Skip to content

Installer not working: Can't check signature: No public key #715

Open
Open
Installer not working: Can't check signature: No public key#715
Labels
Arch:x86_64OS:LinuxSeverity:criticalp1

Description

@dlangBugzillaToGithub
dlangBugzillaToGithub
opened on Feb 13, 2024

Robert reported this on 2024-02-13T07:14:12Z

Transferred from https://issues.dlang.org/show_bug.cgi?id=24392

CC List

Description

I cannot install D because the installer is failing right away when trying to verify the install.sh script:

robert@fedora:~$ curl -fsS https://dlang.org/install.sh | bash -s dmd
Downloading https://dlang.org/d-keyring.gpg
######################################################################## 100.0%
Downloading https://dlang.org/install.sh
######################################################################## 100.0%
gpg: Signature made Mon 02 Jan 2023 01:47:04 PM CET
gpg:                using RSA key 30AE2FC45DE4153268ED91754CF5FA5326CC62EB
gpg: Can't check signature: No public key
Invalid signature https://dlang.org/install.sh.sig

I am on Fedora 39 (I know there is an RPM but I still wanted to report this bug).

Activity

  1. dlangBugzillaToGithub commented on Aug 7, 2024

    @dlangBugzillaToGithub
    dlangBugzillaToGithub
    on Aug 7, 2024
    Author

    code (@MartinNowak) commented on 2024-08-07T16:03:26Z

    Due to https://github.com/dlang/dlang.org/pull/3769#issuecomment-2273811808 not signing the updated keyring.

  2. dlangBugzillaToGithub commented on Aug 7, 2024

    @dlangBugzillaToGithub
    dlangBugzillaToGithub
    on Aug 7, 2024
    Author

    code (@MartinNowak) commented on 2024-08-07T16:04:41Z

    (In reply to Martin Nowak from comment #1)
> Due to https://github.com/dlang/dlang.org/pull/3769#issuecomment-2273811808
> not signing the updated keyring.

A workaround is to import the updated key manually for now.

`gpg --recv-keys E22EC04C82780970381402F4A7D4D42F8EC6A355`

  3. dlangBugzillaToGithub commented on Sep 25, 2024

    @dlangBugzillaToGithub
    dlangBugzillaToGithub
    on Sep 25, 2024
    Author

    code (@MartinNowak) commented on 2024-09-25T15:21:35Z

    More specifically, the keyring was updated by now, but it wasn't signed with any of the existing keys, hence `install.sh update` might fail verifying the new d-keyring. Maybe we should skip that verification step to not complicate bootstrapping that much.

> A workaround is to import the updated key manually for now.
> `gpg --recv-keys E22EC04C82780970381402F4A7D4D42F8EC6A355`

Actually that should update the dlang keyring, not the default one.

`gpg --keyring ~/dlang/d-keyring.gpg --no-default-keyring --recv-keys E22EC04C82780970381402F4A7D4D42F8EC6A355`

  4. dlangBugzillaToGithub commented on Sep 25, 2024

    @dlangBugzillaToGithub
    dlangBugzillaToGithub
    on Sep 25, 2024
    Author

    code (@MartinNowak) commented on 2024-09-25T15:23:12Z

    *** Issue 24767 has been marked as a duplicate of this issue. ***

  5. robertschulze commented on Jan 10, 2025

    @robertschulze
    robertschulze
    on Jan 10, 2025

    This appears to not be working anymore:

    [root@pve-onedrive ~]# curl -fsS https://dlang.org/install.sh | bash -s dmd
Downloading https://dlang.org/d-keyring.gpg
######################################################################## 100.0%
Downloading https://dlang.org/install.sh
######################################################################## 100.0%
gpg: Signature made Mon Apr  1 20:02:30 2024 UTC
gpg:                using RSA key E22EC04C82780970381402F4A7D4D42F8EC6A355
gpg: Can't check signature: No public key
Invalid signature https://dlang.org/install.sh.sig
[root@pve-onedrive ~]# gpg --keyring ~/dlang/d-keyring.gpg --no-default-keyring --recv-keys E22EC04C82780970381402F4A7D4D42F8EC6A355
gpg: key 4CF5FA5326CC62EB: public key "Iain Buclaw <ibuclaw@gdcproject.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
[root@pve-onedrive ~]# curl -fsS https://dlang.org/install.sh | bash -s dmd
Downloading https://dlang.org/d-keyring.gpg
######################################################################## 100.0%
gpg: Signature made Mon Feb 13 22:52:51 2023 UTC
gpg:                using RSA key E22EC04C82780970381402F4A7D4D42F8EC6A355
gpg: BAD signature from "Iain Buclaw <ibuclaw@gdcproject.org>" [expired]
Invalid signature https://dlang.org/d-keyring.gpg.sig
[root@pve-onedrive ~]#

  6. robertschulze commented on Jan 10, 2025

    @robertschulze
    robertschulze
    on Jan 10, 2025

    What I did:

    [root@pve-onedrive ~]# cd dlang
[root@pve-onedrive dlang]# rm d-keyring.gpg 
[root@pve-onedrive dlang]# wget https://dlang.org/d-keyring.gpg.sig

    Probably highly insecure but at least it worked...

  7. chenzhekl commented on Mar 19, 2025

    @chenzhekl
    chenzhekl
    on Mar 19, 2025

    The same problem happened to me. Is D really dead to the point that the official installer is kind of abandoned...

