cloudfoundry / cloudfoundry/cli

New APT (DEB) repo signature is invalid

Open
#3,863 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
1.9k
Forks
990
Avg merge
1d 7h
Merged PRs (30d)
8

Description

Please fill out the issue checklist below and provide ALL the requested information.

  • I reviewed open and closed github issues that may be related to my problem.
  • I tried updating to the latest version of the CF CLI to see if it fixed my problem.
  • I attempted to run the command with CF_TRACE=1 to help debug the issue.
  • I am reporting a bug that others will be able to reproduce.

Describe the bug and the command you saw an issue with

I am trying to install cf8-cli from the apt repository:

FROM "node:24.21.0-trixie-slim"

RUN apt-get update \
    && apt-get install -y --no-install-recommends curl ca-certificates gnupg \
    && curl --silent --location https://packages.cloudfoundry.org/debian/cli.cloudfoundry.org.key \
    | gpg --dearmor -o /etc/apt/trusted.gpg.d/cloudfoundry-cli.gpg \
    && echo "deb https://packages.cloudfoundry.org/debian stable main" | tee /etc/apt/sources.list.d/cloudfoundry-cli.list \
    && apt-get update \
    && apt-get install --no-install-recommends --assume-yes cf8-cli \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

What happened

#7 2.099   Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on C19C04748BF33B2E17863557172B5989FCD21EF8 is bad:            The primary key is not live   because: Expired on 2020-09-12T18:17:33Z
#7 3.001 Reading package lists...
#7 3.834 W: OpenPGP signature verification failed: https://cf-cli-debian-repo.s3.amazonaws.com/ stable InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on C19C04748BF33B2E17863557172B5989FCD21EF8 is bad:            The primary key is not live   because: Expired on 2020-09-12T18:17:33Z
#7 3.834 E: The repository 'https://packages.cloudfoundry.org/debian stable InRelease' is not signed.

Expected behavior
I'd expect the signature to be valid so the package can be installed.

Exact Steps To Reproduce
see above

Provide more context

  • platform and shell details ( e.g. Mac OS X 10.11 iTerm): Docker (trixie-based), without cache

Seems it's about one year after the last time it expired: #3579

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the provided Dockerfile on the Debian trixie-based image and reproduce the failure with apt-get update. Inspect the Cloud Foundry APT repository key and signing metadata involved in the command; done means the repository signature validates and cf8-cli installs successfully without the expired-key error.

Written by the indexing model from the issue text.

Assessment

Tech stack
debian, docker
Domain
release, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.