Zsh-autosuggestions: Key for zsh-autosuggestions packages in OBS has expired

[JaviMerino]

Describe the bug

INSTALL.md lists the zsh-autosuggestions OBS repository as a way to install it in Ubuntu. However, the release key expired on the 14th of October:

$ apt-key adv --list-key 767B5F350F20116F 
Executing: /tmp/apt-key-gpghome.jKWbDodOp0/gpg.1.sh --list-key 767B5F350F20116F
pub   rsa2048 2017-08-05 [SC] [expired: 2019-10-14]
      4919522E6859A90747C6D97A767B5F350F20116F
uid           [ expired] shells:zsh-users OBS Project <shells:[email protected]>

I'm not sure if github is the correct place to raise this bug, but I hope that if it isn't, someone can tell where is the right place.

To Reproduce

Steps to reproduce the behavior:

In an Ubuntu 18.04 system, following the instructions linked in the INSTALL.md:

$ wget -nv https://download.opensuse.org/repositories/shells:zsh-users:zsh-autosuggestions/xUbuntu_18.04/Release.key -O Release.key
2019-10-16 09:21:17 URL:https://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04/Release.key [1110/1110] -> "Release.key" [1]

$ sudo apt-key add Release.key
OK



md5-33c46501f89d77c3a228a3af74f309f2



$ sudo apt-get update
[...]
Ign:8 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  InRelease
Hit:9 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release
[...]
Err:13 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release.gpg
  The following signatures were invalid: EXPKEYSIG 767B5F350F20116F shells:zsh-users OBS Project <shells:[email protected]>
Reading package lists... Done 
Building dependency tree
Reading state information... Done
All packages are up to date.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release: The following signatures were invalid: EXPKEYSIG 767B5F350F20116F shells:zsh-users OBS Project <shells:[email protected]>
W: Failed to fetch http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04/Release.gpg  The following signatures were invalid: EXPKEYSIG 767B5F350F20116F shells:zsh-users OBS Project <shells:[email protected]>

Expected behavior

The certificate should expire in the future.

Desktop

• OS + distribution: Ubuntu 18.04
• Zsh version: 5.4.2
• Plugin version: 0.5.0+1.1

[ericfreese]

@nicoulaj can you take a look at this?

[omarefg]

Same here.

[nicoulaj]

The OBS shows the key as valid until 2021-12-08, so I'm not sure what is going here. I tried launching a full rebuild of the packages, let's see if that helps.

[cr-lgl]

Is there no workaround yet?

[zamanmh1]

Still experiencing this also.

[peterlewis]

My experience has been that this is still an issue, as of just now. Does anyone know if there are any further developments? Many thanks!

[ericfreese]

@nicoulaj Do you know anything more about the key that @JaviMerino's output said expired 2019-10-14?

[KarlScheibelhofer]

The key in the Ubuntu 18.04 repo expired as mentioned above.

$ wget -qnv https://download.opensuse.org/repositories/shells:zsh-users:zsh-autosuggestions/xUbuntu_18.04/Release.key -O- | gpg
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2017-08-05 [SC] [expired: 2019-10-14]
      4919522E6859A90747C6D97A767B5F350F20116F
uid           shells:zsh-users OBS Project <shells:[email protected]>

Whereas the key in the 19.10 repo is still valid.

$ wget -qnv https://download.opensuse.org/repositories/shells:zsh-users:zsh-autosuggestions/xUbuntu_19.10/Release.key -O- | gpg
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2017-08-05 [SC] [expires: 2021-12-08]
      4919522E6859A90747C6D97A767B5F350F20116F
uid           shells:zsh-users OBS Project <shells:[email protected]>

It is the same key in both repos, but with different expiration dates. Thus, one can simply import the key of the 19.10 repo and use it with the 18.04.

sudo sh -c "echo 'deb http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04/ /' > /etc/apt/sources.list.d/shells:zsh-users:zsh-autosuggestions.list"
wget -nv https://download.opensuse.org/repositories/shells:zsh-users:zsh-autosuggestions/xUbuntu_19.10/Release.key -O Release.key
sudo apt-key add - < Release.key
sudo apt-get update
sudo apt-get install zsh-autosuggestions

For me, this works. Maybe, someone can update the Release.key in the 18.04 repo, e.g. replace it with the one from the 19.10 repo.

[nicoulaj]

It should be working now

[Hero9909]

sorry but on ubuntu 18.04 the gpg verification failed
see:

Ign:5 http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release.gpg                                                                
Paketlisten werden gelesen... Fertig                                                                                                                                             
W: GPG-Fehler: http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release: Die folgenden Signaturen waren ungültig: EXPKEYSIG 767B5F
350F20116F shells:zsh-users OBS Project <shells:[email protected]>                                                                                                    
E: Das Depot »http://download.opensuse.org/repositories/shells:/zsh-users:/zsh-autosuggestions/xUbuntu_18.04  Release« ist nicht signiert.                                       
N: Eine Aktualisierung von solch einem Depot kann nicht auf eine sichere Art durchgeführt werden, daher ist es standardmäßig deaktiviert.

btw using the 19th key works fine

[adreo00]

I was still experiencing this issue until I used the keys from 19.10 as @KarlScheibelhofer recommended.