[SOLVED] Configuration Concerns

[mikeatuabb]

1. /usr/share is for packages, not for end users (including admins); If the key is not managed by a package, it should be in /etc/apt/keyrings.

2. It appears that the key changed, yet there is no instruction that explains the old key needs to be replaced

```
# apt update
Hit:1 http://security.debian.org/debian-security trixie-security InRelease
Get:2 http://download.proxmox.com/debian/pve trixie InRelease [3,534 B]
Err:2 http://download.proxmox.com/debian/pve trixie InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY A7BCD1420BFE778E
Get:3 http://download.proxmox.com/debian/ceph-squid trixie InRelease [2,736 B]
Err:3 http://download.proxmox.com/debian/ceph-squid trixie InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY A7BCD1420BFE778E
Hit:4 http://deb.debian.org/debian trixie InRelease
Hit:5 http://deb.debian.org/debian trixie-updates InRelease
Reading package lists... Done
W: GPG error: http://download.proxmox.com/debian/pve trixie InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY A7BCD1420BFE778E
E: The repository 'http://download.proxmox.com/debian/pve trixie InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: GPG error: http://download.proxmox.com/debian/ceph-squid trixie InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY A7BCD1420BFE778E
E: The repository 'http://download.proxmox.com/debian/ceph-squid trixie InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
```

 

[fabian]

the key is shipped in a package:

$ dpkg -L proxmox-archive-keyring
/.
/etc
/etc/apt
/etc/apt/trusted.gpg.d
/etc/apt/trusted.gpg.d/proxmox-release-bookworm.gpg
/etc/apt/trusted.gpg.d/proxmox-release-trixie.gpg
/usr
/usr/share
/usr/share/doc
/usr/share/doc/proxmox-archive-keyring
/usr/share/doc/proxmox-archive-keyring/SOURCE
/usr/share/doc/proxmox-archive-keyring/changelog.gz
/usr/share/doc/proxmox-archive-keyring/copyright
/usr/share/keyrings
/usr/share/keyrings/proxmox-archive-keyring.gpg
/usr/share/keyrings/proxmox-offline-signing-key.pub
/usr/share/keyrings/proxmox-release-bookworm.gpg
/usr/share/keyrings/proxmox-release-trixie.gpg
/etc/apt/trusted.gpg.d/proxmox-release-buster.gpg
/etc/apt/trusted.gpg.d/proxmox-release-bullseye.gpg

that package got the current Trixie release key in version 3.1 back in November '24..

 

[mikeatuabb]

Ah...well that's an interesting change that our configuration management needs to be updated for.
The key change still seems odd/unexpected, but I suppose that's moot when it actually is managed by a package.

Thanks!

 

[fabian]

like many distros, we normally generate a new key for every release. we ship it in the previous release well before the new release is cut, to allow for a smooth transition.