MySQL APT repositories: An error occurred during the signature verification (public key is not available)

Written by Claudio Kuenzler - 2 comments

Published on March 22nd 2022 - Listed in MySQL Linux

---

MySQL runs their own package repositories for community editions of MySQL. They support both yum and apt package managers, separated by sub-directories.

So far so good, but it seems that the previous GPG (to sign the packages) was replaced. This leads to errors when running apt-get update (or apt update):

root@debian:~# apt-get update
Hit:1 http://security.debian.org buster/updates InRelease
Hit:2 https://artifacts.elastic.co/packages/7.x/apt stable InRelease
Hit:3 http://httpredir.debian.org/debian buster InRelease
Get:4 http://repo.mysql.com/apt/debian buster InRelease [22.1 kB]
Hit:5 https://packages.sury.org/php buster InRelease
Err:4 http://repo.mysql.com/apt/debian buster InRelease                                          
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 467B942D3A79BD29
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://repo.mysql.com/apt/debian buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 467B942D3A79BD29
W: Failed to fetch http://repo.mysql.com/apt/debian/dists/buster/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 467B942D3A79BD29
W: Some index files failed to download. They have been ignored, or old ones used instead.

When looking through the repository, no specific APT gpg key could be identified. These files usually end with a suffix of .gpg, .gnupg, .key or similar.

However there is one more intriguing file at the top-level directory of the repository: RPM-GPG-KEY-mysql-2022.

Why intriguing? Because the file starts with RPM, suggesting this key is only used for rpm packages (for the yum package manager). 

Let's import that file with apt-key:

root@debian:~# curl -s http://repo.mysql.com/RPM-GPG-KEY-mysql-2022 | apt-key add -
OK

It worked, so it is a GPG key. But is it the right key for the signed deb packages in the apt repositories?

root@debian:~# apt-get update
Hit:1 http://security.debian.org buster/updates InRelease
Hit:2 http://httpredir.debian.org/debian buster InRelease
Hit:3 https://artifacts.elastic.co/packages/7.x/apt stable InRelease
Get:4 http://repo.mysql.com/apt/debian buster InRelease [22.1 kB]
Hit:5 https://packages.sury.org/php buster InRelease
Get:6 http://repo.mysql.com/apt/debian buster/mysql-8.0 Sources [941 B]
Get:7 http://repo.mysql.com/apt/debian buster/mysql-apt-config amd64 Packages [567 B]
Get:8 http://repo.mysql.com/apt/debian buster/mysql-8.0 amd64 Packages [8,421 B]
Get:9 http://repo.mysql.com/apt/debian buster/mysql-tools amd64 Packages [7,070 B]
Hit:10 https://packagecloud.io/varnishcache/varnish60lts/debian buster InRelease
Fetched 39.1 kB in 1s (35.9 kB/s)
Reading package lists... Done

No errors! Although RPM-GPG-KEY-mysql-2022 sounds confusing, it is indeed the right key for the MySQL APT repository.

Add a comment

Show form to leave a comment

Comments (newest first)

Peter from wrote on Jun 18th, 2022:

Thanks for this post and making the command where it can be copied. This is like the 5th time I've ran into this and finally somebody posted a short, coherent fix.

---

Claude LaBadie from Canada wrote on May 6th, 2022:

Thank you so much for sharing this.
Would creating a better named symlink a good approach?

---