Image -> https://postimg.cc/WtZ6QD3V <-Image Hi all, I just installed Kali Linux and ran:

sudo apt update

But I got this error:

GPG error: http://mirrors.tuna.tsinghua.edu.cn/kali  kali-rolling InRelease: 
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 827CB569F2518CC677FECA1AED65462ECB5E4C5
E: The repository is not signed.

I also saw warnings about apt-key being deprecated, and attempts to use curl | gpg returned a 404. --- **What I Want:** I don’t care about using the Tsinghua mirror — I just want a clean fix using the **official Kali sources and keys**. --- **What I’ve Tried:** * Replacing the mirror in /etc/apt/sources.list with the official Kali one. * Using the modern gpg --dearmor method to import the official Kali archive key. My sources.list [I copied it from chatgpt, its not the default one]

# See https://www.kali.org/docs/general-use/kali-linux-sources-list-repositories/ 
deb [signed-by=/etc/apt/keyrings/tuna-kali.gpg] http://mirrors.tuna.tsinghua.edu.cn/kali  kali-rolling main non-free contrib

# Additional line for source packages
# deb-src http://http.kali.org/kali  kali-rolling main contrib non-free non-free-firmware

Thanks in advance!

I've got the problem, that the "apt-get update" produced a KEYEXPIRED 1587841717 error:

# apt-get update
...
W: GPG error: http://archive.debian.org  jessie Release: The following signatures were invalid: KEYEXPIRED 1587841717

Here my sources.list:

# cat /etc/apt/sources.list.d/sources.list
deb http://http.debian.net/debian  jessie main
deb http://http.debian.net/debian  jessie contrib
deb http://archive.debian.org/debian  jessie main
deb http://archive.debian.org/debian  jessie contrib

Here the expired keys found by apt-key (it seems that the key 46925553 expired on 2020-04-25):

apt-key list | grep expired -A1
pub   4096R/46925553 2012-04-27 [expired: 2020-04-25]
uid                  Debian Archive Automatic Signing Key (7.0/wheezy) 
--
pub   4096R/65FFB764 2012-05-08 [expired: 2019-05-07]
uid                  Wheezy Stable Release Key 
--
pub   4096R/B98321F9 2010-08-07 [expired: 2017-08-05]
uid                  Squeeze Stable Release Key 
--
pub   4096R/473041FA 2010-08-27 [expired: 2018-03-05]
uid                  Debian Archive Automatic Signing Key (6.0/squeeze) 
--
pub   4096R/65FFB764 2012-05-08 [expired: 2019-05-07]
uid                  Wheezy Stable Release Key 
--
pub   4096R/46925553 2012-04-27 [expired: 2020-04-25]
uid                  Debian Archive Automatic Signing Key (7.0/wheezy)

Now i tried to renew the keys:

apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 46925553
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 65FFB764
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys B98321F9
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 473041FA

But the keys are not changed:

# apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 46925553
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/tmp.Ue8AFETZOi --no-auto-check-trustdb --trust-model always --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-wheezy-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-wheezy-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian.gpg --keyring /etc/apt/trusted.gpg.d/php.gpg --keyring /etc/apt/trusted.gpg.d/turnkey.gpg --keyring /etc/apt/trusted.gpg.d/ubuntuzilla.firefox.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 46925553
gpg: requesting key 46925553 from hkp server keyserver.ubuntu.com
gpg: key 46925553: "Debian Archive Automatic Signing Key (7.0/wheezy) " not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

A new "apt-get update" get the same error like above. Can anybody help to solve the problem?

I'm getting the error in the title (aead encrypted packet with unknown version 29), when trying to decrypt an encrypted file created in the same environment (Termux on Android, if it matters):

$ gpgtar --encrypt --output e -r attilio test
$ ls
e test
$ gpgtar -d e
gpgtar: gpg: encrypted with cv25519 key, ID 74341D598FFF0056, created 2021-08-13
gpgtar: gpg:       "attilio"
gpgtar: gpg: public key decryption failed: Not a typewriter
gpgtar: gpg: decryption failed: Not a typewriter
gpgtar: gpg: aead encrypted packet with unknown version 29
gpgtar: error running '/data/data/com.termux/files/usr/bin/gpg': exit status 2

I got the usage from here . **Question:** what does this error even mean, and how can I fix it? (Google results only show the source code, so I guess it does not happen all that often.)

