mod-pagespeed signature verification failure

[Stephen Reese]

I am receiving the following signature error when running $ sudo apt-get update on a Debian 8.2

Reading package lists... Done
W: An error occurred during the signature verification. The repository
is not updated and the previous index files will be used. GPG error:
http://dl.google.com stable Release: The following signatures were
invalid: BADSIG A040830F7FAC5991 Google, Inc. Linux Package Signing
Key <linux-packages-keymaster@google.com>

W: Failed to fetch
http://dl.google.com/linux/mod-pagespeed/deb/dists/stable/Release

W: Some index files failed to download. They have been ignored, or old
ones used instead.

Here's what I have for a source:
$ more /etc/apt/sources.list.d/mod-pagespeed.list
### THIS FILE IS AUTOMATICALLY CONFIGURED ###
# You may comment out this entry, but any other modifications may be lost.
deb http://dl.google.com/linux/mod-pagespeed/deb/ stable main

After trying to clean the repo per http://stackoverflow.com/a/13392695 I get:
W: GPG error: http://dl.google.com stable Release: The following
signatures were invalid: BADSIG A040830F7FAC5991 Google, Inc. Linux
Package Signing Key <linux-packages-keymaster@google.com>

I tried updating the key per https://www.google.com/linuxrepositories/ and reinstalling the package but still see the same error.

Any thoughts?

ii  mod-pagespeed-beta             1.9.32.10-r7423               amd64        Apache 2 module to optimize web content.


Thanks,
Stephen

[Jeffrey Crowell]

can you provide the output of 

sudo apt-key list




Are you on the beta channel trying to update your beta package?




Thanks,
Jeff

[Stephen Reese]

I assume I have been on the beta channel as I have always had the beta package installed. Never noticed this error until recent but my update script only notifies me when a new package is available so I cannot confirm how long this has been an issue.

Thanks,

Stephen

$ sudo apt-key list
/etc/apt/trusted.gpg
--------------------
pub   4096R/C4DEFFEB 2010-09-08 [expires: 2020-09-05]
uid                  varnish-cache.org repository key <sysa...@varnish-software.com>

pub   2048R/7BD9BF62 2011-08-19 [expires: 2016-08-17]
uid                  nginx signing key <signi...@nginx.com>

pub   2048R/1BE7A449 2013-12-25
uid                  Paul Tarjan <p...@fb.com>
sub   2048R/452A652F 2013-12-25

pub   1024D/7FAC5991 2007-03-08
uid                  Google, Inc. Linux Package Signing Key <linux-packag...@google.com>
sub   2048g/C07CB649 2007-03-08

/etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
----------------------------------------------------------
pub   4096R/2B90D010 2014-11-21 [expires: 2022-11-19]
uid                  Debian Archive Automatic Signing Key (8/jessie) <ftpm...@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
-------------------------------------------------------------------
pub   4096R/C857C906 2014-11-21 [expires: 2022-11-19]
uid                  Debian Security Archive Automatic Signing Key (8/jessie) <ftpm...@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
-------------------------------------------------------
pub   4096R/518E17E1 2013-08-17 [expires: 2021-08-15]
uid                  Jessie Stable Release Key <debian-...@lists.debian.org>

/etc/apt/trusted.gpg.d/debian-archive-squeeze-automatic.gpg
-----------------------------------------------------------
pub   4096R/473041FA 2010-08-27 [expires: 2018-03-05]
uid                  Debian Archive Automatic Signing Key (6.0/squeeze) <ftpm...@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-squeeze-stable.gpg
--------------------------------------------------------
pub   4096R/B98321F9 2010-08-07 [expires: 2017-08-05]
uid                  Squeeze Stable Release Key <debian-...@lists.debian.org>

/etc/apt/trusted.gpg.d/debian-archive-wheezy-automatic.gpg
----------------------------------------------------------
pub   4096R/46925553 2012-04-27 [expires: 2020-04-25]
uid                  Debian Archive Automatic Signing Key (7.0/wheezy) <ftpm...@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-wheezy-stable.gpg
-------------------------------------------------------
pub   4096R/65FFB764 2012-05-08 [expires: 2019-05-07]
uid                  Wheezy Stable Release Key <debian-...@lists.debian.org>

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/a8c2b5aa-db9e-41a0-8625-584ea8dc4750%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Diego Pastore]

Same issue for me!

