hbsd-update fails on 13.0-STABLE with "Public key failed to validate"

[Ian Silvester]

Hi,

It was about time I updated my HardenedBSD server so, as root, I ran hbsd-update and got the following failure:

$ hbsd-update fetch
hbsd-v1300066-dc7f80082fe37687cbaab0231ee65a3f728e617c
/tmp/tmp.LVQ1GPH4/update.tar                           672 MB   21 MBps    32s
[*] Public key failed to validate.

The keys at /usr/share/keys/hbsd-update/trusted are from January 2022. I'm conscious that the server is quite out of date; what ought I do to update the keys such that the update process can succeed?

Thanks in advance,

Ian

[Shawn Webb]

Hey Ian,

HardenedBSD 13 has not been supported for a number of years now. You
will want to upgrade to 15.

Thanks,

--
Shawn Webb
Cofounder / Security Engineer
HardenedBSD

Signal Username: shawn_webb.74
Tor-ified Signal: +1 (719) 756-1197 / activist_opsec.27
https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc

[Ian Silvester]

Thanks Shawn,

Is there a guide somewhere to doing so, without rebuilding from scratch? I did a fair bit of googling that always led me to hbsd-update.

Cheers,

Ian

> Attachments:
> * signature.asc

[Shawn Webb]

Edit /etc/hbsd-update.conf

Replace all instances of 13 to 15. Replace all instances of master to
main. Use that newly modified config file with hbsd-update's -c
option.

Of course, you'll want to make sure you do your due diligence to make
sure things don't break such that data loss occurs. Updating two major
version numbers in one go might prove difficult for you.

Good luck!

--
Shawn Webb
Cofounder / Security Engineer
HardenedBSD

Signal Username: shawn_webb.74
Tor-ified Signal: +1 (719) 756-1197 / activist_opsec.27
https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc

[Ian Silvester]

Nice - thanks!

> Attachments:
> * signature.asc

[Ian Silvester]

Just for the benefit of anyone who finds this thread, it took three runs (the first two failed with kernel panics, which might have simply been due to insufficient RAM given to the VM) but this worked like a dream!

Ian