In GPG, my own uid presents as [ full ] rather than [ ultimate ].

gpg --list-keys --with-sig-check

pub   ed25519 2025-07-02 [SC] [expires: 2030-07-01]
      GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
uid           [  full  ] Me 
sig!3        XXXXXXXXXXXXXXXX 2025-07-02  [self-signature]
sig!3        XXXXXXXXXXXXXXXX 2025-07-04  [self-signature]
sig!         YYYYYYYYYYYYYYYY 2025-07-03  Person1
sig!         ZZZZZZZZZZZZZZZZ 2025-07-03  Person2
sub   cv25519 2025-07-02 [E] [expires: 2030-07-01]
sig!         XXXXXXXXXXXXXXXX 2025-07-02  [self-signature]
sub   ed25519 2025-07-02 [S]
sig!         XXXXXXXXXXXXXXXX 2025-07-02  [self-signature]

This is pretty weird. If I delete the uid

adduid
uid 2
primary
uid 2
uid 1
deluid

and recreate it:

adduid
uid 2
primary
uid 2
uid 1
deluid

I end up with

gpg --list-keys --with-sig-check

pub   ed25519 2025-07-02 [SC] [expires: 2030-07-01]
      GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
uid           [ultimate] Me 
sig!3        XXXXXXXXXXXXXXXX 2025-07-04  [self-signature]
sub   cv25519 2025-07-02 [E] [expires: 2030-07-01]
sig!         XXXXXXXXXXXXXXXX 2025-07-02  [self-signature]
sub   ed25519 2025-07-02 [S]
sig!         XXXXXXXXXXXXXXXX 2025-07-02  [self-signature]

but once I import Person1 and Person2's signatures, I'm back to [ full ]. What's going on here?

I am using Fedora 40 (KDE) and I have followed the Arch Wiki guide on how to set it up. However, I would like to unlock - or, whatever is happening in the background - my GPG keys upon login. I am trying to set it up in a similar fashion to how ssh-agent works: that it caches the password (?) and it doesn't ask for it when you SSH into a remote machine; it just logs you straight in. The way it works now, is that it caches the password for however long you have set up default-cache-* but if you log out and back in, you'll have to reenter the passphrase.

My PGP-key follows the long-lived-mainkey-short-time-subkeys pattern. Thus I already have 12 expired subkeys attached to my mainkey. When handing out my key today, there seems to be not much reason to include the expired encryption subkeys - nobody's going to need them anymore. Is there a way to only export a few of the **public** subkeys along with the (public) mainkey? I tried to explicitly export the two current subkeys, which should provoke the mainkey to be exported alongside:

gpg -a --export   >output.file

But this command exported the complete key: mainkey with *all* subkeys.

I keep getting a recurring problem in Fedora 41 and now 42 where the GPG database gets locked and nothing I try can get it working. I have to delete the .gnupg directory and re-import my keys all over again. The problem manifests after a reboot and I discover it the next time I try and commit code to git. I have tried: 1. Killing the process. 2. Rebooting. 3. rm -f ~/.gnupg/*.lock 4. gpgconf --kill all && gpgconf --launch gpg-agent Additional info based on question below:

$ gpg --list-keys
gpg: Note: database_open 134217901 waiting for lock (held by 5289) ...
gpg: Note: database_open 134217901 waiting for lock (held by 5289) ...
gpg: Note: database_open 134217901 waiting for lock (held by 5289) ...
gpg: Note: database_open 134217901 waiting for lock (held by 5289) ...
gpg: Note: database_open 134217901 waiting for lock (held by 5289) ...
gpg: keydb_search_first failed: Connection timed out
$ lsof | grep 5289
$$ tree ~/.gnupg
/home/bryon/.gnupg
├── common.conf
├── private-keys-v1.d
│   ├── 3ED6F3A0FE32B7DFEC04340B9AFCDB4842DFDC85.key
│   ├── 6026F43FDF049972ED2ABFF215E85EB4937D6B45.key
│   ├── 81F8A0D8D0E9CD406AE2C89B16AA4D4E872A39AD.key
│   └── FAC9D0944809312FCD2EC1C5B3D9F79210AECF8D.key
├── public-keys.d
│   ├── pubring.db
│   └── pubring.db.lock
└── trustdb.gpg

