#853858 /usr/bin/apt-key: cannot add gpg keys due to their large size

Package:
apt
Source:
apt
Description:
commandline package manager
Submitter:
? ??
Date:
2021-06-05 08:57:02 UTC
Severity:
normal
#853858#5
Date:
2017-02-01 15:20:35 UTC
From:
To:
Dear Maintainer,

I get warnings after I added virtualbox and scala-sbt repos in
/etc/apt/sources.list.d/ and running 'apt-get update', and NO_PUBKEY
warnings occured.

So I retried with the instructions on virtualbox.org and scala-sbt.org,
but still got the same problems.

I manually downloaded and imported the keys using gpg and export them to
'apt-key', but the problem was not solved, and I got the same warnings
with 'apt-get update'.

I can install packages from virtualbox.org and scala-sbt.org after
saying 'y' to every warnings.

Thank you.
dkqjwl93


# apt-get update results
root@debian:~# apt-get update
Get:1 http://download.virtualbox.org/virtualbox/debian stretch InRelease
[7,793 B]
Ign:1 http://download.virtualbox.org/virtualbox/debian stretch InRelease
Ign:2 https://dl.bintray.com/sbt/debian  InRelease
Get:4 https://dl.bintray.com/sbt/debian  Release [814 B]
Hit:3 http://debian-mirror.sakura.ne.jp/debian stretch InRelease
Get:5 https://dl.bintray.com/sbt/debian  Release.gpg [821 B]
Ign:5 https://dl.bintray.com/sbt/debian  Release.gpg
Get:6 https://dl.bintray.com/sbt/debian  Packages [1,640 B]
Hit:6 https://dl.bintray.com/sbt/debian  Packages
Ign:6 https://dl.bintray.com/sbt/debian  Packages
Get:6 https://dl.bintray.com/sbt/debian  Packages [1,437 B]
Hit:6 https://dl.bintray.com/sbt/debian  Packages
Fetched 9,428 B in 2s (3,955 B/s)
Reading package lists... Done
W: GPG error: http://download.virtualbox.org/virtualbox/debian stretch
InRelease: The following signatures couldn't be verified because the
public key is not available: NO_PUBKEY A2F683C52980AECF
W: The repository 'http://download.virtualbox.org/virtualbox/debian
stretch InRelease' is not signed.
N: Data from such a repository can't be authenticated and is therefore
potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user
configuration details.
W: GPG error: https://dl.bintray.com/sbt/debian  Release: The following
signatures couldn't be verified because the public key is not available:
NO_PUBKEY 99E82A75642AC823
W: The repository 'https://dl.bintray.com/sbt/debian  Release' is not
signed.
N: Data from such a repository can't be authenticated and is therefore
potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user
configuration details.
root@debian:~#

# instruction from virtualbox.org
root@debian:~# wget -q https://www.virtualbox.org/download/oracle_vbox_2016.asc -O- | sudo apt-key add -
gpg: Warning: 1 key skipped due to its large size
gpg: Warning: 1 key skipped due to its large size
OK
root@debian:~#

# instruction from scala-sbt.org
root@debian:~# sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823
Executing: /tmp/apt-key-gpghome.gNgechPNd5/gpg.1.sh --keyserver
hkp://keyserver.ubuntu.com:80 --recv
2EE0EA64E40A89B84B2DF73499E82A75642AC823
gpg: key 99E82A75642AC823: public key "[User ID not found]" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: Warning: 1 key skipped due to its large size
gpg: Warning: 1 key skipped due to its large size
root@debian:~#

# manually import and export to apt-key
root@debian:~# gpg --list-keys virtualbox.org
pub   rsa4096 2016-04-22 [SC]
      B9F8D658297AF3EFC18D5CDFA2F683C52980AECF
      uid           [ unknown] Oracle Corporation (VirtualBox archive
      signing key) <info@virtualbox.org>
      sub   rsa4096 2016-04-22 [E]

root@debian:~# gpg --export --armor B9F8D658297AF3EFC18D5CDFA2F683C52980AECF | apt-key add -
gpg: Warning: 1 key skipped due to its large size
gpg: Warning: 1 key skipped due to its large size
OK
root@debian:~#

