Cannot install on Ubuntu 24.10 due to weak/untrusted key

[fschoenm]

Describe the bug

On Ubuntu 24.10, jfrog-cli cannot be installed anymore as described on your download page (https://jfrog.com/getcli/) because the key algorithm (DSA-1024) is untrusted:

Get:7 https://releases.jfrog.io/artifactory/jfrog-debs xenial InRelease [4,675 B]
Err:7 https://releases.jfrog.io/artifactory/jfrog-debs xenial InRelease
  The following signatures were invalid: A3D085F542F740BBD7E3A2846B219DCCD7639232 (untrusted public key algorithm: dsa1024)
Warning: GPG error: https://releases.jfrog.io/artifactory/jfrog-debs xenial InRelease: The following signatures were invalid: A3D085F542F740BBD7E3A2846B219DCCD7639232 (untrusted public key algorithm: dsa1024)
Error: The repository 'https://releases.jfrog.io/artifactory/jfrog-debs xenial InRelease' is not signed.
Notice: Updating from such a repository can't be done securely, and is therefore disabled by default.
Notice: See apt-secure(8) manpage for repository creation and user configuration details.

Current behavior

Installation impossible from Ubuntu/Debian repo.

Reproduction steps

No response

Expected behavior

No response

JFrog CLI version

n/a

Operating system type and version

Ubuntu 24.10

JFrog Artifactory version

No response

JFrog Xray version

No response

[kellyschoenhofenge]

Same, 24.10, apt has dropped dsa1024. I believe NIST disallowed dsa1024 eleven years ago and it's been on apt's/canonical's deprecated list for years, it appears they finally followed through.

I read a bit on other companies in the same boat can "double sign", and it just takes a little work on our part to take the more secure key.

I'm willing to dumb-down my security for this, stupidly. Here's a workaround on 24.10:

sudo apt update # shows "untrusted public key algorithm: dsa1024"
sudo apt update --allow-insecure-repositories
sudo apt install jfrog-cli-v2-jf # success :(

[yarcod-zpt]

Stumbling on the same error here as well. Very hard to use the workaround mentioned above when jf is installed and setup in an automated fashion using Ansible (no support for that flag).

This should be of highest priority to solve!

[EyalDelarea]

Hey @fschoenm,

Thank you for reporting this issue!

We are currently working on updating the signing key to resolve this problem.
The fix will likely be included in the next release.

We’ll keep you updated here once it’s completed.

[EyalDelarea]

Hi @fschoenm,

We’ve recently updated the GPG keys, so this issue should now be resolved. 👍

Feel free to reach out if you encounter any further problems!

[sbingham-MET]

An important note that was not well communicated:

You will need to update the jfrog gpg key URLs as they changed with this PR: #2831

The GPG key URL has changed:
From https://releases.jfrog.io/artifactory/jfrog-gpg-public/jfrog_public_gpg.key

To two separate URLs for backward compatibility:
https://releases.jfrog.io/artifactory/api/v2/repositories/jfrog-rpms/keyPairs/primary/public
https://releases.jfrog.io/artifactory/api/v2/repositories/jfrog-rpms/keyPairs/secondary/public

We had our builds start to fail this morning due to this issue.

[EyalDelarea]

An important note that was not well communicated:

You will need to update the jfrog gpg key URLs as they changed with this PR: #2831

The GPG key URL has changed: From https://releases.jfrog.io/artifactory/jfrog-gpg-public/jfrog_public_gpg.key

To two separate URLs for backward compatibility: https://releases.jfrog.io/artifactory/api/v2/repositories/jfrog-rpms/keyPairs/primary/public https://releases.jfrog.io/artifactory/api/v2/repositories/jfrog-rpms/keyPairs/secondary/public

We had our builds start to fail this morning due to this issue.

Hi @sbingham-MET,

The old scripts should still work, as one of the new URLs points to the existing key.

Could you share the error message and any additional details? This will help us investigate the issue further.

Thank you!

[jm-paulin]

This is the error I got from apt update:

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://releases.jfrog.io/artifactory/jfrog-debs xenial InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DE70421F135DCA68
W: Failed to fetch https://releases.jfrog.io/artifactory/jfrog-debs/dists/xenial/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DE70421F135DCA68

I think the question is how do I change/migrate from the old/existing jfrog repository setup to the new one.

[sbingham-MET]

@EyalDelarea our error was basically the same as @jm-paulin starting on Monday.

34.42 W: GPG error: https://releases.jfrog.io/artifactory/jfrog-debs focal InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DE70421F135DCA68
34.42 E: The repository 'https://releases.jfrog.io/artifactory/jfrog-debs focal InRelease' is not signed.

We opened a support ticket Monday morning, but jfrog support is pretty slow so it didn't help us in time, but finding your PR linked to this issue helped. Once I changed the pub key URL to the new location it worked again.