MX Linux Forum

Eadwine Rose wrote: Wed Mar 13, 2019 8:38 am
I think the last line needs root?

Reloaded in synaptic and all is fine :)

anticapitalista wrote: Wed Mar 13, 2019 8:35 am 3 steps, in a terminal

sudo -v ; wget 'https://download.tuxfamily.org/antix/releases/antix-archive-keyring.asc' -O- | sudo apt-key add - ; sudo apt-get update

GuiGuy wrote: Wed Mar 13, 2019 9:04 am I have done anti's method on this installation and it seems to have worked OK.
But do I now have to fix all my other installations? If so I suppose Fehlix's method looks a bit simpler - has anybody tried it yet?

/etc/apt/trusted.gpg.d/antix-archive-keyring.gpg 

gpg --with-fingerprint  --no-default-keyring --keyring /etc/apt/trusted.gpg.d/antix-archive-keyring.gpg --list-keys
/etc/apt/trusted.gpg.d/antix-archive-keyring.gpg
------------------------------------------------
pub   rsa2048 2013-03-13 [SC] [expires: 2021-05-01]
      ED57 48AC 0E57 5DD2 49A5  6B84 DB36 CDF3 452F 0C20
uid           [ unknown] antiX (antix repo) <repo@antixlinux.com>
sub   rsa2048 2013-03-13 [E] [expires: 2021-05-01] 

/etc/apt/trusted.gpg.d/antix-archive-keyring.gpg 

fehlix wrote: Wed Mar 13, 2019 8:55 am

anticapitalista wrote: Wed Mar 13, 2019 8:35 am 3 steps, in a terminal

Or with one liner ;=):

Code: Select all

sudo -v ; wget 'https://download.tuxfamily.org/antix/releases/antix-archive-keyring.asc' -O- | sudo apt-key add - ; sudo apt-get update

fehlix wrote: Wed Mar 13, 2019 9:11 am........
Conclusion:
Instead of the download method for additonal installs you can copy the new keyring file
from

Code: Select all

/etc/apt/trusted.gpg.d/antix-archive-keyring.gpg 

to your other installations.

GuiGuy wrote: Wed Mar 13, 2019 10:03 am

fehlix wrote: Wed Mar 13, 2019 9:11 am........
Conclusion:
Instead of the download method for additonal installs you can copy the new keyring file
from

Code: Select all

/etc/apt/trusted.gpg.d/antix-archive-keyring.gpg 

to your other installations.

Thanks, Fehlix - that sounds a bit easier .

asqwerth wrote: Wed Mar 13, 2019 10:06 am...........
But after copying, you still need to add the new key. You only save on the step of downloading the key file.

asqwerth wrote: Wed Mar 13, 2019 10:06 am But after copying, you still need to add the new key. You only save on the step of downloading the key file.

GuiGuy wrote: Wed Mar 13, 2019 10:16 am

asqwerth wrote: Wed Mar 13, 2019 10:06 am...........
But after copying, you still need to add the new key. You only save on the step of downloading the key file.

Will "sudo apt-get update" add it OK?
Edit:-
My question is really "How do I add the new key after I have copied it to the correct location?".

anticapitalista wrote: Wed Mar 13, 2019 10:37 am If you copy /etc/apt/trusted.gpg.d/antix-archive-keyring.gpg to all your boxes, run apt-get update and a new antix-archive-keyring deb will show up for installation.

anticapitalista wrote: Wed Mar 13, 2019 10:37 am If you copy /etc/apt/trusted.gpg.d/antix-archive-keyring.gpg to all your boxes, run apt-get update and a new antix-archive-keyring deb will show up for installation.

anticapitalista wrote: Wed Mar 13, 2019 8:35 am For those users getting the EXPKEYSIG error.

Method 1:

3 steps, in a terminal

1.

Code: Select all

wget 'https://download.tuxfamily.org/antix/releases/antix-archive-keyring.asc'

or

Code: Select all

wget 'http://repo.antixlinux.com/antix-archive-keyring.asc'

2.

Code: Select all

sudo apt-key add antix-archive-keyring.asc

3.

Code: Select all

sudo apt-get update

Method 2:

1. Download antix-archive-keyring_20019.3.13_all.deb from here: http://repo.antixlinux.com

In the directory where you downloaded the deb, use gdebi to install or do this -

2.

Code: Select all

sudo dpkg -i antix-archive-keyring_20019.3.13_all.deb

3.

Code: Select all

sudo apt-get update

Method 2:

1. Download antix-archive-keyring_20019.3.13_all.deb from here: http://repo.antixlinux.com

In the directory where you downloaded the deb, use gdebi to install

asqwerth wrote: Sat Mar 16, 2019 12:29 am I think an announcement and the new apt-get instructions should be posted on the announcement section of the forum because I understand the expiry of key is now also affecting the mx15/16 version of said Repo.

