Subject: GPG key error: public key E1F958385BFE2B6E is not available

From: "Chatterjee, Saion" <[email-masked]>
Date: Wed, 28 Jul 2021 16:27:50 +0000

Package: x2goserver
Severity: critical

Unable to install x2Go packages for Debian because the repository archive key is not available.

When I try to bootstrap the repository GPG keys using the docs:  https://wiki.x2go.org/doku.php/wiki:repositories:debian
with this command:
apt-key adv --recv-keys --keyserver keys.gnupg.net E1F958385BFE2B6E

Then I receive the following error message:

GPG error: http://packages.x2go.org/debian stretch InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E1F958385BFE2B6E
gpg: keyserver receive failed: No name

It was working fine till last month. Please check if the public key has changed.

I mark this ticket as critical because at the moment we are unable to even install x2Go for new users.

Regards,
Saion

---

From: Juri Grabowski <[email-masked]>
Date: Wed, 28 Jul 2021 21:40:49 +0200

Hello Saion,

as a quickfix you can use another gpg server:
apt-key adv --recv-keys --keyserver keyserver.ubuntu.com E1F958385BFE2B6E

On debian buster-backports and newer systems you can use extrepo:
apt install extrepo && extrepo enable x2go && apt-get update && apt-get install x2goserver

I have changed this in wiki.

Best Regards,
Juri Grabowski

---

From: "Chatterjee, Saion" <[email-masked]>
Date: Thu, 29 Jul 2021 16:17:15 +0000

Many Thanks Juri,

The quickfix works although it could not verify 2 signatures:

gpg: key E1F958385BFE2B6E: 2 signatures not checked due to missing keys

gpg: key E1F958385BFE2B6E: public key "X2go Debian/Ubuntu Packaging [email-masked]<mailto:[email-masked]>" imported

gpg: Total number processed: 1

gpg:               imported: 1

Do you think this can lead to a security issue due to the 2 signatures not checked?

Best Regards, Saion

---

From: Juri Grabowski <[email-masked]>
Date: Tue, 16 Nov 2021 00:48:18 +0100

Hello together,

>Do you think this can lead to a security issue due to the 2 signatures not checked?
Sorry for long delay. It's OK, right now.

@Heinz:
Default gpg2 setting is to load keys from WebKeyDirectory
I mean it would be nice, if you can create DNS-Entries (A and AAAA) for
openpgpkey.x2go.org like for x2go.org.
On my side I can configure WKD on japsand with: 

1. Add apache vhost
mkdir .well-known/openpgpkey/x2go.org/
cd .well-known/openpgpkey/x2go.org/
apt-get install python3-gnupg
touch policy
wget --content-disposition 'https://gitlab.com/Martin_/generate-openpgpkey-hu-3/-/raw/master/generate-openpgpkey-hu-3?inline=false'
gpg --keyserver keyserver.ubuntu.com --search-keys [email-masked]
python3 generate-openpgpkey-hu-3 -a [email-masked]

Best Regards,
Juri Grabowski

P.S.: wiki.x2go.org don't have AAAA DNS entry. Do you know why? Maybe
can you set it as well.