webmin.sh: signature verification failed

for the records:
https://github.com/nextcloud/vm/blob/24f1720e5eda9b7ce922ea5d1a9521bcbec10baa/apps/webmin.sh#L52

apt-key depreciated
https://www.digitalocean.com/community/tutorials/how-to-handle-apt-key-and-add-apt-repository-deprecation-using-gpg-to-add-external-repositories-on-ubuntu-22-04

EDiT:
i am not sure what happened and how it happened 🤔

at least i was clumsy enough to ignore one inactive terminal window:

# bash /var/scripts/vm-repo-backup/apps/webmin.sh
dpkg-query: no packages found matching webmin
Installing Webmin...
[⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻]
1 of 10 retries.
Trying again in 30 seconds...
Adding trusted key in /etc/apt/keyrings/jcameron-key.asc...
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.7 (GNU/Linux)

mQGiBDx9wR0RBACR3xGPTkG5Staj7EVeiVJDrYXIPF28MGCrOEGw04tQmQTALz0E
YEcyfvui7KScrpHmZpy70PwgwxUDPUMik7vvRiUa9RRbJsDYyom06NGk+Z4dURhn
DeNRhcBrNBfyMvUY7HSJ2JP9jhQDWb8Lo1i231tvlnY0tNudVsP484ax6wCgrBwW
myad6TLYaETj0+AxGJxYgikD/iERqNF60x+WyfEH/SIOuKGlV/QoxmqOePn2gj9V
DWiOOAZ9DDWD6DpRNK/UVZRD1MK37HU1ePv7i92DTL9yIbyJwFcZNkEyMU3t+GBj
zf4YvaQnvtA09EdQNsC1GXxNXqYkVmTE1dHH83UK+chaXRoDQ6O9KD9SFE2vsj1d
z9VPBACPgmuVcUKXag6ZBY+SBColQzwyZfXtTOCnBh0HP4HOjU4G6CRTcAgLQrdM
1Uu29Al7TaE2p8HZb37dVoTRntM+Nf5O+2dX5iHA6ncdozKGftuXQMC7z9758nUi
2E4Svo9hmroM+NKonpZByt6TilhDXrPIcNYHlNsxpTAxq+lnw7QjSmFtaWUgQ2Ft
ZXJvbiA8amNhbWVyb25Ad2VibWluLmNvbT6IVwQTEQIAFwUCPH3BHQULBwoDBAMV
AwIDFgIBAheAAAoJENl6OukR9jxRQZEAoIHxngo/LxLBeFF9cpEViVGgChRIAJ90
zwqcBfw02su5AavnXjv6HxXF8bkBDQQ8fcEqEAQAx88aO9zI912/tbsNjLhDXpq0
WMw5F6fUUlwYpkaspPwWZ3UgDJaR1+oL3xnJKlD1Eu5x9B3r+rxYyoFpXubWz4R6
sL1u4kMRb347+fv140dE/RGFNEmqefZDeysz1TQG1Sskyyf7sV2KRUmI8wJTwg3n
IOtbyOoE3XlxI5FUrW8AAwUD/iEBdIH5DYB/FnOb/EkP3G3kCXGgTdZk7UA9HPKB
dV7JckgSicpi/mX898LxQrr0jyb6nyi2900OgQUQArrviTnp37j4ciQj214gTHzf
ssA40O5QR4t915z6wS4Ml+fAc5ZOeL6EQxiP+x+rz6h9+Mc8rawowY+7sBnvVw5O
YoVXiEYEGBECAAYFAjx9wSoACgkQ2Xo66RH2PFH+ZgCggAyuOLaoE9t9tyJbifEz
/YzvqYwAnj85Ehe8EmnKuor/k/TPtKl4MzDm
=oxvD
-----END PGP PUBLIC KEY BLOCK-----
[⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻W: OpenPGP signature verification failed: https://download.webmin.com/download/repository sarge Release: The following signatures were invalid: 1719003ACE3E5A41E2DE70DFD97A3AE911F63C51 (untrusted public key algorithm: dsa1024)
E: The repository 'https://download.webmin.com/download/repository sarge Release' is not signed.
]
dpkg-query: no packages found matching webmin
[⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻W: OpenPGP signature verification failed: https://download.webmin.com/download/repository sarge Release: The following signatures were invalid: 1719003ACE3E5A41E2DE70DFD97A3AE911F63C51 (untrusted public key algorithm: dsa1024)
E: The repository 'https://download.webmin.com/download/repository sarge Release' is not signed.
]
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package webmin
dpkg-query: no packages found matching webmin
--2026-08-11 15:09:46--  http://prdownloads.sourceforge.net/webadmin/webmin_2.010_all.deb
Resolving prdownloads.sourceforge.net (prdownloads.sourceforge.net)... 104.18.13.149, 104.18.12.149, 2606:4700::6812:d95, ...
Connecting to prdownloads.sourceforge.net (prdownloads.sourceforge.net)|104.18.13.149|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://downloads.sourceforge.net/project/webadmin/webmin/2.010/webmin_2.010_all.deb [following]
--2026-08-11 15:09:46--  http://downloads.sourceforge.net/project/webadmin/webmin/2.010/webmin_2.010_all.deb
Resolving downloads.sourceforge.net (downloads.sourceforge.net)... 104.18.12.149, 104.18.13.149, 2606:4700::6812:c95, ...
Reusing existing connection to prdownloads.sourceforge.net:80.
HTTP request sent, awaiting response... 302 Found
Location: http://ixpeering.dl.sourceforge.net/project/webadmin/webmin/2.010/webmin_2.010_all.deb?viasf=1&fid=dac998b8e751a47d&e=1786540187&st=__70pX-rK5OxOKRtyXliHQ [following]
--2026-08-11 15:09:47--  http://ixpeering.dl.sourceforge.net/project/webadmin/webmin/2.010/webmin_2.010_all.deb?viasf=1&fid=dac998b8e751a47d&e=1786540187&st=__70pX-rK5OxOKRtyXliHQ
Resolving ixpeering.dl.sourceforge.net (ixpeering.dl.sourceforge.net)... 103.2.117.3
Connecting to ixpeering.dl.sourceforge.net (ixpeering.dl.sourceforge.net)|103.2.117.3|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 34186404 (33M) [application/octet-stream]
Saving to: ‘webmin_2.010_all.deb.1’

