While performing an apt-get update in February, I was
presented with the error message:
GPG error: http://ftp.uk.debian.org testing Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 010908312D230C5F
It appears I had upgraded, at some time in the recent past, to a
version of apt-get that supports verifying signed apt
repositories. See this Debian
security announcement and this Debian SecureApt wiki entry. The
existing public key for the apt archives, presumably acquired at the
same time as the updated apt-get, had expired. The list of
apt-get keys can be viewed with the apt-key list command.
The following magic incantation (stolen from Serendipitous Altruism) fixed the problem for me.
# gpg --keyserver wwwkeys.eu.pgp.net --recv-keys 010908312D230C5F # gpg --armor --export 2D230C5F | apt-key add -
The first command line imports the missing Debian archive key (using
the key id complained about by apt-get) from a keyserver.
A list of public key servers can be found on David Ross's
site. The key is stored locally in the gpg public keyring.
You can see the list of keys held with the following command:
# gpg --list-keys
which on my machine produces the following output:
/root/.gnupg/pubring.gpg ------------------------ pub 1024D/2D230C5F 2006-01-03 [expires: 2007-02-07] uid Debian Archive Automatic Signing Key (2006) <ftpmaster@debian.org>
The second line of the magic incantation exports this key (which now
appears to be identified by the last eight digits of the key id) into
apt-key, which makes the key available to apt-get.
apt-key list now gives the following output:
/etc/apt/trusted.gpg -------------------- pub 1024R/1DB114E0 2004-01-15 [expired: 2005-01-27] uid Debian Archive Automatic Signing Key (2004) <ftpmaster@debian.org> pub 1024D/4F368D5D 2005-01-31 [expired: 2006-01-31] uid Debian Archive Automatic Signing Key (2005) <ftpmaster@debian.org> pub 1024D/2D230C5F 2006-01-03 [expires: 2007-02-07] uid Debian Archive Automatic Signing Key (2006) <ftpmaster@debian.org>
It appears there is a much simpler way to get the current debian archive keys, namely:
apt-get install debian-archive-keyring
And I would have known this earlier, had I read properly the wiki entry I referred to above!
