ATTENTION: Intel APT/deb feed for MKL is temporarily broken

[Kirill Katsnelson]

It seems that the maintainer did not renew the security key in the Intel MKL deb package feed, and the old one expired about 12 hours ago.

It is possible that other feeds are affected; I did not check really.

If you are attempting to install or upgrade MKL and see the following messages (using either the script tools/extra/install_mkl.sh or just running apt update), this is the problem.

$ sudo apt update
 . . .
Err:9 https://apt.repos.intel.com/mkl all InRelease
  The following signatures were invalid: EXPKEYSIG 1A8497B11911E097 "CN = Intel(R) Software Development Products", O=Intel Corporation
 . . .
Reading state information... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://apt.repos.intel.com/mkl all InRelease: The following signatures were invalid: EXPKEYSIG 1A8497B11911E097 "CN = Intel(R) Software Development Products", O=Intel Corporation
W: Failed to fetch https://apt.repos.intel.com/mkl/dists/all/InRelease  The following signatures were invalid: EXPKEYSIG 1A8497B11911E097 "CN = Intel(R) Software Development Products", O=Intel Corporation
W: Some index files failed to download. They have been ignored, or old ones used instead.

This is a serious blooper on their part, and I would be surprised if it's not fixed first thing on Monday. There is a workaround, but it's ugly, and I'd just wait out till the upload a new key.

I opened a support issue just in case, and duplicated in a message board post, which will hopefully updated when the problem is noted and fixed: https://software.intel.com/en-us/forums/intel-math-kernel-library/topic/821496

Check if the issue is fixed

Use the command from the above post; I highlighted the expiration date in bold red:

$ curl -Ss https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS-2019.PUB | gpg -
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2016-09-28 [SC] [expired: 2019-09-27]
      BF4385F91CA5FC005AB39E1C1A8497B11911E097
uid           "CN = Intel(R) Software Development Products", O=Intel Corporation

What to do after you confirm the new key is valid

1. If the problem happened while running our tools/extra/install_mkl.sh script, re-run it.

2. If you are upgrading MKL beyond the version installed with our script, update the key as follows  (you need a root prompt):

$ sudo -s
# curl -Ss https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS-2019.PUB | apt-key --keyring /usr/share/keyrings/intel-sw-products.gpg add -
#^D
$

3. If the MKL was installed by other means, you'll have to figure out where the keyring is. By default, Ubuntu/Debian lump all the keys together, so the above command will work if you omit the --keyring <arg> switch. You can confirm that this was the way MKL was installed originally by running

$ apt-key list

If you see the expired key with the the uid ' "CN = Intel(R) Software Development Products", O=Intel Corporation' among the output, this is the way to go.

You can use wget -qO- in place of curl -sS; both commands are equivalent.

If you really really need a workaround before it's fixed

Respond to this thread, and I'll explain how. But this involves weakenig your system security somewhat, and you'll have to undo it later. So best of all just wait out until Intel fixed the problem if you can.

If the problem also manifests itself with other feeds

Refer to the manual of your package manager (yum, zypper or dnf). I just do not have a ready answer. Post your findings here for the benefit of others.

 -kkm

[Kirill Katsnelson]

Note: The file name may be changed, I just realized there is '-2019' in the key file name. So either try your luck on Monday with -2020 (currently not available), or check the updated instructions that could name a different key URL.

 -kkm

[Антон Стаховский]

I was unable to install install MKL on friday using tools/extra/install_mkl.sh on CentOS. So i installed MKL from tarballs downloaded from Intel website https://software.intel.com/en-us/mkl (you need to register and login to get access to download page).

I used l_mkl_2019.2.187_online package for Docker installation. I installed it with ./install.sh --silent silent.cfg comand (you need to accept license first by editing ACCEPT_EULA=accept line in silent.cfg).

With default params my MKL installation takes about  2.5G which is not very pleasant.

I successfully installed Kaldi then and run some scripts. Everything seems to work fine.

воскресенье, 29 сентября 2019 г., 12:02:53 UTC+3 пользователь Kirill Katsnelson написал:

[Kirill Katsnelson]

The issue has been fixed, and the key file name in the URL did not change.

The new key's fingerprint is (52AB D6E8 7E42 1793 9718 73FF) ACFA 9FC5 7E6C 5DBE, and the expiration date 2023-09-30.

Please update the key as described in the original post ("What to do next...").

Since the key filename has not changed, the install_mkl.sh script does not need to be updated.

My understanding is the RPM feeds (for other package managers) have been updated too.