#1152601 extrepo: webmin signing cert contains commented yaml

Package:
extrepo
Source:
extrepo
Submitter:
Uwe Kleine-König
Date:
2026-10-30 12:07:02 UTC
Severity:
normal
Tags:
#1152601#5
Date:
2026-10-30 12:05:51 UTC
From:
To:
Hello,

(not sure if this report should have been sent against
extrepo-offline-data? It affects the data on
https://extrepo-team.pages.debian.net/extrepo-data which is used by
extrepo but provided by extrepo-offline-data. I let you reassign if I
chose wrongly.)

After

	sudo extrepo enable webmin

I have:

	$ cat /etc/apt/sources.list.d/extrepo_webmin.sources
	Components: contrib
	Signed-By: /var/lib/extrepo/keys/webmin.asc
	Suites: stable
	Types: deb
	Uris: https://download.webmin.com/download/newkey/repository

(that part is fine), but the file containing the signing cert:

	$ cat /var/lib/extrepo/keys/webmin.asc
	-----BEGIN PGP PUBLIC KEY BLOCK-----

	mQINBGSuZVABEAC5H1bzk4TYlpu8gcEwWGD7eVxtBagEYRCrG9WLkJ1TohfGumUd
	za5H0KU/sfI1VkLFkMJ/UE8PblCE4l9qePDfo0Cf35PU9Y5D5/KvbatR2lVM9C2k
	[...]
	gtVP/edU/JbeCEnjsCsdeWAgLaByp5yTS0u3i9Jn3rPU+cekNTfEprM61SutrIfV
	NwLr+Y0i9j34kj2CjamfZrYtCjOVytsfVGGogSd5GBumqfYt2bmJywuom1Wkpvkv
	eMAhu3k=
	=ha4Q
	-----END PGP PUBLIC KEY BLOCK-----

	# It's empty right now
	#   webmin-prerelease:
	#     description: webmin.com prerelease Repository
	#     source:
	#       Types: deb
	#       URIs: https://rc.download.webmin.dev
	#       Suites: webmin
	#       Components: main
	#       Architectures: amd64 i386 arm64 armhf alpha arm armel armhf hppa ia64 mips mipsel powerpc powerpcspe s390x sparc
	#     suites:
	#     - bullseye
	#     - bookworm
	#     - trixie
	#     - forky
	#     - sid
	#     policy: main
	#       # https://download.webmin.com/developers-key.asc
	#     gpg-key: |
	#       -----BEGIN PGP PUBLIC KEY BLOCK-----
	#
	#       mQINBGSuZVABEAC5H1bzk4TYlpu8gcEwWGD7eVxtBagEYRCrG9WLkJ1TohfGumUd
	#       za5H0KU/sfI1VkLFkMJ/UE8PblCE4l9qePDfo0Cf35PU9Y5D5/KvbatR2lVM9C2k
	#       [...]
	#       gtVP/edU/JbeCEnjsCsdeWAgLaByp5yTS0u3i9Jn3rPU+cekNTfEprM61SutrIfV
	#       NwLr+Y0i9j34kj2CjamfZrYtCjOVytsfVGGogSd5GBumqfYt2bmJywuom1Wkpvkv
	#       eMAhu3k=
	#       =ha4Q
	#       -----END PGP PUBLIC KEY BLOCK-----

the part after the (first) "-----END PGP PUBLIC KEY BLOCK-----" leaks in
from extrepo data and there is a merge request with a fix at
https://salsa.debian.org/extrepo-team/extrepo-data/-/merge_requests/591
.

Best regards
Uwe