mod-pagespeed signature verification failure

3360 views
Skip to first unread message

Stephen Reese

unread,
Oct 28, 2015, 10:57:12 PM10/28/15
to mod-pagesp...@googlegroups.com
I am receiving the following signature error when running $ sudo apt-get update on a Debian 8.2

Reading package lists... Done
W: An error occurred during the signature verification. The repository
is not updated and the previous index files will be used. GPG error:
http://dl.google.com stable Release: The following signatures were
invalid: BADSIG A040830F7FAC5991 Google, Inc. Linux Package Signing
Key <linux-packages-keymaster@google.com>

W: Failed to fetch
http://dl.google.com/linux/mod-pagespeed/deb/dists/stable/Release

W: Some index files failed to download. They have been ignored, or old
ones used instead
.

Here's what I have for a source:
$ more /etc/apt/sources.list.d/mod-pagespeed.list
### THIS FILE IS AUTOMATICALLY CONFIGURED ###
# You may comment out this entry, but any other modifications may be lost.
deb http://dl.google.com/linux/mod-pagespeed/deb/ stable main


After trying to clean the repo per http://stackoverflow.com/a/13392695 I get:
W: GPG error: http://dl.google.com stable Release: The following
signatures were invalid: BADSIG A040830F7FAC5991 Google, Inc. Linux
Package Signing Key <linux-packages-keymaster@google.com>


I tried updating the key per https://www.google.com/linuxrepositories/ and reinstalling the package but still see the same error.

Any thoughts?

ii  mod-pagespeed-beta             1.9.32.10-r7423               amd64        Apache 2 module to optimize web content.


Thanks,
Stephen

Jeffrey Crowell

unread,
Oct 29, 2015, 9:24:10 AM10/29/15
to mod-pagespeed-discuss
can you provide the output of 

sudo apt-key list

Are you on the beta channel trying to update your beta package?

Thanks,
Jeff

Stephen Reese

unread,
Oct 29, 2015, 9:35:41 AM10/29/15
to mod-pagesp...@googlegroups.com
I assume I have been on the beta channel as I have always had the beta package installed. Never noticed this error until recent but my update script only notifies me when a new package is available so I cannot confirm how long this has been an issue.

Thanks,
Stephen

$ sudo apt-key list
/etc/apt/trusted.gpg
--------------------
pub   4096R/C4DEFFEB 2010-09-08 [expires: 2020-09-05]
uid                  varnish-cache.org repository key <sysa...@varnish-software.com>

pub   2048R/7BD9BF62 2011-08-19 [expires: 2016-08-17]
uid                  nginx signing key <signi...@nginx.com>

pub   2048R/1BE7A449 2013-12-25
uid                  Paul Tarjan <p...@fb.com>
sub   2048R/452A652F 2013-12-25

pub   1024D/7FAC5991 2007-03-08
uid                  Google, Inc. Linux Package Signing Key <linux-packag...@google.com>
sub   2048g/C07CB649 2007-03-08

/etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
----------------------------------------------------------
pub   4096R/2B90D010 2014-11-21 [expires: 2022-11-19]
uid                  Debian Archive Automatic Signing Key (8/jessie) <ftpm...@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
-------------------------------------------------------------------
pub   4096R/C857C906 2014-11-21 [expires: 2022-11-19]
uid                  Debian Security Archive Automatic Signing Key (8/jessie) <ftpm...@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
-------------------------------------------------------
pub   4096R/518E17E1 2013-08-17 [expires: 2021-08-15]
uid                  Jessie Stable Release Key <debian-...@lists.debian.org>

/etc/apt/trusted.gpg.d/debian-archive-squeeze-automatic.gpg
-----------------------------------------------------------
pub   4096R/473041FA 2010-08-27 [expires: 2018-03-05]
uid                  Debian Archive Automatic Signing Key (6.0/squeeze) <ftpm...@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-squeeze-stable.gpg
--------------------------------------------------------
pub   4096R/B98321F9 2010-08-07 [expires: 2017-08-05]
uid                  Squeeze Stable Release Key <debian-...@lists.debian.org>

/etc/apt/trusted.gpg.d/debian-archive-wheezy-automatic.gpg
----------------------------------------------------------
pub   4096R/46925553 2012-04-27 [expires: 2020-04-25]
uid                  Debian Archive Automatic Signing Key (7.0/wheezy) <ftpm...@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-wheezy-stable.gpg
-------------------------------------------------------
pub   4096R/65FFB764 2012-05-08 [expires: 2019-05-07]
uid                  Wheezy Stable Release Key <debian-...@lists.debian.org>


--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/a8c2b5aa-db9e-41a0-8625-584ea8dc4750%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Diego Pastore

unread,
Oct 29, 2015, 9:39:13 AM10/29/15
to mod-pagespeed-discuss
Same issue for me!

