Error With The X-Road Package Repository Metadata

Owned by Petteri Kivimäki
Last updated: May 08, 2023
2 min read

Problem

When updating the X-Road package repository metadata, the following error message is returned:

Ubuntu
$ sudo apt update . . . W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://artifactory.niis.org/xroad-release-deb bionic-current InRelease: The following signatures were invalid: EXPKEYSIG FB0D532C10F6EC5B NIIS Repository Automatic Signing Key <info@niis.org> W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://artifactory.niis.org/xroad-snapshot-deb bionic-snapshot InRelease: The following signatures were invalid: EXPKEYSIG FB0D532C10F6EC5B NIIS Repository Automatic Signing Key <info@niis.org> W: Failed to fetch https://artifactory.niis.org/xroad-release-deb/dists/bionic-current/InRelease The following signatures were invalid: EXPKEYSIG FB0D532C10F6EC5B NIIS Repository Automatic Signing Key <info@niis.org> W: Failed to fetch https://artifactory.niis.org/xroad-snapshot-deb/dists/bionic-snapshot/InRelease The following signatures were invalid: EXPKEYSIG FB0D532C10F6EC5B NIIS Repository Automatic Signing Key <info@niis.org> W: Some index files failed to download. They have been ignored, or old ones used instead.
RHEL
$ sudo yum update . . Retrieving key from https://artifactory.niis.org/api/gpg/key/public xroad-remote-repository/signature | 1.4 kB 00:00:00 !!! https://artifactory.niis.org/xroad-release-rpm/rhel/7/current/repodata/repomd.xml: [Errno -1] repomd.xml signature could not be verified for xroad-remote-repository

Solution

The reason for the error is that the X-Road repository metadata has changed, e.g., the expiry date of the sign key has changed. The sign key expiry date is updated every two years so it's normal to receive the error every two years.

The solution is to add again the X-Road repository’s signing key to the list of trusted keys:

Ubuntu
curl https://artifactory.niis.org/api/gpg/key/public | sudo apt-key add -
RHEL

Repository sign key info

Hash: 935CC5E7FA5397B171749F80D6E3973B
Fingerprint: A01B FE41 B9D8 EAF4 872F A3F1 FB0D 532C 10F6 EC5B
3rd party key server: Ubuntu key server

Related articles