOpenJDK (used for publishing RPM and DEB files)
sub rsa4096 2019-04-30 [E]
```
Oddly enough apt-get update does not report any errors.
Contributor guide
Assessment
This issue has not been assessed yet.