[Diego Pastore]

Google pagespeed debian repo (http://dl.google.com/linux/mod-pagespeed/deb/) now 404 error.

Any news?

[Jeffrey Crowell]

looking into it now, thanks for the report.

--

You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/56bf13b7-f3cb-40e2-8187-d1a01541de28%40googlegroups.com.

[Jeffrey Crowell]

issue should be resolved. please retry.

Thanks,
Jeff

[Diego Pastore]

Hi Jeff,

signature error resolved, but 404 on repository url don't.

Thanks,

Diego.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-discuss+unsub...@googlegroups.com.

[Jeffrey Crowell]

what are you trying to access? The .deb files are available by direct link.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/56bf13b7-f3cb-40e2-8187-d1a01541de28%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/3e52b362-cae7-4915-9241-33d50b57a65c%40googlegroups.com.

[Stephen Reese]

Issue resolved, thanks Jeff!

-Stephen

To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/CA%2B7dWMFO2Xw7EM5KqXjj_eGUQ4xDTp-8aJOJaa9n7FTjxoNUwA%40mail.gmail.com.

[Jeffrey Crowell]

Diego,

That 404 on the raw directory is the intended behavior.

What file(s) are you trying to download?

Jeff

[Diego Pastore]

Hi Jeff,

I tried on raw directory, because normally debian repo show files, I don't know on Google repo, 404 on raw dir is the intended behavior.

Anyway, issue resolved!

Thanks,

Diego.

[Пламен Василев]

Hello, I have same issue on Debian 9:

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://dl.google.com/linux/mod-pagespeed/deb stable Release: The following signatures were invalid: EXPKEYSIG 6494C6D6997C215E Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>
W: Failed to fetch http://dl.google.com/linux/mod-pagespeed/deb/dists/stable/Release.gpg  The following signatures were invalid: EXPKEYSIG 6494C6D6997C215E Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>

W: Some index files failed to download. They have been ignored, or old ones used instead.

Reading package lists... Done

I trying to add key again from article:

https://www.google.com/linuxrepositories/

Google keys from apt-key list:

pub   dsa1024 2007-03-08 [SC]
      4CCA 1EAF 950C EE4A B839  76DC A040 830F 7FAC 5991
uid           [ unknown] Google, Inc. Linux Package Signing Key <linux-packag...@google.com>
sub   elg2048 2007-03-08 [E]

pub   rsa4096 2016-04-12 [SC]
      EB4C 1BFD 4F04 2F6D DDCC  EC91 7721 F63B D38B 4796
uid           [ unknown] Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>
sub   rsa4096 2019-07-22 [S] [expires: 2022-07-21]

[Carlos Alberto Martínez Gadea]

Same here on Ubuntu 18.04

[SUNIL GUPTA]

CLOSE EMAIL

On Mon, Feb 10, 2020 at 1:02 PM Carlos Alberto Martínez Gadea <carlosmar...@gmail.com> wrote:

Same here on Ubuntu 18.04

--

You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/248a643c-1caf-43ca-914a-0e0491a60677%40googlegroups.com.

[SUNIL GUPTA]

STOP EMAIL

[Simon Tideswell]

Hello

Is this a CDN issue? It may be relevant which region of the World the affected parties are in. I'm in Australia, how about everyone else? For me dl.google.com currently resolves to 216.58.196.142 (USA). Another host on a different ISP resolves this to 216.58.199.46 (USA). I've not had the chance to test APT from this second place, but may try tomorrow. I have experienced the issue from 2 separate data centres (Brisbane and Sydney).

Simon

[Carlos Alberto Martínez Gadea]

It resolves to 172.217.17.14 in my case and I'm in Spain.

