Subject: Bug#1401 closed by Mihai Moldovan <[email-masked]> (Re: Bug#1401: PGP-Key is not available on keyservers for debian buster)

From: [email-masked] (X2Go Bug Tracking System)
Date: Thu, 12 Sep 2019 17:45:02 +0000

This is an automatic notification regarding your Bug report
which was filed against the packages.x2go.org package:

#1401: Update GPG key bootstrapping instructions for Debian

It has been closed by Mihai Moldovan <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Mihai Moldovan <[email-masked]> by
replying to this email.

-- 
1401: bugs.x2go.org/cgi-bin/bugreport.cgi?bug=1401
X2Go Bug Tracking System
Contact [email-masked] with problems

Subject: Re: Bug#1401: PGP-Key is not available on keyservers for debian buster
From: Mihai Moldovan <[email-masked]>
To: [email-masked]
Date: Thu, 12 Sep 2019 19:40:40 +0200

Control: reassign wiki.x2go.org
Control: retitle -1 Update GPG key bootstrapping instructions for Debian
Control: close -1

* On 8/24/19 7:06 PM, Mihai Moldovan wrote:
> Control: reassign -1 packages.x2go.org
> 
> 
>> N: An update from such a repository cannot be done in a secure way, so
>> it is disabled by default.
> 
> The x2go-keyring package is available for Debian buster, includes the required
> key file and should work just fine.
> 
> However, newer apt versions will disallow downloading from an untrusted repository.
> 
> In order to actually install the keyring package, try running something like:
> sudo apt-get --allow-unauthenticated install x2go-keyring
> 
> Afterwards, sudo apt update should not return an error again. Do not use the
> --allow-unauthenticated flag without understanding its implications.

That wasn't correct - at least not completely. --allow-unauthenticated should
work for package installations, but not for downloading repository metadata.

To allow apt to work with unauthenticated repository metadata, users would need
to use something like:
apt-get update --allow-insecure-repositories

This said: this is totally risky, now and later. Installing packages from an
unauthenticated repository doesn't give apt any chance to check the origin. A
successful Man-in-the-Middle attack is very likely in such a scenario. Worse,
even after the initial bootstrap, all subsequent operations and packages from
such a repository could still be malicious.

I've updated https://wiki.x2go.org/doku.php/wiki:repositories:debian et al with
this information, big fat warning signs and explanations.

**Users should always bootstrap with the currently valid GPG key and then
install the x2go-keyring package from the validated X2Go repository location!**

Closing up here.

Mihai

Subject: PGP-Key is not available on keyservers for debian buster
From: "Daniel Ullrich" <[email-masked]>
To: [email-masked]
Date: Sat, 24 Aug 2019 02:36:24 +0000

Package: complete x2go repo
version: none

sudo apt update
The following signatures could not be verified because their public key 
is not available: NO_PUBKEY E1F958385BFE2B6E
W: GPG error: http://packages.x2go.org/debian buster InRelease: The 
following signatures could not be verified because their public key is 
not available: NO_PUBKEY E1F958385BFE2B6E
E: The depot "http://packages.x2go.org/debian buster InRelease" is not 
signed.
N: An update from such a repository cannot be done in a secure way, so 
it is disabled by default.
N: See the apt-secure(8) manual page for more details on package vault 
creation and user configuration.

sudo apt-key adv --recv-keys --keyserver keys.gnupg.net E1F958385BFE2B6E
Executing: /tmp/apt-key-gpghome.4WhtJFIi3f/gpg.1.sh --recv-keys 
--keyserver keys.gnupg.net E1F958385BFE2B6E
gpg: Received from key server failed: The waiting time for the 
connection has expired.

x2go-keyring package is not available for debian buster => would solve 
this issue!