Diego Pastore

unread,
Oct 29, 2015, 9:53:42 AM10/29/15
to mod-pagespeed-discuss
Google pagespeed debian repo (http://dl.google.com/linux/mod-pagespeed/deb/) now 404 error.

Any news?

Jeffrey Crowell

unread,
Oct 29, 2015, 9:54:59 AM10/29/15
to mod-pagespeed-discuss
looking into it now, thanks for the report.

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

Jeffrey Crowell

unread,
Oct 29, 2015, 11:50:45 AM10/29/15
to mod-pagespeed-discuss
issue should be resolved. please retry.

Thanks,
Jeff

Diego Pastore

unread,
Oct 29, 2015, 12:00:35 PM10/29/15
to mod-pagespeed-discuss
Hi Jeff,

signature error resolved, but 404 on repository url don't.

Thanks,
Diego.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-discuss+unsub...@googlegroups.com.

Jeffrey Crowell

unread,
Oct 29, 2015, 12:30:09 PM10/29/15
to mod-pagespeed-discuss
what are you trying to access? The .deb files are available by direct link.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/3e52b362-cae7-4915-9241-33d50b57a65c%40googlegroups.com.

Stephen Reese

unread,
Oct 29, 2015, 1:31:03 PM10/29/15
to mod-pagesp...@googlegroups.com
Issue resolved, thanks Jeff!

-Stephen

Jeffrey Crowell

unread,
Oct 30, 2015, 12:20:42 AM10/30/15
to mod-pagespeed-discuss
Diego,

That 404 on the raw directory is the intended behavior.

What file(s) are you trying to download?

Jeff

Diego Pastore

unread,
Oct 30, 2015, 3:53:26 AM10/30/15
to mod-pagespeed-discuss
Hi Jeff,

I tried on raw directory, because normally debian repo show files, I don't know on Google repo, 404 on raw dir is the intended behavior.

Anyway, issue resolved!

Thanks,
Diego.

Пламен Василев

unread,
Jan 28, 2020, 4:15:19 PM1/28/20
to mod-pagespeed-discuss
Hello, I have same issue on Debian 9:

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://dl.google.com/linux/mod-pagespeed/deb stable Release: The following signatures were invalid: EXPKEYSIG 6494C6D6997C215E Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>
W: Failed to fetch http://dl.google.com/linux/mod-pagespeed/deb/dists/stable/Release.gpg  The following signatures were invalid: EXPKEYSIG 6494C6D6997C215E Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>

W: Some index files failed to download. They have been ignored, or old ones used instead.
Reading package lists... Done


I trying to add key again from article:

Google keys from apt-key list:

pub   dsa1024 2007-03-08 [SC]
      4CCA 1EAF 950C EE4A B839  76DC A040 830F 7FAC 5991
uid           [ unknown] Google, Inc. Linux Package Signing Key <linux-packag...@google.com>
sub   elg2048 2007-03-08 [E]

pub   rsa4096 2016-04-12 [SC]
      EB4C 1BFD 4F04 2F6D DDCC  EC91 7721 F63B D38B 4796
uid           [ unknown] Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>
sub   rsa4096 2019-07-22 [S] [expires: 2022-07-21]

Carlos Alberto Martínez Gadea

unread,
Feb 10, 2020, 2:32:06 AM2/10/20
to mod-pagespeed-discuss
Same here on Ubuntu 18.04

SUNIL GUPTA

unread,
Feb 10, 2020, 6:27:11 AM2/10/20
to mod-pagesp...@googlegroups.com
CLOSE EMAIL

On Mon, Feb 10, 2020 at 1:02 PM Carlos Alberto Martínez Gadea <carlosmar...@gmail.com> wrote:
Same here on Ubuntu 18.04

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/248a643c-1caf-43ca-914a-0e0491a60677%40googlegroups.com.

SUNIL GUPTA

unread,
Feb 10, 2020, 6:27:23 AM2/10/20
to mod-pagesp...@googlegroups.com
STOP EMAIL

Simon Tideswell

unread,
Feb 10, 2020, 6:29:40 AM2/10/20
to mod-pagespeed-discuss
Hello

Is this a CDN issue? It may be relevant which region of the World the affected parties are in. I'm in Australia, how about everyone else? For me dl.google.com currently resolves to 216.58.196.142 (USA). Another host on a different ISP resolves this to 216.58.199.46 (USA). I've not had the chance to test APT from this second place, but may try tomorrow. I have experienced the issue from 2 separate data centres (Brisbane and Sydney).

Simon

Carlos Alberto Martínez Gadea

unread,
Feb 10, 2020, 6:44:10 AM2/10/20
to mod-pagesp...@googlegroups.com
It resolves to 172.217.17.14 in my case and I'm in Spain.