MX-16_fan wrote: Sun Mar 17, 2019 3:38 pm @all:

My general question would be whether there would be some safer way of handling situations like that (from a user perspective) – safer than downloading new keys via the open internet.

I remember that there were similar situations with MX-16 or MX-17, and similar advice was given then.

Unfortunately, I'm no expert at all when it comes to this key/signature stuff, but my naïve assumption would be that downloading authentication-related stuff via the open internet would be a no-go, as it breaks the signature/authentication chain of your protected Linux ecosystem.

To me, downloading keyrings via the open internet sounds like an invitation to MIT-attackers (https://en.wikipedia.org/wiki/Man-in-the-middle_attack), who might in this way build bridgeheads that would allow them to compromise other your system.

Please correct me if I'm wrong. As said, I'm not an expert, and I've never really understood the details of apt's handling of keyrings and signatures.


Greetings, and a great week to all of you, Joe

MX-16_fan wrote: Sun Mar 17, 2019 3:38 pm My general question would be whether there would be some safer way of handling situations like that (from a user perspective) – safer than downloading new keys via the open internet.

gpg --with-fingerprint  --no-default-keyring --keyring /etc/apt/trusted.gpg.d/antix-archive-keyring.gpg --list-keys
/etc/apt/trusted.gpg.d/antix-archive-keyring.gpg
------------------------------------------------
pub   rsa2048 2013-03-13 [SC] [expires: 2021-05-01]
      ED57 48AC 0E57 5DD2 49A5  6B84 DB36 CDF3 452F 0C20
uid           [ unknown] antiX (antix repo) <repo@antixlinux.com>
sub   rsa2048 2013-03-13 [E] [expires: 2021-05-01] 

dolphin_oracle wrote: Sun Mar 17, 2019 7:11 pm (...)
I may be off base but...

my understanding of this is that the issue isn't that the repos are encrypted (they aren't), but that they are signed. In order to verify the private signature of the signer of the repo packages, the end user needs the public key, which is what the archive package provides. So actually, its designed to work this way, a public key that is distributed and a private key that is secret. downloading the key from our own server via a link we provide, and having the key work against our own repos should be a strong indication that things are as they should be.

anyone that has ever added a key manually with "apt-key add -" faces a similar issue. I guess if you don't trust the public/private key relationship, you would have to assume that every mirror and every repository and release file was compromised. Since we the operators are saying that nothing was compromised, and the fact that the repo operators are pretty sharp people, I think we are safe in assuming that the keys are good.

the safer and less troublesome method is to update the key archive ahead of time. this one got missed this time. it happens, we are all human.

fehlix wrote: Sun Mar 17, 2019 8:09 pm

MX-16_fan wrote: Sun Mar 17, 2019 3:38 pm My general question would be whether there would be some safer way of handling situations like that (from a user perspective) – safer than downloading new keys via the open internet.

That's actually a good question.
And yes, it is save and secure, even downloading a public-key through the un-encrypted internet is not the issue.
Because, the here shown key-finger print is the key-element to verify the downloaded public-key of the signing key is legitimate.
The user can/should verify the key by it's fingerprint:
One method I have shown above:

Code: Select all

gpg --with-fingerprint  --no-default-keyring --keyring /etc/apt/trusted.gpg.d/antix-archive-keyring.gpg --list-keys
/etc/apt/trusted.gpg.d/antix-archive-keyring.gpg
------------------------------------------------
pub   rsa2048 2013-03-13 [SC] [expires: 2021-05-01]
      ED57 48AC 0E57 5DD2 49A5  6B84 DB36 CDF3 452F 0C20
uid           [ unknown] antiX (antix repo) <repo@antixlinux.com>
sub   rsa2048 2013-03-13 [E] [expires: 2021-05-01] 

And the shown key-fingerprint "ED57 48AC 0E57 5DD2 49A5 6B84 DB36 CDF3 452F 0C20"
is unique and after manually verification save and secure to use and to trust.

First of all, such situation shall not happen, and the issue was fixed 1 day later by providing an additional package through the normal secure update mechanism.
So the question is good, but if carefully proceeded even such unusual situation can be solved fairly securely.
HTH

MX-16_fan wrote: Mon Mar 18, 2019 3:18 pm Thanks for the explanation. Appears to me that this might be a valuable piece of information for the FAQ / Wiki / User Manual as well. Greetings, and have a nice week, Joe

fehlix wrote: Wed Mar 13, 2019 8:55 am

anticapitalista wrote: Wed Mar 13, 2019 8:35 am 3 steps, in a terminal

Or with one liner ;=):

Code: Select all

sudo -v ; wget 'https://download.tuxfamily.org/antix/releases/antix-archive-keyring.asc' -O- | sudo apt-key add - ; sudo apt-get update