Apt updates failing with "The following signatures were invalid"

Virtualmin
1
SYSTEM INFORMATION
OS type and version Ubuntu Linux 20.04.6
Webmin version 2.105
Virtualmin version 7.9.0 Pro

Updates worked fine last time we ran them about 3 months ago, but now we get an error saying the signature is invalid.

Output of apt update:

Hit:1 http://se.archive.ubuntu.com/ubuntu focal InRelease
Hit:2 http://se.archive.ubuntu.com/ubuntu focal-updates InRelease
Hit:3 https://artifacts.elastic.co/packages/8.x/apt stable InRelease
Hit:4 http://se.archive.ubuntu.com/ubuntu focal-backports InRelease
Hit:5 http://se.archive.ubuntu.com/ubuntu focal-security InRelease
Hit:6 http://software.virtualmin.com/vm/6/apt virtualmin-focal InRelease
Hit:7 http://software.virtualmin.com/vm/6/apt virtualmin-universal InRelease
Err:6 http://software.virtualmin.com/vm/6/apt virtualmin-focal InRelease
  The following signatures were invalid: EXPKEYSIG D9F9010760D62A6B Virtualmin, Inc. (Package signing key for Virtualmin 6) <security@virtualmin.com>
Err:7 http://software.virtualmin.com/vm/6/apt virtualmin-universal InRelease
  The following signatures were invalid: EXPKEYSIG D9F9010760D62A6B Virtualmin, Inc. (Package signing key for Virtualmin 6) <security@virtualmin.com>
Reading package lists... Done
Building dependency tree
Reading state information... Done
93 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://software.virtualmin.com/vm/6/apt virtualmin-focal InRelease: The following signatures were invalid: EXPKEYSIG D9F9010760D62A6B Virtualmin, Inc. (Package signing key for Virtualmin 6) <security@virtualmin.com>
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://software.virtualmin.com/vm/6/apt virtualmin-universal InRelease: The following signatures were invalid: EXPKEYSIG D9F9010760D62A6B Virtualmin, Inc. (Package signing key for Virtualmin 6) <security@virtualmin.com>
W: Failed to fetch http://software.virtualmin.com/vm/6/apt/dists/virtualmin-focal/InRelease  The following signatures were invalid: EXPKEYSIG D9F9010760D62A6B Virtualmin, Inc. (Package signing key for Virtualmin 6) <security@virtualmin.com>
W: Failed to fetch http://software.virtualmin.com/vm/6/apt/dists/virtualmin-universal/InRelease  The following signatures were invalid: EXPKEYSIG D9F9010760D62A6B Virtualmin, Inc. (Package signing key for Virtualmin 6) <security@virtualmin.com>
W: Some index files failed to download. They have been ignored, or old ones used instead.

Output of: virtualmin setup-repos

Setting up Virtualmin software repositories ..
..error : Hit:1 http://se.archive.ubuntu.com/ubuntu focal InRelease Hit:2
http://se.archive.ubuntu.com/ubuntu focal-updates InRelease Hit:3
https://artifacts.elastic.co/packages/8.x/apt stable InRelease Hit:4
http://se.archive.ubuntu.com/ubuntu focal-backports InRelease Hit:5
http://se.archive.ubuntu.com/ubuntu focal-security InRelease Get:6
https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease [10.7 kB] Err:6
https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease The following signatures couldn't
be verified because the public key is not available: NO_PUBKEY 3E570892B9A0B8B7 Reading package
lists. W: GPG error: https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease: The following
signatures couldn't be verified because the public key is not available: NO_PUBKEY
3E570892B9A0B8B7 E: The repository 'https://software.virtualmin.com/vm/7/pro/apt virtualmin
InRelease' is not signed. Downloading repository metadata: [2024-06-04 09:01:03 CEST] Failed with
error: 100 [2024-06-04 09:01:03 CEST] Something went wrong. Exiting.

Running apt update again after, it has changed to the v7 repos but same error (different key)

Hit:1 http://se.archive.ubuntu.com/ubuntu focal InRelease
Hit:2 http://se.archive.ubuntu.com/ubuntu focal-updates InRelease
Hit:3 https://artifacts.elastic.co/packages/8.x/apt stable InRelease
Hit:4 http://se.archive.ubuntu.com/ubuntu focal-backports InRelease
Get:5 https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease [10.7 kB]
Hit:6 http://se.archive.ubuntu.com/ubuntu focal-security InRelease
Err:5 https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3E570892B9A0B8B7
Reading package lists... Done
W: GPG error: https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3E570892B9A0B8B7
E: The repository 'https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details

Output of: apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3E570892B9A0B8B7

Executing: /tmp/apt-key-gpghome.f4WFzt6Rk9/gpg.1.sh --keyserver keyserver.ubuntu.com --recv-keys 3E570892B9A0B8B7
gpg: keyserver receive failed: No data
2

