Error message re: invalid signatures following interrupted BC install

[stefanabr...@gmail.com]

Hello,

I am trying to install BitCurator in VirtualBox. I was successfully able to follow these Quick Start Guide instructions for doing so, to the point of running "sudo bitcurator install"

My host computer's proxy (ZScaler) prevents the installation, and I'm able to disable it for 10-15 minutes before it comes back on again. "sudo bitcurator install" ran for about that period of time, before it was interrupted and failed. I rebooted the VM and attempted to run "sudo bitcurator install" again, but I get the following error message:

Command failed: apt-get update
W: https://download.docker.com/linux/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: GPG error: https://www.itforarchivists.com buster InRelease: The following signatures were invalid: EXPKEYSIG A702E58BD13BE0B5 Richard Lehane (siegfried) <ric...@itforarchivists.com>
E: The repository 'https://www.itforarchivists.com buster InRelease' is not signed.

Error: Command failed: apt-get update
W: https://download.docker.com/linux/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: GPG error: https://www.itforarchivists.com buster InRelease: The following signatures were invalid: EXPKEYSIG A702E58BD13BE0B5 Richard Lehane (siegfried) <ric...@itforarchivists.com>
E: The repository 'https://www.itforarchivists.com buster InRelease' is not signed.
    at ChildProcess.exithandler (child_process.js:303:12)
    at ChildProcess.emit (events.js:315:20)
    at maybeClose (internal/child_process.js:1021:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:286:5)

Try rebooting your system and trying the operation again.

I tried removing the key following these instructions for Siegfried/IT for Archivists, as well as using "apt-key del" for Docker, but now I'm getting this error:

An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://download.docker.com/linux/ubuntu jammy InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7EA0A9C3F273FCD8

W: GPG error: https://www.itforarchivists.com buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY A702E58BD13BE0B5

E: The repository 'https://www.itforarchivists.com buster InRelease' is not signed.

Is there a better way to handle an interrupted BitCurator install? Or away to get around the key issues?

Thanks in advance for any help you might be able to provide!

Stefana Breitwieser

[co...@digitalsleuth.ca]

Hi Stefana, let me take a look at this and see if something happened with the signing key!

[co...@digitalsleuth.ca]

Additionally, regarding your question at the end of your question (re: interrupted install), unfortunately this all depends on the issue itself. There are no real "key" issues, as the installation depends mainly on the source of the software being available, and that's more general than specific. The best that can be done is to do as you have, provide us the error message, and we can help identify the cause and prevent it from occurring again. I'm running some tests now and will hopefully get back to you with some answers.

Cheers!

[co...@digitalsleuth.ca]

Hi Stefana, it appears that the signing key for the siegfried package has expired and has not yet been renewed (https://github.com/richardlehane/siegfried/issues/249). In the meantime, I can come up with a temporary solution to allow siegfried to be installed while we wait for the key to be updated.

[Kam Woods]

Corey's fix for this issue has been applied and an updated release of BitCurator (4.4.5) is now available.

Kam

[stefanabr...@gmail.com]

Thank you both for this fix -- I really appreciate it! Hoping to test further this week and will circle back if needed.

Thanks again,

Stefana