# apt-key list
root@debian:~# apt-key list
/etc/apt/trusted.gpg
--------------------
pub   rsa4096 2012-04-27 [SC] [expires: 2020-04-25]
      A1BD 8E9D 78F7 FE5C 3E65  D8AF 8B48 AD62 4692 5553
uid           [ unknown] Debian Archive Automatic Signing Key
(7.0/wheezy) <ftpmaster@debian.org>

pub   rsa4096 2014-11-21 [SC] [expires: 2022-11-19]
      126C 0D24 BD8A 2942 CC7D  F8AC 7638 D044 2B90 D010
uid           [ unknown] Debian Archive Automatic Signing Key (8/jessie)
<ftpmaster@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
----------------------------------------------------------
pub   rsa4096 2014-11-21 [SC] [expires: 2022-11-19]
      126C 0D24 BD8A 2942 CC7D  F8AC 7638 D044 2B90 D010
uid           [ unknown] Debian Archive Automatic Signing Key (8/jessie)
<ftpmaster@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
-------------------------------------------------------------------
pub   rsa4096 2014-11-21 [SC] [expires: 2022-11-19]
      D211 6914 1CEC D440 F2EB  8DDA 9D6D 8F6B C857 C906
uid           [ unknown] Debian Security Archive Automatic Signing Key
(8/jessie) <ftpmaster@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
-------------------------------------------------------
pub   rsa4096 2013-08-17 [SC] [expires: 2021-08-15]
      75DD C3C4 A499 F1A1 8CB5  F3C8 CBF8 D6FD 518E 17E1
uid           [ unknown] Jessie Stable Release Key
<debian-release@lists.debian.org>

/etc/apt/trusted.gpg.d/debian-archive-squeeze-automatic.gpg
-----------------------------------------------------------
pub   rsa4096 2010-08-27 [SC] [expires: 2018-03-05]
      9FED 2BCB DCD2 9CDF 7626  78CB AED4 B06F 4730 41FA
uid           [ unknown] Debian Archive Automatic Signing Key
(6.0/squeeze) <ftpmaster@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-squeeze-stable.gpg
--------------------------------------------------------
pub   rsa4096 2010-08-07 [SC] [expires: 2017-08-05]
      0E4E DE2C 7F3E 1FC0 D033  800E 6448 1591 B983 21F9
uid           [ unknown] Squeeze Stable Release Key
<debian-release@lists.debian.org>

/etc/apt/trusted.gpg.d/debian-archive-wheezy-automatic.gpg
----------------------------------------------------------
pub   rsa4096 2012-04-27 [SC] [expires: 2020-04-25]
      A1BD 8E9D 78F7 FE5C 3E65  D8AF 8B48 AD62 4692 5553
uid           [ unknown] Debian Archive Automatic Signing Key
(7.0/wheezy) <ftpmaster@debian.org>

/etc/apt/trusted.gpg.d/debian-archive-wheezy-stable.gpg
-------------------------------------------------------
pub   rsa4096 2012-05-08 [SC] [expires: 2019-05-07]
      ED6D 6527 1AAC F0FF 15D1  2303 6FB2 A1C2 65FF B764
uid           [ unknown] Wheezy Stable Release Key
<debian-release@lists.debian.org>

root@debian:~#
#853858#10
Date:
2017-02-01 20:55:15 UTC
From:
To:
Hi ? ??--

These are both bad instructions, and should not be used.  Remote
repositories should be added by fetching a binary key and placing it in
the local file system.

for Debian 9 ("stretch") and later, you should place these keys (in
binary form) someplace within /usr/local/share/keyrings/ and add a
"Signed-By:" option to the relevant apt sources (see sources.list(5)).

This makes it so that the special key is only authorized for the
specific repository.

For Debian 8 ("jessie"), you should place these keys in binary form with
a name that matches the shell glob /etc/apt/trusted.gpg.d/*.gpg

Feel free to tell those upstreams that they should change their
instructions.

this is less isolated than the recommended practice for debian 9, but
you still should not be using "apt-key add" or (shudder) "apt-key adv",
which is even worse.
#853858#15
Date:
2017-02-02 06:34:12 UTC
From:
To:
Thank you. It is hard to search "Singed-By:" option on the forums.


