Debian feed broken after upgrade to 2025.14

felfert

FYI: Debian feed appears to be broken after upgrade to 2025.14. (host: Rocky9, podman, quadlets, postgres)

Nothing has changed in the feed data and all packages appear to be present in the proget gui of the feed. Yet, an ubuntu client instance (Tested both jammy and noble) cannot find any packages when attempting to install packages from that feed. Client config (apt sources and keys) had been unchanged as well.

After switching back to the previous image (2025.13), everything is back to normal.

CU
-Fritz

dean-houston

Hi @felfert ,

There were major changes to Debian feeds in ProGet 2025.14:
https://blog.inedo.com/inedo/proget-2025-14-major-updates-to-debian-feeds

They were thoroughly tested and we did not encounter issues when upgrading and switching back/forth between versions. As you might imagine, we don't have enough information to help you troubleshoot this - so we'd appreciate if you could investigate further.

It is most certainly a client-related configuration issue and you may need to reconfigure the keys, clear a cache, or something to that effect. Signing keys are typically not changed for already-configured repositories, so this isn't common client behavior.

Please let us know what you find, so we can document appropriately.

-- Dean

felfert

@dean-houston

Hi Dean,
Yes of course. I already expected that, so I'm currently creating a second sandbox instance of proget where I can play around freely. On that instance I will try to reproduce this and analyze it in depth. I will come back to you, when I have analyzed this issue.

Cheers
-Fritz

thomas_3037

Hi,

in our Proget the Debian Feed are also broken after Update to 2025.14.

In the Diagnostic Center we the error:

An error occurred processing a GET request to http://<redacted>/InRelease: error:0200007E:rsa routines::iqmp not inverse of q

Interop+Crypto+OpenSslCryptographicException: error:0200007E:rsa routines::iqmp not inverse of q
   at System.Security.Cryptography.RSAOpenSsl.ImportParameters(RSAParameters parameters)
   at Inedo.LilPgp.PgpSignaturePacket.Sign(ReadOnlySpan`1 data, PgpRsaPrivateKeyPacket privateKey, PgpHashAlgorithm digestAlgorithm, Byte signatureClass, Nullable`1 expirationDate)
   at Inedo.LilPgp.AsciiArmor.ClearTextSign(ReadOnlySpan`1 clearText, IBufferWriter`1 output, PgpRsaPrivateKeyPacket privateKey, PgpHashAlgorithm digestAlgorithm)
   at Inedo.LilPgp.AsciiArmor.ClearTextSign(ReadOnlySpan`1 clearText, Stream output, PgpRsaPrivateKeyPacket privateKey, PgpHashAlgorithm digestAlgorithm)
   at Inedo.ProGet.WebApplication.FeedEndpoints.Debian2.DebianReleaseIndexHandler.<ProcessRequestAsync>g__WriteResponse|0_1(DebianReleaseFile index, <>c__DisplayClass0_0&) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E609935\Src\src\ProGet\WebApplication\FeedEndpoints\Debian2\DebianReleaseIndexHandler.cs:line 70
   at Inedo.ProGet.WebApplication.FeedEndpoints.Debian2.DebianReleaseIndexHandler.ProcessRequestAsync(AhHttpContext context, WebApiContext apiContext, Debian2Feed feed, String relativeUrl) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E609935\Src\src\ProGet\WebApplication\FeedEndpoints\Debian2\DebianReleaseIndexHandler.cs:line 45
   at Inedo.ProGet.WebApplication.FeedEndpoints.Debian2.Debian2FeedHandler.ProcessRequestAsync(AhHttpContext context, WebApiContext apiContext, Debian2Feed feed, String relativeUrl) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E609935\Src\src\ProGet\WebApplication\FeedEndpoints\Debian2\Debian2FeedHandler.cs:line 61
   at Inedo.ProGet.WebApplication.FeedEndpoints.FeedEndpointHandler.FeedRequestHandler.ProcessRequestAsync(AhHttpContext context) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E609935\Src\src\ProGet\WebApplication\FeedEndpoints\FeedEndpointHandler.cs:line 194

::Web Error on 11/13/2025 13:49:14::

dean-houston

Hi @thomas_3037 and @felfert ,

We heard from another users that creating a new signing key in the feed worked, so please try that.

We didn't experience that in our testing, but I suppose it's not all that unexpected given the scope of the changes. We will update the documentation / blog post and also try to put some guidance in the software via PG-3157 to help other users who encounter an error like this.

-- Dean

felfert

@dean-houston

I can confirm, that regenerating the signing keys of all debian feeds solved the problem.
Thanks for your support.

-Fritz

gdivis

Just to keep everyone informed: We are pretty sure we have the underlying issue resolved as of PG-3158. We were incorrectly supplying the wrong InverseQ value to OpenSSL when reading a key from an existing file - so this impacted both uploaded keys and keys from previous ProGet versions. This will be included in next Friday's 2025.15 release, but is available right now at proget.inedo.com/productimages/inedo/proget:25.0.15-ci.4 if anyone would like to test it immediately.