3 directories, 8 files
$ lsof ~/.gnupg/public-keys.d/pubring.db.lock 
$

A few years ago, I read about secrets being passed to commands without displaying and in an automated or scripting manner. Is possible to do this using pass? I figure if it is setup in a way in which upon boot something similar to ssh-agent to keep the GPG encryption key in memory.

I have problem after upgrading PHP image from 8.0 to PHP image 8.1 and on stackoverflow they sent me there this is my dockerfile:

FROM php:8.1-apache AS apache
RUN a2enmod rewrite

WORKDIR /bin
WORKDIR ../

RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0E98404D386FA1D9 6ED0E7B82643E131 F8D2585B8783D481 BDE6D2B9216EC7A8

RUN apt update \
    && apt install \
    curl \
    git \
    unzip \
    cron \
    libzip-dev \
    libcurl4-openssl-dev \
    pkg-config \
    libssl-dev \
    libpng-dev \
    libjpeg62-turbo-dev \
    libicu-dev \
    wget \
    libcap2-bin \
    procps \
    -y \
    && setcap 'cap_net_bind_service=+ep' /usr/sbin/apache2 \
    && chown www-data:www-data /var/log/apache2 \
    && wget https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.bookworm_amd64.deb  \
    && apt install -y ./wkhtmltox_0.12.6.1-3.bookworm_amd64.deb \
    && rm wkhtmltox_0.12.6.1-3.bookworm_amd64.deb \
    && apt-get clean autoclean \
    && apt-get autoremove --yes
    etc...

During image building I have error;

[0mGet:1 http://deb.debian.org/debian  bookworm InRelease [151 kB]
Get:2 http://deb.debian.org/debian  bookworm-updates InRelease [52.1 kB]
Get:3 http://deb.debian.org/debian-security  bookworm-security InRelease [48.0 kB]
Err:1 http://deb.debian.org/debian  bookworm InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0E98404D386FA1D9 NO_PUBKEY 6ED0E7B82643E131 NO_PUBKEY F8D2585B8783D481
Err:2 http://deb.debian.org/debian  bookworm-updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0E98404D386FA1D9 NO_PUBKEY 6ED0E7B82643E131
Err:3 http://deb.debian.org/debian-security  bookworm-security InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 54404762BBB6E853 NO_PUBKEY BDE6D2B9216EC7A8

If I am adding line:

RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0E98404D386FA1D9 6ED0E7B82643E131 F8D2585B8783D481 BDE6D2B9216EC7A8

There is error:

[91mE: gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of them is required for this operation

If I am adding apt installer of gnupg in dockerfile... there is the same error with public keys so I cannot install it What should I do?

I am trying to make chef-11.16.4-1.el6.x86_64.rpm available to our servers via a local yum repo that we've built. it is not available in RHEL Repos, so i had to manually download and save it in our repo. so here is what i did on yum repo server: 1. cd /packages/rhel65-base/; wget https://opscode-omnibus-packages.s3.amazonaws.com/el/6/x86_64/chef-11.16.4-1.el6.x86_64.rpm 2. createrepo /packages/rhel65-base/ Yum client was able to see the new package available: [user1@testserver01 ~]$ yum list chef Loaded plugins: amazon-id, rhui-lb, security Installed Packages chef.x86_64 11.16.0-1.el6 installed Available Packages chef.x86_64 11.16.4-1.el6 local-rhel65-base But when trying to install the latest package of chef, it ends with below error: warning: rpmts_HdrFromFdno: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY Public key for chef-11.16.4-1.el6.x86_64.rpm is not installed Assuming that the chef rpm has not been signed, i tried to sign it myself by following https://iuscommunity.org/pages/CreatingAGPGKeyandSigningRPMs.html but still couldn't get it working. Some useful info i can find in Chef's website is the SHA1 checksum value of this package. Anyone got ideas/suggestions to solve this issue? thanks!