I solved the problem in Synaptic Package Manager by

     menu -> Setting -> Repository -> Authentication -> Import Key File.

I guess it imports the keys into /etc/apt/trusted.gpg.

Using "Signed-By:" option seems better solution than this.
#853858#20
Date:
2017-02-03 00:59:34 UTC
From:
To:
Hi Kim Yeon-Soo--

Sorry about that!  I didn't mean to be obscure.  When i wrote "(see
sources.list(5))" i meant "see the documentation about sources.list in
section 5 of the system manual", which can be done from the command line
with :

     man 5 sources.list

Or you can also see that online here:

https://manpages.debian.org/testing/apt/sources.list.5.en.html#THE_DEB_AND_DEB-SRC_TYPES:_OPTIONS

If you search within there, you'll see documentation for Signed-By and
related options.

agreed, it would be better to use Signed-By than to import these
external keys into /etc/apt/trusted.gpg.

Regards,
#853858#25
Date:
2018-01-26 22:33:36 UTC
From:
To:
Hello Friend.
Have you seen my previous message? Let me know via
my private email: ms.hweetin2334@gmail.com
#853858#30
Date:
2018-12-30 00:22:16 UTC
From:
To:
안녕하세요, 저는 Lisa Jaster입니다. 당신을 알게되어 대단히 기쁩니다.이 매체를 통해 연락하는 것을 허락 해 주시기 바랍니다. 저는 매우 중요하고 기밀 사항이 있습니다. 제가 당신과상의하고 싶습니다. 친절하게 답장을 보내서 소개하겠습니다. 내 자신을 당신에게, 고마워,
관련
리사 재 스터.
#853858#35
Date:
2021-06-05 08:52:56 UTC
From:
To:
عزيزي مالك البريد الإلكتروني / المستفيدين من الصندوق ،

لقد أرسلت لك هذه الرسالة منذ شهر ، لكنني لم أسمع منك
لست متأكدًا مما إذا كان مفهومًا ، لذا أكرر ذلك مرة أخرى أولاً ، أنا السيدة
مريم محمد ، العضو المنتدب الحالي ورئيس مجلس إدارة صندوق النقد الدولي.

في الواقع ، لقد أخذنا في الاعتبار جميع العقبات والمشاكل المرتبطة بمعاملتك
المعلقة وعدم قدرتك على إرضائك مقابل رسوم التحويل لخيارات التحويل السابقة ،
راجع موقعنا على الإنترنت لتأكيد 38 ° 53′56 ″ N 77 ° 2 ′39 ″ Zh

نحن مجلس الإدارة ، والبنك الدولي ، وصندوق النقد الدولي (IMF) في واشنطن
العاصمة ، بالاشتراك مع وزارة الخزانة الأمريكية وبعض وكالات التحقيق الأخرى
ذات الصلة في الولايات المتحدة. أمر قسم التحويلات لدينا بالخارج ، البنك
المتحد لأفريقيا لومي توغو ، بإصدار بطاقة فيزا لك حيث سيتم تحميل أموالك
البالغة 2،500،000.00 دولار لسحب أموالك مرة أخرى.

في سياق التحقيق الذي أجريناه ، شعرنا بخيبة أمل عندما وجدنا أن مدفوعاتك قد
تم تأجيلها دون داع من قبل مسؤولي البنك الفاسدين الذين حاولوا إعادة توجيه
أموالك إلى حساباتهم الخاصة.

ونعلمك اليوم أن أموالك قد تم إيداعها في بطاقة VISA من قبل بنك UBA وأنها
جاهزة للتسليم أيضًا. اتصل الآن بسكرتير بنك UBA
الاسم: السيدة فيفيان فرانسيس
بريد فرانسيس الإلكتروني: www.info.unitedbankofafrica09@gmail.com

أرسل لها المعلومات التالية لتسليم بطاقة فيزا ATM المعتمدة الخاصة بك إلى
عنوانك.

اسمك الكامل ========================
بلدك الأصلي ==================
عنوان منزلك ======================
عنوان البريد الإلكتروني ========================
رقم هاتفك ==================== عمرك ======================= = جنسك
======================= مهنتك ================== === ===

مبروك مقدما.
يعتبر،
السيدة مريم محمد