Bazel: Ubuntu 16.04 PPA key expired

[jpeabodyjr]

ATTENTION! Please read and follow:

• if this is a _question_ about how to build / test / query / deploy using Bazel, ask it on StackOverflow instead: https://stackoverflow.com/questions/tagged/bazel
• if this is a _discussion starter_, send it to [email protected]
• if this is a _bug_ or _feature request_, fill the form below as best as you can.

Description of the problem / feature request:

It appears that the key for the Ubuntu 16.04 PPA has expired. Running sudo apt-get update produces the following:

Hit:1 http://us.archive.ubuntu.com/ubuntu xenial InRelease
Hit:2 http://us.archive.ubuntu.com/ubuntu xenial-updates InRelease
Hit:3 http://us.archive.ubuntu.com/ubuntu xenial-backports InRelease
Hit:4 http://storage.googleapis.com/bazel-apt stable InRelease
Hit:5 http://ppa.launchpad.net/beineri/opt-qt562-xenial/ubuntu xenial InRelease
Hit:6 http://security.ubuntu.com/ubuntu xenial-security InRelease
Ign:7 https://apt.buildkite.com/buildkite-agent stable InRelease
Hit:8 https://apt.buildkite.com/buildkite-agent stable Release
Hit:9 http://ppa.launchpad.net/beineri/opt-qt563-xenial/ubuntu xenial InRelease
Err:4 http://storage.googleapis.com/bazel-apt stable InRelease
  The following signatures were invalid: KEYEXPIRED 1527185977  KEYEXPIRED 1527185977  KEYEXPIRED 1527185977
Hit:11 http://ppa.launchpad.net/git-core/ppa/ubuntu xenial InRelease
Hit:12 https://packagecloud.io/github/git-lfs/ubuntu xenial InRelease
Hit:13 http://ppa.launchpad.net/graphics-drivers/ppa/ubuntu xenial InRelease
Hit:14 http://ppa.launchpad.net/mc3man/mpv-tests/ubuntu xenial InRelease
Hit:15 http://ppa.launchpad.net/paulo-miguel-dias/mesa/ubuntu xenial InRelease
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://storage.googleapis.com/bazel-apt stable InRelease: The following signatures were invalid: KEYEXPIRED 1527185977  KEYEXPIRED 1527185977  KEYEXPIRED 1527185977
W: Failed to fetch http://storage.googleapis.com/bazel-apt/dists/stable/InRelease  The following signatures were invalid: KEYEXPIRED 1527185977  KEYEXPIRED 1527185977  KEYEXPIRED 1527185977
W: Some index files failed to download. They have been ignored, or old ones used instead.

The /etc/apt/sources.list.d/storage_googleapis_com_bazel_apt.list contains:

deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8

Feature requests: what underlying problem are you trying to solve with this feature?

Allow Ubuntu 16.04 users to continue to apt-get install the latest version of bazel.

Bugs: what's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Execute sudo apt-get update on a Ubuntu 16.04 machine with the http://storage.googleapis.com/bazel-apt PPA installed.

What operating system are you running Bazel on?

Ubuntu 16.04

What's the output of bazel info release?

Starting local Bazel server and connecting to it...
.
release 0.13.0

[whizzzkid]

Can confirm, got this error:

W: Failed to fetch http://storage.googleapis.com/bazel-apt/dists/stable/InRelease  The following signatures were invalid: KEYEXPIRED 1527185977  KEYEXPIRED 1527185977  KEYEXPIRED 1527185977

basically this key is not good anymore: https://bazel.build/bazel-release.pub.gpg

[paladox]

Im getting this too.

W: GPG error: http://storage.googleapis.com stable InRelease: The following signatures were invalid: KEYEXPIRED 1527185977 KEYEXPIRED 1527185977 KEYEXPIRED 1527185977

on debian

[jin]

cc @buchgr @jmmv

[jin]

Marking this as P0 because it's blocking user workflows.

[jin]

Workaround from [email protected]:

For anyone working around this, just use the gpg provided by

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 71A1D0EFCFEB6281FD0437C93D5919B448457EE0

it appears that's been updated to last till 2020, while the one listed on https://docs.bazel.build/versions/master/install-ubuntu.html isn't.

Cheers
Paul

https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/bazel-dev/Llq6fetzgac/ngdC_QSrAAAJ

[ulfjack]

I have no idea how to do an emergency push of the website. I think this is the location that we need to update:
https://bazel.build/bazel-release.pub.gpg

We may have to wait until @buchgr is in the office.

[ulfjack]

(We should change the instructions to get the key from the keyserver instead.)

[ulfjack]

We're not sure when the change will show up on the website, but we think it shouldn't take longer than ~an hour.

[jpeabodyjr]

I can confirm that reinstalling the key resolves the issue; sudo apt-get update runs successfully.

curl https://bazel.build/bazel-release.pub.gpg | sudo apt-key add -
# Followed by
sudo apt-get update

Thanks for the timely fix!

[ImJasonH]

Can you also update https://storage.googleapis.com/bazel-apt/doc/apt-key.pub.gpg ? This was recommended in previous versions of the installation instructions and is breaking our CI (and presumably some others). We'll update to the new instructions after this release.

[buchgr]

@ImJasonH done.

[ImJasonH]

@buchgr I get Anonymous caller does not have storage.objects.get access to bazel-apt/doc/apt-key.pub.gpg. -- I suspect you need to mark it as publicly visible.

[katre]

I'm taking a look

[katre]

This should be publicly available now.

