@mwt repo apt update error: `NO_PUBKEY 7FC979028B1997C1`

[0nobody0]

Operating System/Distribution

Ubuntu 24.04.3

Installer

apt repo mirror https://mirror.mwt.me/shiftkey-desktop/deb/ any main

What happened?

After reviewing #1062 and #1265 about the https://apt.packages.shiftkey.dev certificate error, I attempted to configure the @mwt mirror repo with:

wget -qO - https://mirror.mwt.me/shiftkey-desktop/gpgkey | gpg --dearmor | sudo tee /usr/share/keyrings/mwt-desktop.gpg > /dev/null
sudo sh -c 'echo "deb [arch=amd64 signed-by=/usr/share/keyrings/mwt-desktop.gpg] https://mirror.mwt.me/shiftkey-desktop/deb/ any main" > /etc/apt/sources.list.d/mwt-desktop.list'

sudo apt update then returns this error:

Err:2 https://mirror.mwt.me/shiftkey-desktop/deb any InRelease             
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7FC979028B1997C1
...
Reading package lists... Done
W: GPG error: https://mirror.mwt.me/shiftkey-desktop/deb any InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7FC979028B1997C1

Any help is greatly appreciated.

[mwt]

Could you try looking at /usr/share/keyrings/mwt-desktop.gpg and see that the file is present and looks like a real gpg key?

Edit: if you can't get that to work, could you try

sudo rm '/etc/apt/sources.list.d/mwt-desktop.list' '/usr/share/keyrings/mwt-desktop.gpg'
wget -qO- 'https://mirror.mwt.me/shiftkey-desktop/install.sh' | sudo -s

[0nobody0]

thanks for the mirror and the quick reply!

sudo cat /usr/share/keyrings/mwt-desktop.gpg:

�3c�e�	+�G@V�[�4�(�p�a��J큲+�ȥ��vz��/S�-Brendan Forster <packages@brendanforster.com>��
>!N�V���
H�y���c�e�		�
                         	
	
       �
	�y������(s��k� /N6�ٻ�~O	���*o�!��	{
                                                 !s�S,E��K-N�:��D���ꗰoﻀi+/�8c�e�
+�U@V�" L����Ԗ!��iR	.�6���Ƀ���~
&!N�V���
H�y���c�e�
          		�
	�y���Ǣ�k�p��M������
                           B�gd`������4{��f�Et
�;	N0���l��]g�;$g,�u�%�d

sudo cat /usr/share/keyrings/mwt-desktop.gpg | gpg --with-colons --import-options show-only --import:

pub:-:255:22:7FC979028B1997C1:1676830120:1834510120::-:::scESC:::::ed25519:::0:
fpr:::::::::4E02A356A18314B00A481F067FC979028B1997C1:
uid:-::::1676830120::610BC0739A460FB6744ED2B8E6182543C30251ED::Brendan Forster <packages@brendanforster.com>::::::::::0:
sub:-:255:18:DE58E9B416EB1F95:1676830120:1834510120:::::e:::::cv25519::
fpr:::::::::1129443175FCDCFFC0008F3EDE58E9B416EB1F95:

i also checked that wget -qO - https://mirror.mwt.me/shiftkey-desktop/gpgkey returns the expected key before being piped to gpg --dearmor:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEY/JlqBYJKwYBBAHaRw8BAQdAVplbujSODiiIcIxhg+xK7YGyK4nIpY/ZdnqL
yi8SHVO0LUJyZW5kYW4gRm9yc3RlciA8cGFja2FnZXNAYnJlbmRhbmZvcnN0ZXIu
Y29tPoiWBBMWCgA+FiEETgKjVqGDFLAKSB8Gf8l5AosZl8EFAmPyZagCGwMFCQlm
AYAFCwkIBwMFFQoJCAsFFgMCAQACHgECF4AACgkQf8l5AosZl8EbYAEAouvPKHOb
zmvBIC9ONp3Zu69+Tx8JoKrfKm+zIfuTCXsBAMKEIXP9UyxF191LLU7aOrXVRJ2y
8uqXsG/vu4BpKy8DuDgEY/JlqBIKKwYBBAGXVQEFAQEHQFbHIiBMgeWt9/3UlhAE
IZS+aVIRCS73Nr+Io8mDjZUkAwEIB4h+BBgWCgAmFiEETgKjVqGDFLAKSB8Gf8l5
AosZl8EFAmPyZagCGwwFCQlmAYAACgkQf8l5AosZl8HHogEArWvwl3DRFr9NiPL1
wv/zC0KaZ2Rg0heEwACmGtg0e9cBAJhm7kV0Cvg7CU4w8sfabNXiXWelOyRnLPR1
pX8lwGQE
=Hv1H
-----END PGP PUBLIC KEY BLOCK-----

i ran

sudo rm '/etc/apt/sources.list.d/mwt-desktop.list' '/usr/share/keyrings/mwt-desktop.gpg'
wget -qO- 'https://mirror.mwt.me/shiftkey-desktop/install.sh' | sudo -s

and verified that /etc/apt/sources.list.d/shiftkey-desktop.list and /etc/apt/keyrings/shiftkey-desktop.asc were created. sudo apt update now returns:

Err:1 https://mirror.mwt.me/shiftkey-desktop/deb any InRelease                                                               
  Unknown error executing apt-key
...
W: GPG error: https://mirror.mwt.me/shiftkey-desktop/deb any InRelease: Unknown error executing apt-key
E: The repository 'https://mirror.mwt.me/shiftkey-desktop/deb any InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Edit: Added sudo cat /usr/share/keyrings/mwt-desktop.gpg | gpg --with-colons --import-options show-only --import above.

[mwt]

Strange. I'm running the same version of Ubuntu and it is signed for me. The InRelease file that it's saying isn't signed is the following:

https://mirror.mwt.me/shiftkey-desktop/deb/dists/any/InRelease

Which is definitely signed. Is this file maybe blocked for you? What happens if you curl it?

[0nobody0]

pardon the confusion - user error. somehow umask was set to 077 which resulted in the keyfile having the wrong permissions:

-rw------- 1 root root  438 Sep 11 11:02 mwt-desktop.gpg

sudo apt update works fine after fixing the permissions with sudo chmod 644 /usr/share/mwt-desktop.gpg:

-rw-r--r-- 1 root root  438 Sep 11 11:02 mwt-desktop.gpg

[mwt]

Interesting. I guess apt doesn't use root when reading the key. I didn't know that.