apt update fails NO_PUBKEY 6A030B21BA07F4FB

27,838 views
Skip to first unread message

Alessandro de Manzano

unread,
Apr 7, 2018, 4:17:46 AM4/7/18
to gce-discussion
Hi,

since few days all my Debian 9.x VMs are failing "apt update" because of an invalid signature key of Google Cloud repository, below the exact messages.

What should I do to resolve this problem ? Or it is Google's ?

Many thanks for any help

A. de Manzano
DQMicro




root@srv01:~# apt update


Ign:1 http://deb.debian.org/debian stretch InRelease


Hit:2 http://security.debian.org stretch/updates InRelease                        


Get:3 http://deb.debian.org/debian stretch-updates InRelease [91.0 kB]            


Get:4 http://deb.debian.org/debian stretch-backports InRelease [91.8 kB]


Hit:5 http://deb.debian.org/debian stretch Release                      


Hit:6 https://deb.nodesource.com/node_8.x stretch InRelease              


Get:7 http://packages.cloud.google.com/apt cloud-sdk-stretch InRelease [6,377 B]


Ign:8 https://download.arangodb.com/arangodb33/Debian_9.0  InRelease


Get:9 http://deb.debian.org/debian stretch-backports/main Sources.diff/Index [27.8 kB]


Get:10 http://deb.debian.org/debian stretch-backports/main amd64 Packages.diff/Index [27.8 kB]


Get:11 http://deb.debian.org/debian stretch-backports/main Sources 2018-04-07-0224.40.pdiff [325 B]


Get:11 http://deb.debian.org/debian stretch-backports/main Sources 2018-04-07-0224.40.pdiff [325 B]


Get:12 http://deb.debian.org/debian stretch-backports/main amd64 Packages 2018-04-07-0224.40.pdiff [267 B]


Get:12 http://deb.debian.org/debian stretch-backports/main amd64 Packages 2018-04-07-0224.40.pdiff [267 B]


Hit:13 https://download.arangodb.com/arangodb33/Debian_9.0  Release                              


Err:7 http://packages.cloud.google.com/apt cloud-sdk-stretch InRelease                                  


  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 6A030B21BA07F4FB


Get:16 http://packages.cloud.google.com/apt google-compute-engine-stretch-stable InRelease [3,843 B]


Err:16 http://packages.cloud.google.com/apt google-compute-engine-stretch-stable InRelease


  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 6A030B21BA07F4FB


Get:17 http://packages.cloud.google.com/apt google-cloud-packages-archive-keyring-stretch InRelease [3,876 B]


Err:17 http://packages.cloud.google.com/apt google-cloud-packages-archive-keyring-stretch InRelease


  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 6A030B21BA07F4FB


Fetched 239 kB in 1s (169 kB/s)


Reading package lists... Done


Building dependency tree      


Reading state information... Done


All packages are up to date.


W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://packages.cloud.google.com/apt cloud-sdk-stretch InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 6A030B21BA07F4FB


W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://packages.cloud.google.com/apt google-compute-engine-stretch-stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 6A030B21BA07F4FB


W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://packages.cloud.google.com/apt google-cloud-packages-archive-keyring-stretch InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 6A030B21BA07F4FB


W: Failed to fetch http://packages.cloud.google.com/apt/dists/cloud-sdk-stretch/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 6A030B21BA07F4FB


W: Failed to fetch http://packages.cloud.google.com/apt/dists/google-compute-engine-stretch-stable/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 6A030B21BA07F4FB


W: Failed to fetch http://packages.cloud.google.com/apt/dists/google-cloud-packages-archive-keyring-stretch/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 6A030B21BA07F4FB


W: Some index files failed to download. They have been ignored, or old ones used instead.



Navi Aujla (Google Cloud Support)

unread,
Apr 7, 2018, 1:41:42 PM4/7/18
to gce-discussion
Hello Alessandro, 

This is a known issue[1].

