GPG error updating Debian repositories

Scati

Is there any documentation about how ProGet generate the certificates for Debian repositories? or, where I could find them in a Windows installation? To have something to start working with.
I tried searching for any file with .asc extension, but there is nothing found in my Windows installation, so I guess certificates like stable.asc are generated/stored somehow on the website for download ¿?

I'm totally willing to help as far as I can. Thank you.

atripp

Hi @daniel-scati,

ProGet generates a signing key when you first create a Debian feed; it's stored in the database, so you won't be able to find it on disk. You can "see" (i.e. download) the key under Manage Feed > "signing key".

We don't really document how the key is generated, but looking at the code... we use BouncyCastle to create a 4096-bit nonexpiring PGP key with <feed-name>@proget as the pgp comment. That's what gets saved in the database, and is what you end up downloading.

So creating a new feed would give you a new signing key.

Hope that helps.

Cheers,
Alana

philippe.camelio_3885

Hello
Just in case, starting from Ubuntu 22.04, certificates for Debian repositories stored in Proget can be imported using this command

curl -fsSL ${proget}/${feed}/keys/${feed}.asc | sudo gpg --dearmor  -o /etc/apt/keyrings/${feed}.gpg

A source file in /etc/apt/sources.list.d/ will contain

deb [arch=amd64 signed-by=/etc/apt/keyrings/${feed}.gpg] ${proget}/${feed} ${distribution} ${components}

Best regards
PhilippeC.

atripp

Thanks @philippe-camelio_3885!

Should we update our docs to reflect this? Does this basically only apply to Ubuntu 22.04+?

Currently, the instruction we have uses apt-key add instead:
https://docs.inedo.com/docs/proget-feeds-debian

Thanks,
Alana

philippe.camelio_3885

@atripp
Yes, you should update the doc.
Starting debian 11 and ubuntu 22.04 apt-key is deprecated.

You will find more details on this article

Best regards
PhilippeC.

atripp

@philippe-camelio_3885 thank you much, we just updated the docs :)

Scati

@philippe-camelio_3885 thanks for the piece of advice about how to import the certificate on Jammy, but I already used that way, and it also fails.
After several tests I found out the root of the problem, and strange as it may seem, it is caused for the Description field in the Properties of Manage Feed. The feed description supports markdown format, but if it contains a break line with a blank line, after some minutes (or hours?) it will start to fail in the client when execute an update.
One example of a description that reproduce the bug could be:

**Fabricación**

Instaladores Ubuntu liberados a producción

The second blank line is the one that causes the issue. Fortunately, edit the description removing the blank line solves it

atripp

@daniel-scati great work finding that :)

The Feed Description is written in the Release Index, and the Debian "Stanza" format is kind of weird like that.

However, newlines should already be replaced...

var desc = FeedCache.GetFeed(this.feedId)?.Feed_Description;
if (!string.IsNullOrWhiteSpace(desc))
    writer.WriteLine($"Description: {desc.ReplaceLineEndings("\n ")}");

A blank line with a space isn't supposed to create a new "stanza", but maybe it is in your version?? We'll look closer; perhaps we should just strip the newline altogether and replace it with a space.

Cheers,
Alana

stevedennis

@daniel-scati we'll also get this fixed via PG-2635 in an upcoming maintenance release (hopefully 2024.2), which is targeted for next Friday.

Scati

Fix verified on 2024.2 version.
Thank you.