Hello,

Run the following command on your system to fix Virtualmin repository:

virtualmin setup-repos
1 Like
3 
Setting up Virtualmin software repositories ..
..error : Hit:1 http://se.archive.ubuntu.com/ubuntu focal InRelease Hit:2
http://se.archive.ubuntu.com/ubuntu focal-updates InRelease Hit:3
https://artifacts.elastic.co/packages/8.x/apt stable InRelease Hit:4
http://se.archive.ubuntu.com/ubuntu focal-backports InRelease Hit:5
http://se.archive.ubuntu.com/ubuntu focal-security InRelease Get:6
https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease [10.7 kB] Err:6
https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease The following signatures couldn't
be verified because the public key is not available: NO_PUBKEY 3E570892B9A0B8B7 Reading package
lists. W: GPG error: https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease: The following
signatures couldn't be verified because the public key is not available: NO_PUBKEY
3E570892B9A0B8B7 E: The repository 'https://software.virtualmin.com/vm/7/pro/apt virtualmin
InRelease' is not signed. Downloading repository metadata: [2024-06-04 09:01:03 CEST] Failed with
error: 100 [2024-06-04 09:01:03 CEST] Something went wrong. Exiting.
4

Try running:

rm -f /etc/apt/sources.list.d/virtualmin.list

then

apt-get clean && apt-get update

Does it work?

If it does then run:

virtualmin setup-repos
5

Hi,
The first 2 commands produced no errors, however virtualmin setup-repos still produces an error:

Setting up Virtualmin software repositories ..
..error : Hit:1 http://se.archive.ubuntu.com/ubuntu focal InRelease Hit:2
https://artifacts.elastic.co/packages/8.x/apt stable InRelease Hit:3
http://se.archive.ubuntu.com/ubuntu focal-updates InRelease Hit:4
http://se.archive.ubuntu.com/ubuntu focal-backports InRelease Hit:5
http://se.archive.ubuntu.com/ubuntu focal-security InRelease Get:6
https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease [10.7 kB] Err:6
https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease The following signatures couldn't
be verified because the public key is not available: NO_PUBKEY 3E570892B9A0B8B7 Reading package
lists. W: GPG error: https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease: The following
signatures couldn't be verified because the public key is not available: NO_PUBKEY
3E570892B9A0B8B7 E: The repository 'https://software.virtualmin.com/vm/7/pro/apt virtualmin
InRelease' is not signed. Downloading repository metadata: [2024-06-10 12:01:03 CEST] Failed with
error: 100 [2024-06-10 12:01:03 CEST] Something went wrong. Exiting.
6

That’s an unusual error! What is the output of the following command:

apt-key list
7 
/etc/apt/trusted.gpg
--------------------
pub   rsa4096 2017-05-01 [SC] [expired: 2024-04-29]
      E36F 0664 7D8E BD2B E364  2BCE D9F9 0107 60D6 2A6B
uid           [ expired] Virtualmin, Inc. (Package signing key for Virtualmin 6) <security@virtualmin.com>

pub   dsa1024 2002-02-28 [SCA]
      1719 003A CE3E 5A41 E2DE  70DF D97A 3AE9 11F6 3C51
uid           [ unknown] Jamie Cameron <jcameron@webmin.com>
sub   elg1024 2002-02-28 [E]

/etc/apt/trusted.gpg.d/ubuntu-keyring-2012-archive.gpg
------------------------------------------------------
pub   rsa4096 2012-05-11 [SC]
      790B C727 7767 219C 42C8  6F93 3B4F E6AC C0B2 1F32
uid           [ unknown] Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>

/etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg
------------------------------------------------------
pub   rsa4096 2012-05-11 [SC]
      8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092
uid           [ unknown] Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>

/etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg
------------------------------------------------------
pub   rsa4096 2018-09-17 [SC]
      F6EC B376 2474 EDA9 D21B  7022 8719 20D1 991B C93C
uid           [ unknown] Ubuntu Archive Automatic Signing Key (2018) <ftpmaster@ubuntu.com>
8

Try deleting expired key by running:

apt-key del 60D62A6B

and then re-running:

virtualmin setup-repos
9

Hi,

Still getting the an error unfortunately

apt-key del 60D62A6B
OK

virtualmin setup-repos
Setting up Virtualmin software repositories ..
..error : Hit:2 https://artifacts.elastic.co/packages/8.x/apt stable InRelease Get:3
http://se.archive.ubuntu.com/ubuntu focal-updates InRelease [128 kB] Hit:4
http://se.archive.ubuntu.com/ubuntu focal-backports InRelease Hit:5
http://se.archive.ubuntu.com/ubuntu focal-security InRelease Get:6
https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease [10.7 kB] Get:7
http://se.archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages [3343 kB] Err:6
https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease The following signatures couldn't
be verified because the public key is not available: NO_PUBKEY 3E570892B9A0B8B7 Get:8
http://se.archive.ubuntu.com/ubuntu focal-updates/universe amd64 Packages [1194 kB] Reading
package lists. W: GPG error: https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease: The
following signatures couldn't be verified because the public key is not available: NO_PUBKEY
3E570892B9A0B8B7 E: The repository 'https://software.virtualmin.com/vm/7/pro/apt virtualmin
InRelease' is not signed. Downloading repository metadata: [2024-06-12 11:02:22 CEST] Failed with
error: 100 [2024-06-12 11:02:22 CEST] Something went wrong. Exiting.