To resolve this error, obtain the latest valid apt-key.gpg key file from https://packages.cloud.google.com:

Alessandro de Manzano

unread,
Apr 7, 2018, 2:41:07 PM4/7/18
to gce-discussion
Hello,

many thanks BUT this does not resolve..

Now the message I get is:


Hit:1 http://security.debian.org stretch/updates InRelease


Ign:2 http://deb.debian.org/debian stretch InRelease                                              


Hit:3 http://deb.debian.org/debian stretch-updates InRelease                                      


Hit:4 http://deb.debian.org/debian stretch-backports InRelease                                                              


Hit:5 http://deb.debian.org/debian stretch Release                                                                          


Hit:6 http://packages.cloud.google.com/apt cloud-sdk-stretch InRelease                                                      


Hit:7 http://apt.postgresql.org/pub/repos/apt stretch-pgdg InRelease    


Hit:9 http://packages.cloud.google.com/apt google-cloud-compute-stretch InRelease


Err:9 http://packages.cloud.google.com/apt google-cloud-compute-stretch InRelease


  The following signatures were invalid: EXPKEYSIG 3746C208A7317B0F Google Cloud Packages Automatic Signing Key <gc-team@google.com>


Hit:10 http://packages.cloud.google.com/apt google-cloud-packages-archive-keyring-stretch InRelease


Hit:11 http://packages.cloud.google.com/apt google-compute-engine-stretch-stable InRelease


Reading package lists... Done


Building dependency tree      


Reading state information... Done


4 packages can be upgraded. Run 'apt list --upgradable' to see them.


W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://packages.cloud.google.com/apt google-cloud-compute-stretch InRelease: The following signatures were invalid: EXPKEYSIG 3746C208A7317B0F Google Cloud Packages Automatic Signing Key <gc-...@google.com>


W: Failed to fetch http://packages.cloud.google.com/apt/dists/google-cloud-compute-stretch/InRelease  The following signatures were invalid: EXPKEYSIG 3746C208A7317B0F Google Cloud Packages Automatic Signing Key <gc-...@google.com>


W: Some index files failed to download. They have been ignored, or old ones used instead.



I also listed all keys, and "apt-key del"eted the expired one, re-added the new with your solution and retried apt-update, no luck. Same message as above.


Where am I wrong ?

Many thanks!

Ale

Navi Aujla (Google Cloud Support)

unread,
Apr 7, 2018, 4:54:12 PM4/7/18
to gce-discussion
Hello Ale,

Can you try again re-adding the key using the following command and verify the key is not expired (sudo apt-key list):
If you still encounter any problem, I would suggest you to open an issue tracker report along with detailed information, so we can verify and investigate. 

Alessandro de Manzano

unread,
Apr 7, 2018, 5:09:27 PM4/7/18
to gce-discussion
Hello,

yep I tried many times on two of my machines, no luck.

I opened this issue: https://issuetracker.google.com/77688225  (yeah I know, I used another email address of mine, little mistake, but it's always me :-) )


Thanks for your kind help!
Hope this will help

Kind regards

A.de Manzano
DQMicro

Dnishchenko Denys

unread,
Jun 10, 2018, 1:35:02 PM6/10/18
to gce-discussion
Thank it helped me! But commands must be executed with `sudo`

shaun henderson

unread,
Jun 13, 2018, 8:50:11 AM6/13/18
to gce-discussion
I ran as root:
but the output is:

E: This command can only be used by root.
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1326  100  1326    0     0   1326      0  0:00:01 --:--:--  0:00:01 44200
(23) Failed writing body

Viktor Ryzhaiev

unread,
Jun 14, 2018, 3:18:57 PM6/14/18
to gce-discussion
You are running curl with sudo, which makes no sense. The actual command that makes changes to your system is apt-key, so it should be run with admin rights:

Musembi Nzioki

unread,
Jul 23, 2018, 2:45:34 PM7/23/18
to gce-discussion
(23) Failed writing body

is encountered when the piped command (apt-key add -) finishes executing and closes the pipe before curl has completed writing the whole page. To solve this precede the apt-key add command with a command that requires that curl finishes writing before it runs.i.e. curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | tac |tac | apt-key add -
tac is a simple Unix program that reads the entire input page and reverses the line order (hence we run it twice).