Missatge de Simon Tideswell <stide...@gmail.com> del dia dl., 10 de febr. 2020 a les 12:29:
--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

Simon Tideswell

unread,
Feb 10, 2020, 8:44:53 PM2/10/20
to mod-pagespeed-discuss
OK, thanks, given that we are separated geographically by so much distance I don't think a CDN issue is a likely cause.
Simon
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-discuss+unsub...@googlegroups.com.

Longinos

unread,
Feb 11, 2020, 3:17:55 AM2/11/20
to mod-pagespeed-discuss

SUNIL GUPTA

unread,
Feb 11, 2020, 5:36:38 AM2/11/20
to mod-pagesp...@googlegroups.com
stop email

Simon
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/49c33fd7-bb89-4984-9935-ba3a8bc327c8%40googlegroups.com.

Longinos

unread,
Feb 11, 2020, 2:11:04 PM2/11/20
to mod-pagespeed-discuss

Simon Tideswell

unread,
Feb 12, 2020, 2:07:26 AM2/12/20
to mod-pagespeed-discuss
Yes, I've downloaded a fresh copy of linux_signing_key.pub (which is ~2k larger, and has md5 6d5a8b0b20b68757386be840f9c701ae) and applied that to APT-key and it's now working.

apt-key apparently lists the same signatures?! But it's working now.

Simon

Joel Lisenby

unread,
Jul 26, 2022, 6:35:21 PMJul 26
to mod-pagespeed-discuss
Anyone else having the following issue when trying to upgrade via apt in Ubuntu? 

The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13

===

Err:9 http://dl.google.com/linux/mod-pagespeed/deb stable Release.gpg
  The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>


===

All packages are up to date.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://dl.google.com/linux/mod-pagespeed/deb stable Release: The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>
W: Failed to fetch http://dl.google.com/linux/mod-pagespeed/deb/dists/stable/Release.gpg  The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <linux-packag...@google.com>

W: Some index files failed to download. They have been ignored, or old ones used instead.

Joshua Marantz

unread,
Jul 26, 2022, 6:37:39 PMJul 26
to mod-pagesp...@googlegroups.com
I'm going to need to look into that.

In the meantime can you download the packages from top section of https://www.modpagespeed.com/doc/download ?

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/89708e85-7ed9-47d5-b464-3a14b394cd18n%40googlegroups.com.

stide...@gmail.com

unread,
Aug 4, 2022, 11:05:06 PMAug 4
to mod-pagespeed-discuss
Yes, I'm seeing exactly the same error. I'm not sure when this began?

Joshua Marantz

unread,
Aug 5, 2022, 8:36:15 AMAug 5
to mod-pagesp...@googlegroups.com
Yes the problem is that Google is no longer officially driving the mod_pagespeed effort, the old download's signature has expired, 
and the signing infrastructure has evolved.

The latest release (1.14) was issued under the Apache Software Foundation and can be downloaded directly from  https://www.modpagespeed.com/doc/download . Can you switch to that?


--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/b66fefe6-1441-4275-964d-bce17b28eb44n%40googlegroups.com.

Joel Lisenby

unread,
Aug 5, 2022, 12:11:37 PMAug 5
to mod-pagespeed-discuss
Thank you @jmarantz, I have tried installing the *.deb archive from modpagespeed.com but I receive the following error:

sudo dpkg -i mod-pagespeed-apache-incubating-beta_1.14.36.1-r0_amd64.deb
dpkg-deb: error: 'mod-pagespeed-apache-incubating-beta_1.14.36.1-r0_amd64.deb' is not a Debian format archive
dpkg: error processing archive mod-pagespeed-apache-incubating-beta_1.14.36.1-r0_amd64.deb (--install):
 dpkg-deb --control subprocess returned error exit status 2
Errors were encountered while processing:
 mod-pagespeed-apache-incubating-beta_1.14.36.1-r0_amd64.deb


stide...@gmail.com

unread,
Aug 5, 2022, 6:41:18 PMAug 5
to mod-pagespeed-discuss
The download links here https://www.modpagespeed.com/doc/download send you to a web page (i.e. HTML, not DEB) with further instructions. The actual DEB can be found at https://dlcdn.apache.org/incubator/pagespeed.

Joel Lisenby

unread,
Aug 5, 2022, 7:12:49 PMAug 5
to mod-pagespeed-discuss
Ohhhh ... perhaps the URLs to those shouldn't have .tar.bz2 and .deb extensions? hahaha

Otto van der Schaaf

unread,
Aug 5, 2022, 7:39:49 PMAug 5
to mod-pagespeed-discuss
re:  perhaps the URLs to those shouldn't have .tar.bz2 and .deb extensions? hahaha

Oooh thanks for pointing that out!

Otto
Reply all
Reply to author
Forward
0 new messages