Key for zsh-autosuggestions packages in OBS has expired

[JaviMerino]

Describe the bug

INSTALL.md lists the zsh-autosuggestions OBS repository as a way to install it in Ubuntu. However, the release key expired on the 14th of October:

$ apt-key adv --list-key 767B5F350F20116F 
Executing: /tmp/apt-key-gpghome.jKWbDodOp0/gpg.1.sh --list-key 767B5F350F20116F
pub   rsa2048 2017-08-05 [SC] [expired: 2019-10-14]
      4919522E6859A90747C6D97A767B5F350F20116F
uid           [ expired] shells:zsh-users OBS Project <shells:zsh-users@build.opensuse.org>

I'm not sure if github is the correct place to raise this bug, but I hope that if it isn't, someone can tell where is the right place.

To Reproduce

Steps to reproduce the behavior:

In an Ubuntu 18.04 system, following the instructions linked in the INSTALL.md:

$ wget -nv https://download.opensuse.org/repositories/shells:zsh-users:zsh-autosuggestions/xUbuntu_18.04/Release.key -O Release.key
2019-10-16 09:21:17 URL:https://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04/Release.key [1110/1110] -> "Release.key" [1]

$ sudo apt-key add Release.key
OK

$ sudo apt-get update
[...]
Ign:8 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  InRelease
Hit:9 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release
[...]
Err:13 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release.gpg
  The following signatures were invalid: EXPKEYSIG 767B5F350F20116F shells:zsh-users OBS Project <shells:zsh-users@build.opensuse.org>
Reading package lists... Done 
Building dependency tree
Reading state information... Done
All packages are up to date.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release: The following signatures were invalid: EXPKEYSIG 767B5F350F20116F shells:zsh-users OBS Project <shells:zsh-users@build.opensuse.org>
W: Failed to fetch http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04/Release.gpg  The following signatures were invalid: EXPKEYSIG 767B5F350F20116F shells:zsh-users OBS Project <shells:zsh-users@build.opensuse.org>

Expected behavior

The certificate should expire in the future.

Desktop

• OS + distribution: Ubuntu 18.04
• Zsh version: 5.4.2
• Plugin version: 0.5.0+1.1

[ericfreese]

@nicoulaj can you take a look at this?

[omarefg]

Same here.

[nicoulaj]

The OBS shows the key as valid until 2021-12-08, so I'm not sure what is going here. I tried launching a full rebuild of the packages, let's see if that helps.

[cr-lgl]

Is there no workaround yet?

[zamanmh1]

Still experiencing this also.

[peterlewis]

My experience has been that this is still an issue, as of just now. Does anyone know if there are any further developments? Many thanks!

[ericfreese]

@nicoulaj Do you know anything more about the key that @JaviMerino's output said expired 2019-10-14?

[KarlScheibelhofer]

The key in the Ubuntu 18.04 repo expired as mentioned above.

$ wget -qnv https://download.opensuse.org/repositories/shells:zsh-users:zsh-autosuggestions/xUbuntu_18.04/Release.key -O- | gpg
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2017-08-05 [SC] [expired: 2019-10-14]
      4919522E6859A90747C6D97A767B5F350F20116F
uid           shells:zsh-users OBS Project <shells:zsh-users@build.opensuse.org>

Whereas the key in the 19.10 repo is still valid.

$ wget -qnv https://download.opensuse.org/repositories/shells:zsh-users:zsh-autosuggestions/xUbuntu_19.10/Release.key -O- | gpg
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2017-08-05 [SC] [expires: 2021-12-08]
      4919522E6859A90747C6D97A767B5F350F20116F
uid           shells:zsh-users OBS Project <shells:zsh-users@build.opensuse.org>

It is the same key in both repos, but with different expiration dates. Thus, one can simply import the key of the 19.10 repo and use it with the 18.04.

sudo sh -c "echo 'deb http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04/ /' > /etc/apt/sources.list.d/shells:zsh-users:zsh-autosuggestions.list"
wget -nv https://download.opensuse.org/repositories/shells:zsh-users:zsh-autosuggestions/xUbuntu_19.10/Release.key -O Release.key
sudo apt-key add - < Release.key
sudo apt-get update
sudo apt-get install zsh-autosuggestions

For me, this works. Maybe, someone can update the Release.key in the 18.04 repo, e.g. replace it with the one from the 19.10 repo.

