Key signing issue

[Morty-Feldman]

Hello. When I run sudo apt-get update, I get the following errors:

Err:9 https://packages.sury.org/apache2 bookworm InRelease
The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 [DEB.SURY.ORG](https://deb.sury.org/) Automatic Signing Key <[[email protected]](mailto:[email protected])>

Err:10 https://packages.sury.org/php bookworm InRelease
The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 [DEB.SURY.ORG](https://deb.sury.org/) Automatic Signing Key <[[email protected]](mailto:[email protected])>

Then, these warnings show afterward:

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://packages.sury.org/apache2 bookworm InRelease: The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 [DEB.SURY.ORG](https://deb.sury.org/) Automatic Signing Key <[[email protected]](mailto:[email protected])>
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://packages.sury.org/php bookworm InRelease: The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 [DEB.SURY.ORG](https://deb.sury.org/) Automatic Signing Key <[[email protected]](mailto:[email protected])>
W: Failed to fetch https://packages.sury.org/apache2/dists/bookworm/InRelease The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 [DEB.SURY.ORG](https://deb.sury.org/) Automatic Signing Key <[[email protected]](mailto:[email protected])>
W: Failed to fetch https://packages.sury.org/php/dists/bookworm/InRelease The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 [DEB.SURY.ORG](https://deb.sury.org/) Automatic Signing Key <[[email protected]](mailto:[email protected])>
W: Some index files failed to download. They have been ignored, or old ones used instead.

I tried following what people discussed at github issue #2074 but still can't figure out how to resolve these errors and warnings. Can someone please tell me what commands I should run to re-fetch the key?

Please let me know if you need any more information.

[rfay]

You need to get the new key as explained there in #2074.

[rfay]

I recommend that you follow the instructions at https://packages.sury.org/php/README.txt and just get your stuff properly installed in the first place. You may have your key stored in the old place (/etc/trusted.d) etc.

[Morty-Feldman]

The file /etc/trusted.d does not exist but /usr/share/keyrings/deb.sury.org-php.gpg does exist even through the command you mentioned previously does not fix the issue. Do you have any other ideas?

I read that file, by the way, and still can't comprehend what it'll take to fix this issue. Thank you for linking me to it, though.

Edit: do I need to restart or something to ensure the command you told me to run is saved before attempting an update?

[rfay]

I recommend that you follow the instructions at https://packages.sury.org/php/README.txt and just get your stuff properly installed in the first place.

Please don't follow up until you have done that.

• Make sure that the /etc/apt/sources.list.d/php.list contains exactly the contents that that README creates.
• Use gpg /usr/share/keyrings/deb.sury.org-php.gpg to verify that you have the key actually installed, the one that expires in 2026.

$ gpg /usr/share/keyrings/deb.sury.org-php.gpg
gpg: directory '/home/rfay/.gnupg' created
gpg: keybox '/home/rfay/.gnupg/pubring.kbx' created
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa3072 2019-03-18 [SC] [expires: 2026-02-04]
      15058500A0235D97F5D10063B188E2B695BD4743
uid           DEB.SURY.ORG Automatic Signing Key <[email protected]>
sub   rsa3072 2019-03-18 [E] [expires: 2026-02-04]

[Morty-Feldman]

Good news! I remembered that I also have apache2 from sury and that required an additional command to fix.

So, the commands that fixed the issue for me were:

sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-apache2.gpg] https://packages.sury.org/apache2/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/apache2.list'

This is considering the fact that /usr/share/keyrings/deb.sury.org-php.gpg was actually already updated so if anyone is reading this with a similar issue, ensure that's updated as well!

Thank you very much for your help, Randy! ❤️