Installer not working: Can't check signature: No public key

[dlangBugzillaToGithub]

Robert reported this on 2024-02-13T07:14:12Z

Transferred from https://issues.dlang.org/show_bug.cgi?id=24392

CC List

• Martin Nowak (@MartinNowak)
• Iain Buclaw (@ibuclaw)
• Matthew Cook
• Robert

Description

I cannot install D because the installer is failing right away when trying to verify the install.sh script:

robert@fedora:~$ curl -fsS https://dlang.org/install.sh | bash -s dmd
Downloading https://dlang.org/d-keyring.gpg
######################################################################## 100.0%
Downloading https://dlang.org/install.sh
######################################################################## 100.0%
gpg: Signature made Mon 02 Jan 2023 01:47:04 PM CET
gpg:                using RSA key 30AE2FC45DE4153268ED91754CF5FA5326CC62EB
gpg: Can't check signature: No public key
Invalid signature https://dlang.org/install.sh.sig

I am on Fedora 39 (I know there is an RPM but I still wanted to report this bug).

[dlangBugzillaToGithub]

code (@MartinNowak) commented on 2024-08-07T16:03:26Z

Due to https://github.com/dlang/dlang.org/pull/3769#issuecomment-2273811808 not signing the updated keyring.

[dlangBugzillaToGithub]

code (@MartinNowak) commented on 2024-08-07T16:04:41Z

(In reply to Martin Nowak from comment #1)
> Due to https://github.com/dlang/dlang.org/pull/3769#issuecomment-2273811808
> not signing the updated keyring.

A workaround is to import the updated key manually for now.

`gpg --recv-keys E22EC04C82780970381402F4A7D4D42F8EC6A355`

[dlangBugzillaToGithub]

code (@MartinNowak) commented on 2024-09-25T15:21:35Z

More specifically, the keyring was updated by now, but it wasn't signed with any of the existing keys, hence `install.sh update` might fail verifying the new d-keyring. Maybe we should skip that verification step to not complicate bootstrapping that much.

> A workaround is to import the updated key manually for now.
> `gpg --recv-keys E22EC04C82780970381402F4A7D4D42F8EC6A355`

Actually that should update the dlang keyring, not the default one.

`gpg --keyring ~/dlang/d-keyring.gpg --no-default-keyring --recv-keys E22EC04C82780970381402F4A7D4D42F8EC6A355`

[dlangBugzillaToGithub]

code (@MartinNowak) commented on 2024-09-25T15:23:12Z

*** Issue 24767 has been marked as a duplicate of this issue. ***

[robertschulze]

This appears to not be working anymore:

[root@pve-onedrive ~]# curl -fsS https://dlang.org/install.sh | bash -s dmd
Downloading https://dlang.org/d-keyring.gpg
######################################################################## 100.0%
Downloading https://dlang.org/install.sh
######################################################################## 100.0%
gpg: Signature made Mon Apr  1 20:02:30 2024 UTC
gpg:                using RSA key E22EC04C82780970381402F4A7D4D42F8EC6A355
gpg: Can't check signature: No public key
Invalid signature https://dlang.org/install.sh.sig
[root@pve-onedrive ~]# gpg --keyring ~/dlang/d-keyring.gpg --no-default-keyring --recv-keys E22EC04C82780970381402F4A7D4D42F8EC6A355
gpg: key 4CF5FA5326CC62EB: public key "Iain Buclaw <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
[root@pve-onedrive ~]# curl -fsS https://dlang.org/install.sh | bash -s dmd
Downloading https://dlang.org/d-keyring.gpg
######################################################################## 100.0%
gpg: Signature made Mon Feb 13 22:52:51 2023 UTC
gpg:                using RSA key E22EC04C82780970381402F4A7D4D42F8EC6A355
gpg: BAD signature from "Iain Buclaw <[email protected]>" [expired]
Invalid signature https://dlang.org/d-keyring.gpg.sig
[root@pve-onedrive ~]# 

[robertschulze]

What I did:

[root@pve-onedrive ~]# cd dlang
[root@pve-onedrive dlang]# rm d-keyring.gpg 
[root@pve-onedrive dlang]# wget https://dlang.org/d-keyring.gpg.sig

Probably highly insecure but at least it worked...