  8. dkorpel commented on Mar 21, 2025

    @dkorpel
    dkorpel
    on Mar 21, 2025
    Contributor

    Can you post the exact error, and the output of cd ~/dlang && gpg --show-keys ./d-keyring.gpg after running the install script? (Assuming you are installing in your home/dlang folder).

  9. chenzhekl commented on Mar 25, 2025

    @chenzhekl
    chenzhekl
    on Mar 25, 2025

    Unfortunately, I am no longer using Linux with dlang. This is the error I got on macOS:

    ~ % curl -fsS https://dlang.org/install.sh | bash -s dmd

DMD does not have builds for macOS on aarch64/arm64 architecture.
Switching to x86_64 architecture (requires Rosetta).

Downloading https://dlang.org/d-keyring.gpg
######################################################################## 100.0%
Downloading https://dlang.org/install.sh
######################################################################## 100.0%
gpg: /Users/me/.gnupg/trustdb.gpg: trustdb created
gpg: Note: Specified keyrings are ignored due to option "use-keyboxd"
gpg: Signature made Tue Apr  2 05:02:30 2024 JST
gpg:                using RSA key E22EC04C82780970381402F4A7D4D42F8EC6A355
gpg: Can't check signature: No public key
Invalid signature https://dlang.org/install.sh.sig

~ % cd dlang

dlang % gpg --show-keys ./d-keyring.gpg
pub   rsa4096 2014-09-01 [SC] [expired: 2020-03-25]
      AFC7DB45693D62BB472BF27BAB8FE924C2F7E724
uid                      Martin Nowak (dawg) <me@dawg.eu>
uid                      Martin Nowak <martin.nowak@plugintheworld.com>
uid                      Martin Nowak <code@dawg.eu>
uid                      Martin Nowak <martin@dlang.org>
sub   rsa4096 2015-02-27 [S] [expired: 2020-03-25]
sub   rsa4096 2014-09-01 [E] [expired: 2020-03-25]

gpg: WARNING: No valid encryption subkey left over.
pub   rsa2048 2016-01-29 [SC]
      BBED1B088CED7F958917FBE85004F0FAD051576D
uid                      Vladimir Panteleev <gpg@thecybershadow.net>
sub   rsa2048 2016-01-29 [E]

pub   rsa4096 2015-11-24 [SC] [expires: 2026-03-23]
      8FDB8D357AF468A9428ACE3C2055F76601A36FB0
uid                      Sebastian Wilzbach <seb@wilzba.ch>
uid                      Sebastian Wilzbach <sebi@wilzbach.me>
sub   rsa4096 2015-11-24 [E] [expired: 2020-11-22]

gpg: WARNING: No valid encryption subkey left over.
pub   rsa4096 2018-03-26 [SC] [expired: 2020-03-25]
      F77158814C19E5E07BA1079A65394AFEF4A68565
uid                      DLang Nightly (bot) <builder@nightlies.dlang.org>
sub   rsa4096 2018-03-26 [S] [expired: 2020-03-25]
sub   rsa4096 2018-03-26 [E] [expired: 2020-03-25]

gpg: WARNING: No valid encryption subkey left over.
pub   rsa4096 2020-03-12 [SC] [revoked: 2022-03-22]
      F46A10D0AB44C3D15DD65797BCDD73FFC3EB6146
uid                      Martin Nowak <code@dawg.eu>
uid                      Martin Nowak <martin.nowak@7learnings.com>
uid                      Martin Nowak <martin@dlang.org>
sub   rsa4096 2020-03-12 [E] [revoked: 2022-03-22]
sub   rsa4096 2020-03-12 [S] [revoked: 2022-03-22]

gpg: WARNING: No valid encryption subkey left over.
pub   rsa4096 2013-09-28 [SC] [expires: 2027-02-16]
      30AE2FC45DE4153268ED91754CF5FA5326CC62EB
uid                      Iain Buclaw <ibuclaw@gdcproject.org>
uid                      Iain Buclaw <iain.buclaw@dlang.org>
uid                      Iain Buclaw <ibuclaw@gcc.gnu.org>
sub   rsa4096 2013-09-28 [E] [expires: 2027-02-16]
sub   rsa4096 2023-02-13 [S] [expires: 2027-02-16]

pub   ed25519 2022-03-22 [SC] [expired: 2024-03-21]
      F8A26D5D7572ECA06EC7973182C52E37A8BC8393
uid                      Martin Nowak <code@dawg.eu>
uid                      Martin Nowak <martin@dlang.org>
uid                      Martin Nowak <martin.nowak@7learnings.com>
sub   cv25519 2022-03-22 [E] [expired: 2024-03-21]
sub   ed25519 2022-03-22 [S] [expired: 2024-03-21]

gpg: WARNING: No valid encryption subkey left over.
pub   rsa4096 2025-01-09 [SC]
      F3F896F3274BBD9BBBA59058710592E7FB7AF6CA
uid                      Dennis Korpel <dkorpel@gmail.com>
sub   rsa4096 2025-01-09 [E]

  10. dkorpel commented on Mar 25, 2025

    @dkorpel
    dkorpel
    on Mar 25, 2025
    Contributor

    The downloaded keyring looks up to date, but:

    gpg: Note: Specified keyrings are ignored due to option "use-keyboxd"

    That's a problem

    The --keyring option is deprecated and does not work at all if the keyboxd is used.

    https://dev.gnupg.org/T7265

    The install scripts needs to find a new way to apply those downloaded keys

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Arch:x86_64OS:LinuxSeverity:criticalp1

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions