Google-play-music-desktop-player-unofficial-: Debian repo no longer signed and outdated

[G4Zz0L1]

OS:
LInux Mint 18.1 64bit

Issue Descriptions:
The repository is no longer signed, and the application version is outdated

Steps to Reproduce:
Add repository (https://dl.bintray.com/marshallofsound/deb) and apt-get update. For the second part apt-get install google-play-music-desktop-player

[MarshallOfSound]

The application version is 4.2.0 and bintray is still signing the releases, can you actually post any errors you are getting when installing?

(Closing out as it isn't an issue with GPMDP itself rather the install process)

[G4Zz0L1]

The error it gives me is:

E: The repository 'https://dl.bintray.com/marshallofsound/deb debian Release' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

While, for the version:

google-play-music-desktop-player:
Installato: 4.0.5-1
Candidato: 4.0.5-1
Tabella versione:
* 4.0.5-1 500
500 https://dl.bintray.com/marshallofsound/deb debian/main amd64 Packages
100 /var/lib/dpkg/status
4.0.3-1 500
500 https://dl.bintray.com/marshallofsound/deb debian/main amd64 Packages
3.2.5-1 500
500 https://dl.bintray.com/marshallofsound/deb debian/main amd64 Packages
3.2.4-1 500
500 https://dl.bintray.com/marshallofsound/deb trusty/main amd64 Packages

EDIT:
for the first part, i've found this on the update:

Err:52 https://dl.bintray.com/marshallofsound/deb trusty Release.gpg
404 Not Found

[rattboi]

I get the same as above. Unsigned repo.

[MarshallOfSound]

Am contacting bintray support

[G4Zz0L1]

Any news from bintray?

[rattboi]

Any update?

[G4Zz0L1]

Now it updates to the 4.2.0-1, but it still gives the "no signed" error. Something's moving...

[Ocramius]

I'm getting 3.2.4 when downloading from the trusty channel on bintray.

The warning I get is:

Reading package lists... Done
W: The repository 'https://dl.bintray.com/marshallofsound/deb trusty Release' is not signed.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.

[sebastienserre]

same here:
Err:24 https://dl.bintray.com/marshallofsound/deb debian Release.gpg **404 Not Found** E: The repository 'https://dl.bintray.com/marshallofsound/deb debian Release' is no longer signed. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details.

[fastcat]

bintray is signing the packages, but not the repository. Newer versions of APT require the repository to be signed, resulting in the above errors.

Please see https://wiki.debian.org/SecureApt for more info on what needs to be done to make the repository work properly.

[alessiogatto]

I have the same problem with ubuntu 17.04 final beta.

[luislobo]

Same problem here

E: The repository 'https://dl.bintray.com/marshallofsound/deb debian Release' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

[luislobo]

@MarshallOfSound this should not be closed... or we should open a new one

[jwarkentin]

Just ran into this same problem. This is a big issue. I have to disable the repository for now as it's unusable and breaks my update process.

[MarshallOfSound]

Just a question here guys, still chasing this up but have you all followed the instructions and installed the public key as specified in the docs.

wget -qO - https://gpmdp.xyz/bintray-public.key.asc | sudo apt-key add -

[sebastienserre]

Yes I have... and still the same problem.
but where is the doc?

[jwarkentin]

Yes, I tried that several times yesterday. The key is definitely added.

[jasmines]

Why so much time to solve this issue? You're not the only one to use bintray...

[MarshallOfSound]

@jasmines Small things called work and uni sometimes consume time 😆

[dlakomski]

Same here.

[luislobo]

A workaround is adding '[trusted=yes]' to the apt source, so, instead of:

echo "deb https://dl.bintray.com/marshallofsound/deb debian main" | sudo tee -a /etc/apt/sources.list.d/gpmdp.list

you could do:

echo "deb [trusted=yes] https://dl.bintray.com/marshallofsound/deb debian main" | sudo tee -a /etc/apt/sources.list.d/gpmdp.list

BTW, @sebastienserre the Install docs are here:
https://github.com/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/blob/master/docs/Installation_On_Debian.md

@MarshallOfSound These other guys had the same issue and here's some reference on how to solve it: https://github.com/ponylang/ponyc/issues/1433

Edited @sebastienserre fixed the syntax after @jasmines comment below

[sebastienserre]

@luislobo
echo [trusted=yes] "deb https://dl.bintray.com/marshallofsound/deb debian main" | sudo tee -a /etc/apt/sources.list.d/gpmdp.list
give me a " unknown type [trusted=yes] on line1 in the sources list " in /etc/apt/sources.list.d/gpmdp.list"

[jasmines]

echo "deb [trusted=yes] https://dl.bintray.com/marshallofsound/deb debian main" | sudo tee -a /etc/apt/sources.list.d/gpmdp.list

is the right syntax

but it should be the maintener to sign! He is not working on it since march... I prefer uninstall and wait for the official client...

[luislobo]

@jasmines thanks for the clarification, I just pasted it in the wrong place. About your comment, as any open source platform/software, it is AS IS, and the author has no obligation to do anything, specially since it's for free. Also, I don't think Google will make an 'official' desktop version for Linux

[G4Zz0L1]

Indeed. And I'll add that is the only client that works fine among the other that I've tried, without lacking any major function.

[MarshallOfSound]

For everyone watching this thread, I don't think I can retroactively fix this. I uploaded a GPG key ages ago but after the last release. I think it only signs new releases not old ones. So when the next release goes out this should be fixed, until then I don't think I can tell bintray to sign old releases.

but it should be the maintener to sign! He is not working on it since march...

If it makes you feel better I'll quote you and say I have been actively following this up with bintray support and linux users in my community just because I haven't been posting updates doesn't mean I haven't been chipping away at this over time and as @luislobo nicely said

the author has no obligation to do anything

😄

I'll try find a way to tell bintray to sign old releases but I don't think it can be done