microsoft / microsoft/shell-intune-samples
GPG Verification Failure (NO_PUBKEY) on Ubuntu 26.04 due to Key Rotation Mismatch
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 1.1k
- Forks
- 305
- PR merge metrics
- No merged PRs in 30d
Description
The installer.sh script (Release 2026-04-23) fails on Ubuntu 26.04 "Resolute Raccoon" when attempting to install Microsoft Edge. While the script correctly identifies 26.04 and imports the new microsoft-2025.asc key, the Microsoft Edge repository is still signed with the legacy microsoft.asc key. Because the script overwrites the keyring with only the version-specific key, the subsequent apt-get update fails because the public key for the Edge repository is unavailable.
Error log:
W: GPG error: https://packages.microsoft.com/repos/edge stable InRelease:
The following signatures couldn't be verified because the public key is not available:
NO_PUBKEY EB3E94ADBE1229CF
E: The repository 'https://packages.microsoft.com/repos/edge stable InRelease' is not signed.
Root CauseLine 183-187: The script uses dpkg --compare-versions to select either the 2025 key or the legacy key. Line 191: The script uses gpg --dearmor > "$HOME/microsoft.gpg", which replaces any existing keys in the temporary file rather than appending them. Result: On Ubuntu 26.04, the legacy key (required by the Edge repo) is missing from /usr/share/keyrings/microsoft.gpg, causing the installation to exit with status 100. Suggested FixModify the key import logic to merge both keys into the keyring during the transition period, or ensure the Edge repository enrollment includes the legacy key explicitly.
Example:
Import both keys to ensure compatibility with legacy-signed repos (Edge) and new repos (Intune)
curl -fsSL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > "$HOME/microsoft.gpg"
curl -fsSL https://packages.microsoft.com/keys/microsoft-2025.asc | gpg --dearmor >> "$HOME/microsoft.gpg"
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read installer.sh lines 183-191, focusing on the version-based key selection and the gpg --dearmor redirection. Verify the keyring retains both microsoft.asc and microsoft-2025.asc, then run the Edge repository update on Ubuntu 26.04; done means apt-get update no longer reports NO_PUBKEY EB3E94ADBE1229CF.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- bash
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100