webmin_2.010_all.deb.1        100%[==============================================>]  32.60M  4.16MB/s    in 8.6s

2026-08-11 15:09:57 (3.79 MB/s) - ‘webmin_2.010_all.deb.1’ saved [34186404/34186404]

Selecting previously unselected package webmin.
(Reading database ... 138064 files and directories currently installed.)
Preparing to unpack webmin_2.010_all.deb ...
Unpacking webmin (2.010) ...
Setting up webmin (2.010) ...
Configuring Webmin...
Starting webmin...

so i was investigating the OpenPGP signature verification failed error
and github guided me to: https://github.com/nextcloud/vm/blob/24f1720e5eda9b7ce922ea5d1a9521bcbec10baa/apps/webmin.sh#L52

did the following:

• verified that the webmin.pgp was missing
• called webmin.sh again
• uninstalled webmin
• rebooted
• called webmin.sh again
• same repo error
• called webmin.sh again
• uninstalled webmin
• rebooted
• used https://github.com/webmin/webmin/blob/master/webmin-setup-repo.sh
• apt update install webmin

done!

btw:
is there a reason why hardcoding webmin_2.010_all.deb into webmin.sh

EDiT#2:
also there was a warning/notice on webmins dashboard - installed via webmin.sh - that an old repository is used.
i do not remember the exact message 🤷🏻‍♂️ that message is not there with webmin-setup-repo.sh 💡

Start with apps/webmin.sh at line 52 and compare its repository and package-install steps with webmin-setup-repo.sh. Reproduce the installation and apt update to confirm the dsa1024 signature error and the old repository warning. Done means webmin.sh installs Webmin without the reported repository verification failure and does not rely on the outdated hardcoded package path.