At https://ido.rrq.id.au/download there is an initial collection of trial installer ISOs that need to be tested in a range of settings.

Hi Ralph,
there are no files at https://ido.rrq.id.au/download anymore, is the test period over?
Thanks for your time!

It looks like whomever is in charge of the archive keeps managed to get them resigned with a valid signature.

So suddenly, apt/apt-get updates just started working (magically) again with no need for a manual intervention.

Now: It Just Works.  [tm]

[ On my systems which are running chimaera and beowulf. ]

Last sunday noon, aka So 04 Sep 12:00, my usual workflow (as root) was disrupted by an EXPKEYSIG error: WTF? Network error caused by provider? No. – DNS problem? No. – What is going on? This looks like a serious problem to my local machine and has to be fixed NOW!
 
Wait, eight days later, I want to make a long story short. Since my 1st beginning with Linux kernels and GNU software on rpm based machines I know a true zen say:

Security is a matter of trust.

Once upon the time an "update" process "distrust his master voice" and therefor ignores my well choosen configuration. I've lost data and recovering from this accident takes some time. The change to debian packaging system, change of distribution, was one of the consequences. And the step from debian/jessie to devuan/jessie some years later wasn't that difficult to continue the way with GNU/Linux. Back to the failing apt update (as root;)

I'm not a C-programmer and I have only a vague understanding of so-called elliptic curves"internet security", but last week there was a urgent need for me to find some thing like a Devuan Cryptographic Key. But where? And HOW TO know that this is the right key?

Thanks to ralph.ronnquist I've found two answers. (There has always to be an alternative to init freedom;-) The 1st alternative is "allow-unauthenticated" and/or "allow-insecure-repositories". Does not sound trustworthy, really? The second way looks better to me:

• As a "normal user" with UID>=1000 download the new key to a directory of your choice:

  wget http://deb.devuan.org/devuan/pool/main/d/devuan-keyring/devuan-keyring_2022.09.04_all.deb

  Note: Meanwhile https://www.devuan.org/os/keyring states

  apt-get install devuan-keyring

  but I tend to disagree: wget does one thing download one file, but apt installing one file may affect other packages.

• Verify the checksum by your own, that's to say:

  sha256sum ./devuan-keyring_2022.09.04_all.deb

  has an output of

  96c4a206e8dfdc21138ec619687ef9acf36e1524dd39190c040164f37cc3468d  ./devuan-keyring_2022.09.04_all.deb

  Make sure that's ok!

• Now inject this proved file to your system:

  # dpkg -i ./devuan-keyring_2022.09.04_all.deb

  Note: sudo want's user's password, but I'll prefer a real root shell.

• Then update the package information:

  # apt update

Summary:

As far as I can trust myself;-) I have copied that proved deb-file to an USB stick. Using this file with dpkg -i just before any apt update works on every devuan/jessie 'til chimaera I can reach! AND it keeps my last DVD alive: Around easter 2022 I have burned that raw DVD with chimaera to check discless hardware without internet connection. Updating the keyring is just a small step just before getting another host up and running.

last but not least:

Thanks for all your work and a better new week.

Without changing anything or manually doing a key import, my apt-get update & upgrade procs now work as designed.

I wasn't really looking forward to a manual intervention on my dozen or so systems.  Some of which are sometimes difficult to reach. :-(

So: Many thanks to whomever got the archive signed.  I'm guessing here, but probably with an old but unexpired key... ??

But it works.

Thanx.

At https://ido.rrq.id.au/download there is an initial collection of trial installer ISOs that need to be tested in a range of settings.

Everyone here who doesn't devalue themselves with the label "just a Devuan user" should grab at least one of them and run it through a number of variations, and then report on it, maybe as an email to me. Refer to usecases.html for the primary use case division. VM trials as well as bare-metal trials are good.

EDIT: my alternate email is rrq at rrq dot id dot au

Thanks for your work, Ralph

Everyone here who doesn't devalue themselves with the label "just a Devuan user" should grab at least one of them and run it through a number of variations, and then report on it, maybe as an email to me. Refer to usecases.html for the primary use case division. VM trials as well as bare-metal trials are good.

EDIT: my alternate email is rrq at rrq dot id dot au

Be like our friend MiyoLinux and offer to help out.

This is something that I take for granted...as I'm sure many others do. 

If someone will tell me to tell me how to keep up with the renewal date(s), I will gladly accept that responsibility in order to help the project. 

I may be the creator of a Devuan respin, but I'm not ashamed to admit my lack of knowledge in certain areas. I'm always happy to learn something new.

Lay it on me baby!

Contact me here or by email.

Oh Miyo . . . you are one in a million!! Someone who understands the dynamics of what sustains "free software" and actually steps up  to DO something!!! You will be contacted shortly. Promise . . .

If someone will tell me to tell me how to keep up with the renewal date(s), I will gladly accept that responsibility in order to help the project. 

I may be the creator of a Devuan respin, but I'm not ashamed to admit my lack of knowledge in certain areas. I'm always happy to learn something new.

Lay it on me baby!

Contact me here or by email.

alexkemp wrote:

Ogis1975's is a reasonable question to ask.

I disagree: it's a totally useless question.

Yes, of course. You won't get far with that attitude. By the way, even distrowatch mentioned this key issue. Great promotion for this distro.

P.S.

I have already migrated my machines to Debian land.

Many thanks for the quick fix though.

Edit to add, i found this interesting stackechange post about this, albeit a bit old.
https://security.stackexchange.com/questions/14718/does-openpgp-key-expiration-add-to-security/79386#79386

When Devuan has as many maintainers as Debian has, I would likely expect the same, but until then......

(These things happen.....some other software maintainers have been known to forget to renew keys too.)

EDIT: So glad this problem was sorted out so quickly, many thanks.

ralph, users do not have access to gpg keys, nor do they sign packages with that key "everyday", nor do they run `apt-key list` everyday....
i think it's mostly up to the core team to just put some reminders on key/security processes.
yes, users can help, but you should not rely on others noticing in the first place for core/critical(imho), things.

2c.