goaccess: GoAccess Invalid deb signatures EXPKEYSIG - deb repo

Thanks everyone for reporting this. The key has been renewed, please download it again, e.g.,

$ sudo apt-key del 97BD1A0133449C3D
$ sudo rm -rf /usr/share/keyrings/goaccess.gpg
$ wget -O - https://deb.goaccess.io/gnugpg.key | gpg --dearmor | sudo tee /usr/share/keyrings/goaccess.gpg >/dev/null

The key fingerprint is the same: C03B 4888 7D5E 56B0 4671 5D32 97BD 1A01 3344 9C3D

Please let me know if that solves the issue on your end.

Thanks, however, in addition to the above instructions to avoid the “The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY 97BD1A0133449C3D” I had to also do this:

cd /usr/share/keyrings;
sudo apt-key add goaccess.gpg

on a recent 20.04 LTS install I took steps from @allinurl and added two lines to it and it worked with the extra two lines, see below:

sudo apt-key del 97BD1A0133449C3D
sudo rm -rf /usr/share/keyrings/goaccess.gpg
wget -O - https://deb.goaccess.io/gnugpg.key | gpg --dearmor | sudo tee /usr/share/keyrings/goaccess.gpg >/dev/null
cd /usr/share/keyrings
sudo apt-key add goaccess.gpg

@ahayes just for reference, here are some great answers on apt-key and the path of keyrings:

https://askubuntu.com/a/1307181 https://unix.stackexchange.com/a/582853

Resolved!

Thank you!

That didn’t quite work for me on an Ubuntu 20.04 LTS x86_64 system, some other steps may help,

• I wanted to verify the signature of the new key (look for signature ...9C3D showing up in output): wget -O - https://deb.goaccess.io/gnugpg.key | gpg --show-keys
• Then I was happy to download it as suggested to /usr/share/keyrings/goaccess.gpg
• apt-get update was failing with "N: Skipping acquisition of configured file 'main/binary-i386/Packages', as repository 'https://deb.goaccess.io focal InRelease' doesn't support architecture 'i386'"
• To fix this I edited the contents of /etc/apt/sources.list.d/goaccess.list to (adding the arch setting), deb [signed-by=/usr/share/keyrings/goaccess.gpg arch=amd64] https://deb.goaccess.io/ focal main
• This way the key doesn’t have to be on my apt keyring, but it could be (apt-key add /usr/share/keyrings/goaccess.gpg), in which case I think that signed-by option can be removed.

Thank you for creating this issue. I have been trying to find my way around the same problem for the last 30 minutes or so with no success. It looks like this issue comes up for various projects when the repo signing key changes.

On Debian Bullseye, I had to place the gpg key in /etc/apt/trusted.gpg.d instead of /usr/share/keyrings

@ypujante Certificate is fine. Have you run apt update and apt upgrade on your machine? I wonder if you have old cert packages… Then please try:

$ echo "deb http://deb.goaccess.io $(lsb_release -cs) main" | sudo tee -a /etc/apt/sources.list
$ wget -O - http://deb.goaccess.io/gnugpg.key | sudo apt-key add -
$ sudo apt-get update
$ sudo apt-get install goaccess

I installed goaccess via this guide when setting up my server: https://www.howtoforge.com/tutorial/perfect-server-ubuntu-20.04-with-apache-php-myqsl-pureftpd-bind-postfix-doveot-and-ispconfig/

In that guide it installs via these commands:

wget -O - https://deb.goaccess.io/gnugpg.key | sudo apt-key --keyring /etc/apt/trusted.gpg.d/goaccess.gpg add -
sudo apt-get update
sudo apt-get install goaccess

Therefore to correct this issue, I modified the recommendation above slightly to:

sudo apt-key del 97BD1A0133449C3D
sudo rm -rf **/etc/apt/trusted.gpg.d/goaccess.gpg**
wget -O - https://deb.goaccess.io/gnugpg.key | sudo apt-key --keyring /etc/apt/trusted.gpg.d/goaccess.gpg add -
sudo apt-get update

Hope this helps anyone with the key in trusted.gpg.d

The official Debian wiki also does not recommend trusted.gpg.d: https://wiki.debian.org/DebianRepository/UseThirdParty

But a non-armored key and a package which should be updated when the signing key could also be two good points which would make things perfect 🙂

On Debian Bullseye, I had to place the gpg key in /etc/apt/trusted.gpg.d instead of /usr/share/keyrings

I would have thought that when using the deb signed-by setting as documented you could put it anywhere. Is that not the case?