apt-key list
/etc/apt/trusted.gpg
--------------------
pub   dsa1024 2002-02-28 [SCA]
      1719 003A CE3E 5A41 E2DE  70DF D97A 3AE9 11F6 3C51
uid           [ unknown] Jamie Cameron <jcameron@webmin.com>
sub   elg1024 2002-02-28 [E]

/etc/apt/trusted.gpg.d/ubuntu-keyring-2012-archive.gpg
------------------------------------------------------
pub   rsa4096 2012-05-11 [SC]
      790B C727 7767 219C 42C8  6F93 3B4F E6AC C0B2 1F32
uid           [ unknown] Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>

/etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg
------------------------------------------------------
pub   rsa4096 2012-05-11 [SC]
      8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092
uid           [ unknown] Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>

/etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg
------------------------------------------------------
pub   rsa4096 2018-09-17 [SC]
      F6EC B376 2474 EDA9 D21B  7022 8719 20D1 991B C93C
uid           [ unknown] Ubuntu Archive Automatic Signing Key (2018) <ftpmaster@ubuntu.com>
10

That’s unusual. Did you also remove it from the GPG keyring? If not, try running this command:

gpg --list-keys
gpg --delete-key 3E570892B9A0B8B7 # or any other Virtualmin related keys

When done run the following command instead to setup your repos:

apt-get clean
sh -c "$(curl -fsSL https://software.virtualmin.com/gpl/scripts/virtualmin-install.sh)" -- --setup
11

Hi,

gpg --list-keys
/root/.gnupg/pubring.kbx
------------------------
pub   dsa1024 2002-02-28 [SCA]
      1719003ACE3E5A41E2DE70DFD97A3AE911F63C51
uid           [ unknown] Jamie Cameron <jcameron@webmin.com>
sub   elg1024 2002-02-28 [E]

pub   dsa1024 2009-08-13 [SC]
      D1EAE49036C029DEB7133233B0740C10F9232D77
uid           [ unknown] Virtualmin Script Install Updates (For signing updated Virtualmin script.pl files) <latest-scripts@virtualmin.com>
sub   elg2048 2009-08-13 [E]

pub   rsa4096 2023-07-12 [SC]
      7D1AE915F3DCFADA344A4FCB2D223B918916F2A2
uid           [ unknown] Webmin Developers <developers@webmin.com>
sub   rsa4096 2023-07-12 [E]

pub   rsa4096 2017-04-10 [SC]
      EC60F3DA9CB79ADCCF560D1F121E166DD9C821AB
uid           [ unknown] Ilia Ross <ilia@webmin.dev>
sub   rsa4096 2017-04-10 [E]

pub   rsa4096 2022-01-08 [SC] [expires: 2029-01-06]
      586C427B9590C1C435A5FE393E570892B9A0B8B7
uid           [ unknown] Virtualmin, Inc. (Package signing key for Virtualmin 7) <security@virtualmin.com>
sub   rsa4096 2022-01-08 [E] [expires: 2029-01-06]

I deleted all since they seemed to be related to Virtualmin and confirmed with gpg --list-keys. However the error still remains:

 sh -c "$(curl -fsSL https://software.virtualmin.com/gpl/scripts/virtualmin-install.sh)" -- --setup
[INFO] Log will be written to: /root/virtualmin-install.log
[INFO] Started Virtualmin 7 Professional software repositories setup
▣ Phase 1 of 1: Setup
Downloading Virtualmin 7 key                                                 ✔
Installing Virtualmin 7 key                                                  ✔
Downloading repository metadata                                             [ERROR] Failed with error: 100
 ✘

[ERROR] Something went wrong. Exiting.
[ERROR] The last few log entries were:
Spin pid is: 1819703
Hit:1 https://artifacts.elastic.co/packages/8.x/apt stable InRelease
Hit:2 http://se.archive.ubuntu.com/ubuntu focal InRelease
Hit:3 http://se.archive.ubuntu.com/ubuntu focal-updates InRelease
Hit:4 http://se.archive.ubuntu.com/ubuntu focal-backports InRelease
Hit:5 http://se.archive.ubuntu.com/ubuntu focal-security InRelease
Get:6 https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease [10.7 kB]
Err:6 https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3E570892B9A0B8B7
Reading package lists...
W: GPG error: https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3E570892B9A0B8B7
E: The repository 'https://software.virtualmin.com/vm/7/pro/apt virtualmin InRelease' is not signed.
Downloading repository metadata: [2024-06-12 19:55:18 CEST] [ERROR] Failed with error: 100
[2024-06-12 19:55:19 CEST] [ERROR] Something went wrong. Exiting.
12

I’m not sure what’s going on, but having a remote root login might help resolve the issue.

13

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.