Dear Maintainer,

*** Reporter, please consider answering these questions, where
appropriate ***

   * What led up to the situation?

Err:3 http://dellopti:3142/deb.debian.org/debian unstable InRelease
  At least one invalid signature was encountered.
(only a part of the errors)

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

apt(-get) update
   * What was the outcome of this action?
see above
   * What outcome did you expect instead?

If there IS an error with a signature apt must have seen it. How will
the user know which particular signature creates *allegedly* problems.
Here with this computer this problem happened all  of a sudden (I make
daily dist-upgrade(s)) with repos which work fine with my laptop. So I
now have apt blocked by this problem, apt not telling me by which
signature it feels offended and offers effectivly only a
I'm-not-telling-you-burger. Please improve the message by giving
usefull information.

*** End of the template - remove these template lines ***

Control: tag -1 moreinfo

If you only saw that error and no details later on, then no - we did
not get any more details from gpgv or we missed parsing it.

gpgv's status fd output is very opaque, it might just not have told
us anything or anything we understand and exited with 1.

We're going to need the sources file containing the source, the key
configured for the source, and the actual InRelease file that failed
to validate to analyse this further.

Alternatively, it may be that -o Debug::Acquire::gpgv=1 will give
enough information.

Am Thu, Jul 25, 2024 at 09:24:58PM GMT, schrieb mh:

Are you using apt-cacher-ng (or an other proxy) perhaps?
I don't use it myself, but I see somewhat frequent complains about it
shipping broken InRelease files and not recovering from it.
Other people are quick to reply that they never had that problem ever
and I never got to see the broken files so far… but what Julian said.
[…]
[end of mail]

Have you accidentally truncated the output/mail?


Best regards

David Kalnischkies

Hello dear maintainers, I also see this same error on my two Debian sid
installs, please find at the end of this email the output of apt with
suggested debug. The error happens on both external repos (docker,
google chrome) and on debian ones.

My apt sources:

deb https://deb.debian.org/debian/ sid main non-free non-free-firmware contrib
deb-src https://deb.debian.org/debian/ sid main non-free non-free-firmware contrib
deb https://ftp.fr.debian.org/debian/ experimental main non-free non-free-firmware contrib

deb [arch=amd64] https://download.docker.com/linux/debian stretch stable

deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main

deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main



==8<=====8<=====8<=====8<===

# apt update -o Debug::Acquire::gpgv=1
Ign:1 https://ftp.fr.debian.org/debian experimental InRelease
Get:2 http://dl.google.com/linux/chrome/deb stable InRelease [1,825 B]
0% [Connected to debian.map.fastly.net (146.75.54.132)] [Connected to download.docker.com (18.239.236.67)] inside VerifyGetSigners
Preparing to exec:  /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.emhK7K /tmp/apt.data.Q3Xxr4
Get:3 https://updates.signal.org/desktop/apt xenial InRelease [5,887 B]
Get:4 https://deb.debian.org/debian sid InRelease [198 kB]
Get:5 https://download.docker.com/linux/debian stretch InRelease [44.8 kB]
0% [5 InRelease 15.9 kB/44.8 kB 35%]gpgv exited with status 1
Summary:
  Good:
  Valid:
  Bad:
  Worthless:
  SoonWorthless:
  NoPubKey:
  Signed-By:
  NODATA: no
Err:2 http://dl.google.com/linux/chrome/deb stable InRelease
  At least one invalid signature was encountered.
0% [5 InRelease 32.3 kB/44.8 kB 72%]inside VerifyGetSigners
Preparing to exec:  /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.GxhUa7 /tmp/apt.data.THZQqW
0% [Working]gpgv exited with status 1
Summary:
  Good:
  Valid:
  Bad:
  Worthless:
  SoonWorthless:
  NoPubKey:
  Signed-By:
  NODATA: no
Err:3 https://updates.signal.org/desktop/apt xenial InRelease
  At least one invalid signature was encountered.
0% [Working]inside VerifyGetSigners
Preparing to exec:  /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.tW0Lmv /tmp/apt.data.GB4Nce
gpgv exited with status 1
Summary:
  Good:
  Valid:
  Bad:
  Worthless:
  SoonWorthless:
  NoPubKey:
  Signed-By:
  NODATA: no
Err:4 https://deb.debian.org/debian sid InRelease
  At least one invalid signature was encountered.
0% [Working]inside VerifyGetSigners
Preparing to exec:  /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.fWMVK9 /tmp/apt.data.ZEJ1a3
gpgv exited with status 1
Summary:
  Good:
  Valid:
  Bad:
  Worthless:
  SoonWorthless:
  NoPubKey:
  Signed-By:
  NODATA: no
Err:5 https://download.docker.com/linux/debian stretch InRelease
  At least one invalid signature was encountered.
Ign:1 https://ftp.fr.debian.org/debian experimental InRelease
Ign:1 https://ftp.fr.debian.org/debian experimental InRelease
Err:1 https://ftp.fr.debian.org/debian experimental InRelease
  Could not connect to ftp.fr.debian.org:443 (212.27.32.66). - connect (111: Connection refused) Cannot initiate the connection to ftp.fr.debian.org:443 (2a01:e0c:1:1598::2). - connect (101: Network is unreachable)
Warning: GPG error: http://dl.google.com/linux/chrome/deb stable InRelease: At least one invalid signature was encountered.
Error: The repository 'http://dl.google.com/linux/chrome/deb stable InRelease' is not signed.
Notice: Updating from such a repository can't be done securely, and is therefore disabled by default.
Notice: See apt-secure(8) manpage for repository creation and user configuration details.
Warning: GPG error: https://updates.signal.org/desktop/apt xenial InRelease: At least one invalid signature was encountered.
Error: The repository 'https://updates.signal.org/desktop/apt xenial InRelease' is not signed.
Notice: Updating from such a repository can't be done securely, and is therefore disabled by default.
Notice: See apt-secure(8) manpage for repository creation and user configuration details.
Warning: GPG error: https://deb.debian.org/debian sid InRelease: At least one invalid signature was encountered.
Error: The repository 'https://deb.debian.org/debian sid InRelease' is not signed.
Notice: Updating from such a repository can't be done securely, and is therefore disabled by default.
Notice: See apt-secure(8) manpage for repository creation and user configuration details.
Warning: GPG error: https://download.docker.com/linux/debian stretch InRelease: At least one invalid signature was encountered.
Error: The repository 'https://download.docker.com/linux/debian stretch InRelease' is not signed.
Notice: Updating from such a repository can't be done securely, and is therefore disabled by default.
Notice: See apt-secure(8) manpage for repository creation and user configuration details.

Solution from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1077074
which can probably be merged:

  apt purge gpgv-from-sq gpgv-sq