adoptium / adoptium/installer

BAD signature error on AdoptOpenJDK Debian buster Repository

Open
#235 8 comments 0 reactions 2 assignees Claimed by @gdams View on GitHub
bug
Dominant language
Jinja
Stars
168
Forks
77
Avg merge
2d 14h
Merged PRs (30d)
12

Description

We are using the Debian repository

```
deb https://adoptopenjdk.jfrog.io/adoptopenjdk/deb buster main
```

and are monitoring the signatures of all signed repository files in /var/lib/apt/lists (everything that contains a BEGIN PGP SIGNATURE).

Today we are getting the error

```
# apt-key adv --verify /var/lib/apt/lists/adoptopenjdk.jfrog.io_adoptopenjdk_deb_dists_buster_InRelease
Executing: /tmp/apt-key-gpghome.NEgE1ccd7p/gpg.1.sh --verify /var/lib/apt/lists/adoptopenjdk.jfrog.io_adoptopenjdk_deb_dists_buster_InRelease
gpg: Signature made Thu 16 Jul 2020 04:34:39 PM CEST
gpg: using RSA key 8AC3B29174885C03
gpg: BAD signature from "AdoptOpenJDK (used for publishing RPM and DEB files) " [unknown]
zsh: exit 1 apt-key adv --verify
```

We have the key installed and it is not expired (which would give different errors anyway)

```
# apt-key list "8ED1 7AF5 D7E6 75EB 3EE3 BCE9 8AC3 B291 7488 5C03"
pub rsa4096 2019-04-30 [SC]
8ED1 7AF5 D7E6 75EB 3EE3 BCE9 8AC3 B291 7488 5C03
uid [ unknown] AdoptOpenJDK (used for publishing RPM and DEB files)
sub rsa4096 2019-04-30 [E]
```

Oddly enough apt-get update does not report any errors.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.