For

Manual steps

Steps for those not using the aegir-archive-keyring package.

sudo wget -O /usr/share/keyrings/aegir-archive-keyring.gpg https://debian.aegirproject.org/aegir-archive-keyring.gpg
sudo apt-key add /usr/share/keyrings/aegir-archive-keyring.gpg

Comments

helmo created an issue. See original summary.

helmo’s picture

Two remarks:
- The branch you pushed was '7.x-3.18.1' .. not '7.x-3.18.x' the gitlab-ci.yml config filters on that branch pattern to decide if it needs to run a publish job.
- The version string in the Debian changelog file should not have a suffix like `ubuntu1`

After pushing a new branch gitlab ran the pipeline and pushed new packaged to out resting repo.

I've tested this new package on one system, but the output of apt-key list does not show the updated expire date. What are we doing wrong here?

helmo’s picture

Here's a draft for user instructions.

User instructions:
If you installed the aegir-archive-keyring package then updating it before october 12 should be sufficient.

if you used the recent instructions from http://www.aegirproject.org/#download then you'll have a deb source line deb [signed-by=/usr/share/keyrings/aegir-archive-keyring.gpg] https://debian.aegirproject.org stable main
Use:
sudo wget -O /usr/share/keyrings/aegir-archive-keyring.gpg https://debian.aegirproject.org/aegir-archive-keyring.gpg

Otherwise:

sudo wget -O /usr/share/keyrings/aegir-archive-keyring.gpg https://debian.aegirproject.org/aegir-archive-keyring.gpg
sudo apt-key add /usr/share/keyrings/aegir-archive-keyring.gpg
helmo’s picture

My mention of the lack of change in 'apt-key list' output might be OK. The key in the aegir-archive-keyring only helps if the user has the 'signed-by=' part in their sources.list line.

colan’s picture

Status: Active » Needs review
Related issues: +#3085544: Update Debian repo PGP key

Thanks for finishing this. Let's see if we get any more feedback on it.

I clarified one of my mistakes in the docs. That for doing that for my other one. :)

helmo’s picture

I didn't mention that it was finished :( ... I was testing and had my doubts.

But while we're at it we also need to include #3086056: Update bundled dehydrated ... I'm seeing failing LE renewals.

And we should definitely give some warning about this ... Tweet / mailing list.

colan’s picture

Status: Needs review » Needs work
helmo’s picture

3.18.2 is published ... but dred ... the release branch did not include the updated debian repo key :( ... building 3.18.3 now.

helmo’s picture

Issue summary: View changes
Status: Needs work » Needs review

Done ...
For 3.18.3 I've only published the aegir-archive-keyring package ... the rest of the packages are fine at 3.18.2

For most users a manual update step will be needed ... Added to the release notes. (and the summary here)

sudo wget -O /usr/share/keyrings/aegir-archive-keyring.gpg https://debian.aegirproject.org/aegir-archive-keyring.gpg
sudo apt-key add /usr/share/keyrings/aegir-archive-keyring.gpg
helmo’s picture

Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.