From: https://stackoverflow.com/questions/16703647/why-curl-return-and-error-23-failed-writing-body

On Wednesday, June 13, 2018 at 3:50:11 PM UTC+3, shaun henderson wrote:

Justin Reiners

unread,
Jul 23, 2018, 3:05:20 PM7/23/18
to Musembi Nzioki, gce-discussion
how about

sudo su -

--
© 2018 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043
 
Email preferences: You received this email because you signed up for the Google Compute Engine Discussion Google Group (gce-discussion@googlegroups.com) to participate in discussions with other members of the Google Compute Engine community and the Google Compute Engine Team.
---
You received this message because you are subscribed to the Google Groups "gce-discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to gce-discussion+unsubscribe@googlegroups.com.
To post to this group, send email to gce-discussion@googlegroups.com.
 To view this discussion on the web visit https://groups.google.com/d/msgid/gce-discussion/c7a3393c-7209-4069-bda6-5fca5677463c%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

Musembi Nzioki

unread,
Jul 23, 2018, 3:24:20 PM7/23/18
to Justin Reiners, gce-discussion
Yeah apt-key add requires sudo so: `curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | tac |tac | sudo apt-key add -`



Warm Regards,
Joseph Musembi

On Mon, Jul 23, 2018 at 10:05 PM, Justin Reiners <jus...@hotlinesinc.com> wrote:
how about

sudo su -
On Mon, Jul 23, 2018 at 1:41 PM, Musembi Nzioki <musemb...@gmail.com> wrote:
(23) Failed writing body

is encountered when the piped command (apt-key add -) finishes executing and closes the pipe before curl has completed writing the whole page. To solve this precede the apt-key add command with a command that requires that curl finishes writing before it runs.i.e. curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | tac |tac | apt-key add -
tac is a simple Unix program that reads the entire input page and reverses the line order (hence we run it twice).

From: https://stackoverflow.com/questions/16703647/why-curl-return-and-error-23-failed-writing-body

On Wednesday, June 13, 2018 at 3:50:11 PM UTC+3, shaun henderson wrote:
I ran as root:
but the output is:

E: This command can only be used by root.
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1326  100  1326    0     0   1326      0  0:00:01 --:--:--  0:00:01 44200
(23) Failed writing body

--
© 2018 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043
 
Email preferences: You received this email because you signed up for the Google Compute Engine Discussion Google Group (gce-discussion@googlegroups.com) to participate in discussions with other members of the Google Compute Engine community and the Google Compute Engine Team.
---
You received this message because you are subscribed to the Google Groups "gce-discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to gce-discussion+unsubscribe@googlegroups.com.
To post to this group, send email to gce-dis...@googlegroups.com.

Srinivas Adapa

unread,
Sep 8, 2018, 6:08:15 PM9/8/18
to gce-discussion
Thanks Viktor.. By adding sudo to the second command (Before apt-key) fixed my issue.

Thomas Stephenson

unread,
Apr 24, 2021, 9:26:36 AM4/24/21
to gce-discussion
Hello,

This is the first search result that shows up when searching for this error and I was banging my head against it for a couple of weeks...

The above only works when you have installed the GPG key on the default keyring for apt. If, however you are getting this error when the GPG keys are saved to a different keyring (e.g. if you added the keys following the official google documentation), then you will sill get the error. The correct command in this case would be

   curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -

Hope this helps somebody!

With regards,
Thomas Stephenson
Reply all
Reply to author
Forward
0 new messages