Missatge de Simon Tideswell <stide...@gmail.com> del dia dl., 10 de febr. 2020 a les 12:29:

--

You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/7519df4f-aacb-48be-bc5d-9688755fc0aa%40googlegroups.com.

[Simon Tideswell]

OK, thanks, given that we are separated geographically by so much distance I don't think a CDN issue is a likely cause.

Simon

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-discuss+unsub...@googlegroups.com.

[Longinos]

Hi

https://github.com/apache/incubator-pagespeed-mod/issues/1979#issuecomment-584395279

[SUNIL GUPTA]

stop email

Simon

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/7519df4f-aacb-48be-bc5d-9688755fc0aa%40googlegroups.com.

--

You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/49c33fd7-bb89-4984-9935-ba3a8bc327c8%40googlegroups.com.

[Longinos]

Hi to all

Seems that now it is working

https://github.com/apache/incubator-pagespeed-mod/issues/1979#issuecomment-584766036

[Simon Tideswell]

Yes, I've downloaded a fresh copy of linux_signing_key.pub (which is ~2k larger, and has md5 6d5a8b0b20b68757386be840f9c701ae) and applied that to APT-key and it's now working.

apt-key apparently lists the same signatures?! But it's working now.

Simon

[Joel Lisenby]

Anyone else having the following issue when trying to upgrade via apt in Ubuntu? 

The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13

===

Err:9 http://dl.google.com/linux/mod-pagespeed/deb stable Release.gpg
  The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>

===

All packages are up to date.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://dl.google.com/linux/mod-pagespeed/deb stable Release: The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>
W: Failed to fetch http://dl.google.com/linux/mod-pagespeed/deb/dists/stable/Release.gpg  The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>

W: Some index files failed to download. They have been ignored, or old ones used instead.

[Joshua Marantz]

I'm going to need to look into that.

In the meantime can you download the packages from top section of https://www.modpagespeed.com/doc/download ?

--

You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/89708e85-7ed9-47d5-b464-3a14b394cd18n%40googlegroups.com.

[stide...@gmail.com]

Yes, I'm seeing exactly the same error. I'm not sure when this began?

[Joshua Marantz]

Yes the problem is that Google is no longer officially driving the mod_pagespeed effort, the old download's signature has expired, 

and the signing infrastructure has evolved.

The latest release (1.14) was issued under the Apache Software Foundation and can be downloaded directly from  https://www.modpagespeed.com/doc/download . Can you switch to that?

--

You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/b66fefe6-1441-4275-964d-bce17b28eb44n%40googlegroups.com.

[Joel Lisenby]

Thank you @jmarantz, I have tried installing the *.deb archive from modpagespeed.com but I receive the following error:

sudo dpkg -i mod-pagespeed-apache-incubating-beta_1.14.36.1-r0_amd64.deb
dpkg-deb: error: 'mod-pagespeed-apache-incubating-beta_1.14.36.1-r0_amd64.deb' is not a Debian format archive
dpkg: error processing archive mod-pagespeed-apache-incubating-beta_1.14.36.1-r0_amd64.deb (--install):
 dpkg-deb --control subprocess returned error exit status 2
Errors were encountered while processing:
 mod-pagespeed-apache-incubating-beta_1.14.36.1-r0_amd64.deb

[stide...@gmail.com]

The download links here https://www.modpagespeed.com/doc/download send you to a web page (i.e. HTML, not DEB) with further instructions. The actual DEB can be found at https://dlcdn.apache.org/incubator/pagespeed.

[Joel Lisenby]

Ohhhh ... perhaps the URLs to those shouldn't have .tar.bz2 and .deb extensions? hahaha

[Otto van der Schaaf]

re:  perhaps the URLs to those shouldn't have .tar.bz2 and .deb extensions? hahaha

Oooh thanks for pointing that out!

Fixed: https://github.com/apache/incubator-pagespeed-website/commit/42a7b2e1e97ec5e2c200789f18727b66a5eca654

Otto