packages.sury.org - New Signing Key

    key expired

    Code
    1. apt-key del 95BD4743
    2. wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
    3. apt-get update
    4. sudo apt-get update && sudo apt-get dist-upgrade
    5. note:
    6. re-install packages which are marked for autoremove afterwards!

    Edited once, last by fulltilt ().

    Just to clarify a little, the link point to a publication dated on March 2019, where a leak of the signing key did occur.


    Lately, the issue was not the same, the certificate passed it validity date and he get renewed (same key, but expire in 2024 now, if I'm not wrong :) )

    Quote from Athar

    Just to clarify a little, the link point to a publication dated on March 2019, where a leak of the signing key did occur.


    Lately, the issue was not the same, the certificate passed it validity date and he get renewed (same key, but expire in 2024 now, if I'm not wrong :) )

    seems it happend again ...

    https://forum.yunohost.org/t/s…-of-apt-due-to-sury/15024


    I have tested a few servers today and got the same error, fixed with:

    Code
    1. apt-key del 95BD4743
    2. wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
    3. apt-get update
    4. sudo apt-get update && sudo apt-get dist-upgrade


    and

    https://github.com/oerdnj/deb.sury.org/issues/1575

    Yeah, but the root cause is different from the initial link you posted :)


    On your initial link, it was after the key was "stollen".

    For this one, just the key which expire :)


    Previous key expire date : pub rsa3072 2019-03-18 [SC] [expired: 2021-03-17]

    New key expire date : pub rsa3072 2019-03-18 [SC] [expires: 2024-02-16]


    Also, the key didn't changed (this is why we have to delete the actual key, firstly because it's "packaged" with i-MSCP installer and put it in trusted.gpd file, and also we can't get 2 same keys, the one expired having the priority from what I saw).

    In 2019, the key did change :)

  • fulltilt

    Changed the title of the thread from “packages.sury.org - DPA New Signing Key” to “packages.sury.org - New Signing Key”.

    in step 2 - trying to artiffically implant file with trusted key into apt might not work

    better use apt-key add:

    Code
    1. wget -c -t0 https://packages.sury.org/php/apt.gpg
    2. cat apt.pgp | apt-key add -



    it will work in all apt based distros