I'm scratching my head to find a way to correct broken gpg stuff in apt. When i try to install Nodejs : curl -sL https://deb.nodesource.com/setup_7.x | sudo -E bash - sudo apt-get install -y nodejs I get this error : ## You seem to be using Debian version stretch. ## This maps to Debian "jessie"... Adjusting for you... ## Confirming "jessie" is supported... + curl -sLf -o /dev/null 'https://deb.nodesource.com/node_7.x/dists/jessie/Release ' ## Adding the NodeSource signing key to your keyring... + curl -s https://deb.nodesource.com/gpgkey/nodesource.gpg.key | apt-key add - gpg: [don't know]: invalid packet (ctb=00) gpg: keydb_get_keyblock failed: Valeur non trouvée gpg: [don't know]: invalid packet (ctb=00) gpg: /tmp/apt-key-gpghome.ix2LFsfXOw/pubring.gpg: copy to '/tmp/apt-key-gpghome.ix2LFsfXOw/pubring.gpg.tmp' failed: Paquet incorrect gpg: error writing keyring '/tmp/apt-key-gpghome.ix2LFsfXOw/pubring.gpg': Paquet incorrect gpg: [don't know]: invalid packet (ctb=00) gpg: error reading '-': Paquet incorrect gpg: import from '-' failed: Paquet incorrect Error executing command, exiting I use a Debian stretch rc2 with kernel 10.5. Don't know if it's the problem or not. I can't use stable version of debian because i'm running on a Ryzen processor. When i try to install VSCode, i got another error too: W: Erreur de GPG : http://packages.microsoft.com/repos/vscode stable InRelease : Les signatures suivantes n'ont pas pu être vérifiées car la clé publique n'est pas disponible : NO_PUBKEY EB3E94ADBE1229CF W: The repository 'http://packages.microsoft.com/repos/vscode stable InRelease' is not signed. N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use. N: See apt-secure(8) manpage for repository creation and user configuration details. Any idea? [EDIT] This is my source.list deb http://ftp.univ-pau.fr/linux/mirrors/debian/ stretch main non-free contrib deb-src http://ftp.univ-pau.fr/linux/mirrors/debian/ stretch main non-free contrib deb http://security.debian.org/debian-security/ stretch/updates main contrib non-free deb-src http://security.debian.org/debian-security/ stretch/updates main contrib non-free # stretch-updates, previously known as 'volatile' deb http://ftp.univ-pau.fr/linux/mirrors/debian/ stretch-updates main contrib non-free deb-src http://ftp.univ-pau.fr/linux/mirrors/debian/ stretch-updates main contrib non-free # stretch-backports, previously on backports.debian.org deb http://ftp.univ-pau.fr/linux/mirrors/debian/ stretch-backports main contrib non-free deb-src http://ftp.univ-pau.fr/linux/mirrors/debian/ stretch-backports main contrib non-free # deb [arch=amd64] https://download.docker.com/linux/debian/ stretch stable # deb-src [arch=amd64] https://download.docker.com/linux/debian/ stretch stable deb http://www.deb-multimedia.org/ stretch main non-free deb [arch=amd64] http://packages.microsoft.com/repos/vscode stable main

Data is sporadically generated and appended to a file (consider mbox or a log file). I want to store only an encrypted version. For a single "batch" of data, this sort of thing would work:

$ echo hello | gpg -e -r key >file1
$ file1
$ file2
$ sleep 10
$ echo world | gpg -e -r key [...] >>file2
$ 

--- I didn't notice any relevent options in the gpg manpage. I see there is gpgtar but this creates independent files. Encryption output (third example above) seems to be just multiple PGP messages concatenated together, so presumably if there is a way to detect the boundaries, one could split the input and invoke gpg separately on each message although I guess that would be quite inefficient. I see that there is significant overhead for encrypting small amounts of data (598 bytes were added to each chunk in my test) so perhaps there is a better approach.