If I install a package using a supported external repo:

  extrepo enable brave_release
  apt update
  apt install brave-browser

the current Brave signing key will automatically be fetched and placed in
/var/lib/extrepo/keys/.

However, when Brave updates their signing key, then what I get is a message
along the lines of:

  $ sudo apt update
  ...
  Err:3 https://brave-browser-apt-release.s3.brave.com stable InRelease
    The following signatures couldn't be verified because the public key is not available: NO_PUBKEY A8580BDC82D3DC6C
  ...
  W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://brave-browser-apt-release.s3.brave.com stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY A8580BDC82D3DC6C
  W: Failed to fetch https://brave-browser-apt-release.s3.brave.com/dists/stable/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY A8580BDC82D3DC6C
  W: Some index files failed to download. They have been ignored, or old ones used instead.

until, assuming the new signing key was merged in the extrepo-data
repository, I manually refresh the local key using:

  extrepo update brave_release

Given that upstream key rotations such as these should generally be
encouraged (as opposed to never-expiring or 10year-long expiries), many
users are going to get stuck with broken updates and won't know from the apt
error message that they need to do an extrepo update.

I suggest a simple fix, a daily cronjob or systemd timer which goes through
all enabled repos and updates the local copy of the keys. These keys are
already signed by extrepo, so the trust chain is maintained at all times.

Francois

An alternative approach could be that an `apt update` would trigger an
`extrepo update`.

I don't know enough about apt hooks etc. to be able to say if that would
be feasible or - in case such a mechanism isn't available today -  if
apt's maintainers would be in favor of it?

Installing a cron job that periodically retrieves extrepo updates would be
easier to implement. However the problem of offline systems should be
considered then. What do you do with systems (laptops f.ex.) that sleep
when a cron job would be triggered or that are not connected to the
internet at that time? One could look into systemd's timer mechanisms if
the support being deferred until the system wakes up and is connected to
the internet.

*t

That's an interesting idea. I also don't know how feasible that is.

That kind of system would ideally have the anacron package installed.

Francois

So extrepo 0.13, currently in testing, has a few new features, amongst which support for argument-less 'extrepo update' which updates all repositories and which would be a requirement for any feature like this.

I'm not sure at this point whether I prefer an apt hook or a cron job, and I want the argument-less update to be tested a bit before running it in any type of default scenario at any rate, but I thought I'd mention it here first.

I'm not a fan of cronjobs, this looks a bit like windows where everything has it's own updater running in the backround.

What about having the package extrepo-offline-data frequently updated automatically and use that by default?