[nicoulaj]

It should be working now

[Hero9909]

sorry but on ubuntu 18.04 the gpg verification failed
see:

Ign:5 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release.gpg                                                                
Paketlisten werden gelesen... Fertig                                                                                                                                             
W: GPG-Fehler: http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release: Die folgenden Signaturen waren ungültig: EXPKEYSIG 767B5F
350F20116F shells:zsh-users OBS Project <shells:zsh-users@build.opensuse.org>                                                                                                    
E: Das Depot »http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release« ist nicht signiert.                                       
N: Eine Aktualisierung von solch einem Depot kann nicht auf eine sichere Art durchgeführt werden, daher ist es standardmäßig deaktiviert.

btw using the 19th key works fine

[adreo00]

I was still experiencing this issue until I used the keys from 19.10 as @KarlScheibelhofer recommended.

[4k4xs4pH1r3]

@ericfreese + @nicoulaj please can You help us when i try to update my packages in Ubuntu is appearing this

The following signatures were invalid: EXPKEYSIG 767B5F350F20116F shells:zsh-users OBS Project shells:zsh-users@build.opensuse.org

[Kwaadpepper]

I also have EXPKEYSIG 9CBE063CAB8FE1F1 for http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_18.04

It was not renewed.

[nicoulaj]

I have refreshed the key, updated the package to 0.7.0, enabled repos for newer distros and dropped older ones. Hopefully all issues should be solved.

For the record, this is where the packaging happens: https://build.opensuse.org/package/show/shells:zsh-users:zsh-autosuggestions/zsh-autosuggestions (feel free to get in touch if you want to get involved)

[mihailbakirov]

Have the same issue, did it expired again?

Err:7 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_18.04  InRelease
  The following signatures were invalid: EXPKEYSIG 9CBE063CAB8FE1F1 shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>
Reading package lists... Done 
W: GPG error: http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_18.04  InRelease: The following signatures were invalid: EXPKEYSIG 9CBE063CAB8FE1F1 shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>
E: The repository 'http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_18.04  InRelease' is not signed.

[4k4xs4pH1r3]

@ericfreese + @nicoulaj please can You help Us, tank you

[parsanoori]

I have this problem with the 21.10 version:

W: GPG error: http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_21.10  InRelease: The following signatures were invalid: EXPKEYSIG 9CBE063CAB8FE1F1 shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>
E: The repository 'http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_21.10  InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.

[svvj]

Have the same issue, did it expired again?

Err:7 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_18.04  InRelease
  The following signatures were invalid: EXPKEYSIG 9CBE063CAB8FE1F1 shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>
Reading package lists... Done 
W: GPG error: http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_18.04  InRelease: The following signatures were invalid: EXPKEYSIG 9CBE063CAB8FE1F1 shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>
E: The repository 'http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_18.04  InRelease' is not signed.

Same here.

[driuba]

Err:3 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_22.04  InRelease
  The following signatures were invalid: EXPKEYSIG 767B5F350F20116F shells:zsh-users OBS Project <shells:zsh-users@build.opensuse.org>
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_22.04  InRelease: The following signatures were invalid: EXPKEYSIG 767B5F350F20116F shells:zsh-users OBS Project <shells:zsh-users@build.opensuse.org>
W: Failed to fetch http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_22.04/InRelease  The following signatures were invalid: EXPKEYSIG 767B5F350F20116F shells:zsh-users OBS Project <shells:zsh-users@build.opensuse.org>

Same issue again

[lensorip]

Guess I'll just pile on like the rest of ya':
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_2X.XX InRelease: The following signatures were invalid: EXPKEYSIG 9CBE063CAB8FE1F1 shells:zsh-users:zsh-completions OBS Project shells:zsh-users:zsh-completions@build.opensuse.org

W: Failed to fetch http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/xUbuntu_2X.XX/InRelease The following signatures were invalid: EXPKEYSIG 9CBE063CAB8FE1F1 shells:zsh-users:zsh-completions OBS Project shells:zsh-users:zsh-completions@build.opensuse.org

[ARehmanMahi]

Dead Project, un-installing.

[vincentclaes]

This advice has helped me: https://askubuntu.com/a/522687/881221

[dsoto1219]

Dead Project, un-installing.

How do you uninstall after downloading via this OBS ppa?

[driuba]

Dead Project, un-installing.

How do you uninstall after downloading via this OBS ppa?

Remove / comment entry from sources list and run apt remove on the package. Afterwards it can be reinstalled from distros ppa