Package: x2goserver Severity: critical
Unable to install x2Go packages for Debian because the repository archive key is not available.
When I try to bootstrap the repository GPG keys using the docs: https://wiki.x2go.org/doku.php/wiki:repositories:debian with this command: apt-key adv --recv-keys --keyserver keys.gnupg.net E1F958385BFE2B6E
Then I receive the following error message:
GPG error: http://packages.x2go.org/debian stretch InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E1F958385BFE2B6E gpg: keyserver receive failed: No name
It was working fine till last month. Please check if the public key has changed.
I mark this ticket as critical because at the moment we are unable to even install x2Go for new users.
Regards, Saion
Hello Saion,
as a quickfix you can use another gpg server: apt-key adv --recv-keys --keyserver keyserver.ubuntu.com E1F958385BFE2B6E
On debian buster-backports and newer systems you can use extrepo: apt install extrepo && extrepo enable x2go && apt-get update && apt-get install x2goserver
I have changed this in wiki.
Best Regards, Juri Grabowski
Many Thanks Juri,
The quickfix works although it could not verify 2 signatures:
gpg: key E1F958385BFE2B6E: 2 signatures not checked due to missing keys
gpg: key E1F958385BFE2B6E: public key "X2go Debian/Ubuntu Packaging debian@x2go.org<mailto:debian@x2go.org>" imported
gpg: Total number processed: 1
gpg: imported: 1
Do you think this can lead to a security issue due to the 2 signatures not checked?
Best Regards, Saion
On Wed, 28 Jul 2021 21:40:49 +0200 Juri Grabowski <x2go-dev@jugra.de> wrote:
Hello Saion,
as a quickfix you can use another gpg server: apt-key adv --recv-keys --keyserver keyserver.ubuntu.com E1F958385BFE2B6E
On debian buster-backports and newer systems you can use extrepo: apt install extrepo && extrepo enable x2go && apt-get update && apt-get install x2goserver
I have changed this in wiki.
Best Regards, Juri Grabowski
Hello together,
On 2021-07-29 16:17 4, Chatterjee, Saion wrote:
Do you think this can lead to a security issue due to the 2 signatures not checked? Sorry for long delay. It's OK, right now.
@Heinz: Default gpg2 setting is to load keys from WebKeyDirectory I mean it would be nice, if you can create DNS-Entries (A and AAAA) for openpgpkey.x2go.org like for x2go.org. On my side I can configure WKD on japsand with:
- Add apache vhost mkdir .well-known/openpgpkey/x2go.org/ cd .well-known/openpgpkey/x2go.org/ apt-get install python3-gnupg touch policy wget --content-disposition 'https://gitlab.com/Martin_/generate-openpgpkey-hu-3/-/raw/master/generate-op...' gpg --keyserver keyserver.ubuntu.com --search-keys debian@x2go.org python3 generate-openpgpkey-hu-3 -a debian@x2go.org
Best Regards, Juri Grabowski
P.S.: wiki.x2go.org don't have AAAA DNS entry. Do you know why? Maybe can you set it as well.
-
Chatterjee, Saion -
Juri Grabowski