[buchgr]

@ImJasonH sorry marked public. should work now

[PKS2211]

Awesome @jin's suggestion worked for me.

[danindiana]

Just confirming that curl https://bazel.build/bazel-release.pub.gpg | sudo apt-key add -
fixes issue.

OS: Ubuntu 16.04 xenial
Kernel: x86_64 Linux 4.13.0-45-generic
Uptime: 11h 27m
Packages: 3183
Shell: bash 4.3.48
Resolution: 2560x1080
DE: Unity 7.4.5
WM: Compiz
WM Theme: Radiance
Radiance [GTK2]
, Radiance [GTK3]
Icon Theme: ubuntu-mono-light
Font: Ubuntu 11
CPU: AMD Ryzen 5 1600X Six-Core @ 4GHz
GPU: GeForce GTX 1050
RAM: 5808MiB / 16034MiB

[tlc]

I believe this is broken again.

$ sudo apt-get update
Hit:1 http://storage.googleapis.com/bazel-apt stable InRelease
....
Reading package lists... Done 
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://storage.googleapis.com/tensorflow-serving-apt stable InRelease: The following signatures were invalid: KEYEXPIRED 1531525724  KEYEXPIRED 1531525724  KEYEXPIRED 1531525724
W: Failed to fetch http://storage.googleapis.com/tensorflow-serving-apt/dists/stable/InRelease  The following signatures were invalid: KEYEXPIRED 1531525724  KEYEXPIRED 1531525724  KEYEXPIRED 1531525724

$ curl https://bazel.build/bazel-release.pub.gpg | sudo apt-key add -
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  4654  100  4654    0     0  11436      0 --:--:-- --:--:-- --:--:-- 11434



md5-33e966514c69b79fd2071fd80769def5



$ sudo apt-get update
Hit:1 http://storage.googleapis.com/bazel-apt stable InRelease
...                                              
Reading package lists... Done 
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://storage.googleapis.com/tensorflow-serving-apt stable InRelease: The following signatures were invalid: KEYEXPIRED 1531525724  KEYEXPIRED 1531525724  KEYEXPIRED 1531525724
W: Failed to fetch http://storage.googleapis.com/tensorflow-serving-apt/dists/stable/InRelease  The following signatures were invalid: KEYEXPIRED 1531525724  KEYEXPIRED 1531525724  KEYEXPIRED 1531525724
W: Some index files failed to download. They have been ignored, or old ones used instead.

[jin]

@tlc That looks like Tensorflow Serving's key
https://www.tensorflow.org/serving/setup#installing_using_apt and not
Bazel's?

On Fri, Nov 16, 2018 at 10:40 AM tlc [e-mail] wrote:

I believe this is broken again.

$ sudo apt-get update
Hit:1 http://storage.googleapis.com/bazel-apt stable InRelease
....
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://storage.googleapis.com/tensorflow-serving-apt stable InRelease: The following signatures were invalid: KEYEXPIRED 1531525724 KEYEXPIRED 1531525724 KEYEXPIRED 1531525724
W: Failed to fetch http://storage.googleapis.com/tensorflow-serving-apt/dists/stable/InRelease The following signatures were invalid: KEYEXPIRED 1531525724 KEYEXPIRED 1531525724 KEYEXPIRED 1531525724

$ curl https://bazel.build/bazel-release.pub.gpg | sudo apt-key add -
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 4654 100 4654 0 0 11436 0 --:--:-- --:--:-- --:--:-- 11434

$ sudo apt-get update
Hit:1 http://storage.googleapis.com/bazel-apt stable InRelease
...
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://storage.googleapis.com/tensorflow-serving-apt stable InRelease: The following signatures were invalid: KEYEXPIRED 1531525724 KEYEXPIRED 1531525724 KEYEXPIRED 1531525724
W: Failed to fetch http://storage.googleapis.com/tensorflow-serving-apt/dists/stable/InRelease The following signatures were invalid: KEYEXPIRED 1531525724 KEYEXPIRED 1531525724 KEYEXPIRED 1531525724
W: Some index files failed to download. They have been ignored, or old ones used instead.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/bazelbuild/bazel/issues/5261#issuecomment-439432729,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAVPDhER8CT6ZTnqFWOmofiOkbC1wwl7ks5uvtxogaJpZM4UM2Lf
.

[tlc]

Ugh. Sorry, you're right.

[naveenkumarmulabitmovin]

I can confirm that reinstalling the key resolves the issue; sudo apt-get update runs successfully.

curl https://bazel.build/bazel-release.pub.gpg | sudo apt-key add -
# Followed by
sudo apt-get update

Thanks for the timely fix!

I did not work in my case. I am still seeing the error.
An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://storage.googleapis.com/tensorflow-serving-apt stable InRelease: The following signatures were invalid: EXPKEYSIG 544B7F63BF9E4D5F Tensorflow Serving Developer (Tensorflow Serving APT repository key) [e-mail]
W: Failed to fetch http://storage.googleapis.com/tensorflow-serving-apt/dists/stable/InRelease The following signatures were invalid: EXPKEYSIG 544B7F63BF9E4D5F Tensorflow Serving Developer (Tensorflow Serving APT repository key) [e-mail]
W: Some index files failed to download. They have been ignored, or old ones used instead.

[alexattia]

I have the same error. It appeared the key mentioned on this link https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/bazel-dev/Llq6fetzgac/ngdC_QSrAAAJ was available until today (May 25th 2020).
Does anyone have an idea? 😃

[jin]

It's been resolved, please see instructions here: https://github.com/bazelbuild/bazel/issues/11470#issuecomment-633205152