Debian `apt update` GPG error The following signatures were invalid: EXPKEYSIG EFFAF4443CE9AD84 Iterative <eng@iterative.ai>

[DKAndreasen]

Bug Report

I have installed DVC following dvc.org | Docs | Install from repository | On Debian/Ubuntu.

When I want to update DVC I run sudo apt update but it fails to update from the repository

Get:9 https://s3-us-east-2.amazonaws.com/dvc-s3-repo/deb stable InRelease [2,679 B]
Err:9 https://s3-us-east-2.amazonaws.com/dvc-s3-repo/deb stable InRelease

  The following signatures were invalid: EXPKEYSIG EFFAF4443CE9AD84 Iterative <eng@iterative.ai>

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://s3-us-east-2.amazonaws.com/dvc-s3-repo/deb stable InRelease: The following signatures were invalid: EXPKEYSIG EFFAF4443CE9AD84 Iterative <eng@iterative.ai>
W: Failed to fetch https://dvc.org/deb/dists/stable/InRelease  The following signatures were invalid: EXPKEYSIG EFFAF4443CE9AD84 Iterative <eng@iterative.ai>
W: Some index files failed to download. They have been ignored, or old ones used instead.

So it seems to me that your GPG key have expired.

I have tried to update the key by running

wget -qO - https://dvc.org/deb/iterative.asc | sudo gpg --dearmor -o /etc/apt/keyrings/packages.iterative.gpg

and ensure that it the gpg file still have mode 644, but it doesnt work.

Environment information

Output of dvc doctor:

DVC version: 3.59.0 (deb)
-------------------------
Platform: Python 3.12.7 on Linux-5.15.153.1-microsoft-standard-WSL2-x86_64-with-glibc2.36
Subprojects:

Supports:
        azure (adlfs = 2024.12.0, knack = 0.12.0, azure-identity = 1.19.0),
        gdrive (pydrive2 = 1.21.3),
        gs (gcsfs = 2024.12.0),
        hdfs (fsspec = 2024.12.0, pyarrow = 18.1.0),
        http (aiohttp = 3.11.11, aiohttp-retry = 2.9.1),
        https (aiohttp = 3.11.11, aiohttp-retry = 2.9.1),
        oss (ossfs = 2023.12.0),
        s3 (s3fs = 2024.12.0, boto3 = 1.35.93),
        ssh (sshfs = 2024.9.0),
        webdav (webdav4 = 0.10.0),
        webdavs (webdav4 = 0.10.0),
        webhdfs (fsspec = 2024.12.0)
Config:
        Global: ~/.config/dvc
        System: /etc/xdg/dvc
Cache types: hardlink, symlink
Cache directory: ext4 on /dev/sdc
Caches: local
Remotes: s3
Workspace directory: ext4 on /dev/sdc
Repo: dvc, git
Repo.site_cache_dir: /var/tmp/dvc/repo/83f466a3274e4e21df73127bf8e7c5cb

You are using dvc version 3.59.0; however, version 3.59.1 is available.
To upgrade, run 'apt-get install --only-upgrade dvc'.

Just to make it clear, eventhough dvc doctor acknowlegdes that an upgrade is available then

sudo apt-get install --only-upgrade dvc

dvc is already the newest version (3.59.0)

[skshetry]

I think you were following older version of installation script. That'd keep the key packages.iterative.gpg in /etc/apt/trusted.gpg.d/.

So, I think this would work:

wget -qO - https://dvc.org/deb/iterative.asc | gpg --dearmor > packages.iterative.gpg
sudo install -o root -g root -m 644 packages.iterative.gpg /etc/apt/trusted.gpg.d/
sudo apt-get install --only-upgrade dvc

That said, I recommend following the current installation script from https://dvc.org/doc/install/linux#from-repo-on-debian-ubuntu, as the old installation script was adding a key to be trusted by apt for all packages from any repositories (see treeverse/dvc.org#5350).

[skshetry]

Related: #10698.

[DKAndreasen]

Thank you for your suggestion @skshetry, the gpg-key was already in the location specified from https://dvc.org/doc/install/linux#from-repo-on-debian-ubuntu being /etc/apt/keyrings/packages.iterative.gpg, but it turned out that the apt repo list, /etc/apt/sources.list.d/dvc.list, was outdated. It contained the string deb [trusted=yes] https://dvc.org/deb/ stable main, which according to the install note needs to be

deb [arch=amd64 signed-by=/etc/apt/keyrings/packages.iterative.gpg] https://dvc.org/deb/ stable main

Fixing this, solved the issue for me