1
$\begingroup$

Rosanswers logo

Edit2: for full details, see ROS GPG Key Expiration Incident on ROS Discourse. For a summary of the fix, see the accepted answer below.


Edit: removed the work-around. Don't use it. See the answer below.


On 2021-05-28, the signing key of the ROS apt repositories expired.

apt update output will be like this:

$ apt update
...
Err:8 http://packages.ros.org/ros2/ubuntu focal InRelease                      
  The following signatures were invalid: EXPKEYSIG F42ED6FBAB17C654 Open Robotics <[email protected]>
...
Reading package lists... Done                         
W: GPG error: http://packages.ros.org/ros2/ubuntu focal InRelease: The following signatures were invalid: EXPKEYSIG F42ED6FBAB17C654 Open Robotics <[email protected]>
E: The repository 'http://packages.ros.org/ros2/ubuntu focal InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

This will cause CIs to fail and regular apt updates on user machines as well (ie: installing ROS using apt is currently not possible).

See Key for downloading ros2 source showing expired on ROS Discourse for where this is being discussed.

See GPG Key Expired for the incident report.

Work is underway to fix this -- which will likely be a replacement of the current key.

If/when more information is available, I'll update this Q&A.

Related issues:

Related PRs:


Originally posted by gvdhoorn on ROS Answers with karma: 86574 on 2021-05-29

Post score: 17


Original comments

Comment by gvdhoorn on 2021-05-29:
Discourse thread about the previous key change: New GPG keys deployed for packages.ros.org. Previous Q&A: #q325039.

Note: the information in those posts does not necessarily help with the current expired key.

$\endgroup$

3 Answers 3

1
$\begingroup$

Rosanswers logo

Edit 2: in case of Docker images/containers still complaining about expired keys: Docker's layer caching could be interfering there. As the key's signature hasn't changed (only it's expiration date), the command to import the key is identical to what it was before the key update.

This could cause Docker's caching to decide to not run the command, causing the expired key to still become part of the image.

Running docker build with --no-cache or introducing a change in the affected Dockerfile (before the key import) would invalidate the cache and should result in the new key getting imported.

Note: the official ros and osrf/ros Docker images have all been updated with the new key.


Edit: there are reports the ROS 2 specific mitigation doesn't work for some users.

The ROS 1 curl command should work in that case.


From ROS GPG Key Expiration Incident on ROS Discourse:

To fix this issue users need to update the public key used for ROS apt repositories. To do this for ROS 1 installations one needs to run a single command, namely:

curl -s https://raw.githubusercontent.com/ros/rosdistro/master/ros.asc | sudo apt-key add -

For ROS 2 installations you will need to run this command:

sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -o /usr/share/keyrings/ros-archive-keyring.gpg

Originally posted by gvdhoorn with karma: 86574 on 2021-05-29

This answer was ACCEPTED on the original site

Post score: 41


Original comments

Comment by Arunbalaji on 2021-08-17:
thank you worked

Comment by yin-ye on 2021-08-26:
This solved my issue, thanks! :)

$\endgroup$
0
$\begingroup$

Rosanswers logo

This is an issue relating to an expired key on the ROS build farm. We'll be posting updated instructions on ROS discourse shortly.

Update can be found here.


Originally posted by kscottz with karma: 209 on 2021-05-29

This answer was NOT ACCEPTED on the original site

Post score: 1


Original comments

Comment by nuclearsandwich on 2021-05-29:
https://discourse.ros.org/t/ros-gpg-key-expiration-incident/20669

$\endgroup$
0
$\begingroup$

Rosanswers logo

I solved this issue referring this : https://github.com/ros2/ros2/issues/742#issuecomment-509685308

$ curl http://repo.ros2.org/repos.key | sudo apt-key add -


Originally posted by kamal_nathan with karma: 143 on 2021-05-29

This answer was NOT ACCEPTED on the original site

Post score: 13


Original comments

Comment by LSD on 2021-06-03:
This answer helped me with my ROS2 docker image.

Comment by gvdhoorn on 2021-06-05:
Note: you're downloading over HTTP. That's not a secure way to download a key file.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.