# Debian Buster keys expired? **URL:** \ **Category:** I.MX6\ **Created:** [March 16, 2022, 11:58pm UTC](https://community.solid-run.com/t/debian-buster-keys-expired/266 "2022-03-16T23:58:09Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jeffutter](https://dub1.discourse-cdn.com/flex005/user_avatar/community.solid-run.com/jeffutter/32/89_2.png) [@jeffutter](https://community.solid-run.com/u/jeffutter)\ **Post date:** [March 16, 2022, 11:58pm UTC](https://community.solid-run.com/t/debian-buster-keys-expired/266/1 "2022-03-16T23:58:09Z")
I have an old cubox running the solid run buster builds. It looks like some of the apt gpg keys have expired. I get the following when I `apt-get` update: ```auto # apt-get update Hit:1 http://security.debian.org buster/updates InRelease Hit:2 http://httpredir.debian.org/debian buster InRelease Hit:3 http://httpredir.debian.org/debian buster-updates InRelease Hit:4 https://repo.solid-build.xyz/debian/buster/bsp-any ./ InRelease Hit:5 https://repo.solid-build.xyz/debian/buster/bsp-imx6 ./ InRelease Hit:6 http://ftp.debian.org/debian buster-backports InRelease Err:5 https://repo.solid-build.xyz/debian/buster/bsp-imx6 ./ InRelease The following signatures were invalid: EXPKEYSIG A86C36D7E45C02CD BSP:IMX6 OBS Project Hit:7 https://download.docker.com/linux/debian buster InRelease Reading package lists... Done W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://repo.solid-build.xyz/debian/buster/bsp-imx6 ./ InRelease: The following signatures were invalid: EXPKEYSIG A86C36D7E45C02CD BSP:IMX6 OBS Project W: Failed to fetch https://repo.solid-build.xyz/debian/buster/bsp-imx6/./InRelease The following signatures were invalid: EXPKEYSIG A86C36D7E45C02CD BSP:IMX6 OBS Project W: Some index files failed to download. They have been ignored, or old ones used instead. ``` Furthermore, it looks like a handful of keys expired yesterday? ```auto # apt-key list | grep -A 1 expired pub rsa2048 2019-02-17 [SC] [expired: 2022-03-15] FD5A 27BB B509 878E 6DE6 2804 F74C F2AB F1A0 B0E5 uid [expired] BSP:8040 OBS Project -- pub rsa2048 2015-08-14 [SC] [expired: 2022-03-15] 7F6D 0395 2638 7534 04CF A949 A86C 36D7 E45C 02CD uid [expired] BSP:IMX6 OBS Project -- pub rsa2048 2018-10-11 [SC] [expired: 2022-03-15] E8CA 607A 7CAD 4CFF C2E0 8A62 E15E AD09 6857 6D90 uid [expired] BSP:IMX8 OBS Project -- pub rsa2048 2020-01-05 [SC] [expired: 2022-03-15] 4120 07B5 4021 CB24 0969 4D88 4BF8 C443 814B 9D0F uid [expired] BSP:LX2K OBS Project ``` I’ve tried installing the keys from here: [pkg-solidrun-keyring/active-keys at master · SolidRun/pkg-solidrun-keyring · GitHub](https://github.com/SolidRun/pkg-solidrun-keyring/tree/master/active-keys) But that doesn’t seem to fix the issue. I think the apt repo is signed with the expired key. Is there an apt repo that is signed with the updated v2 key in the above github repo? ---
**Author:** ![jnettlet](https://dub1.discourse-cdn.com/flex005/user_avatar/community.solid-run.com/jnettlet/32/62_2.png) [@jnettlet](https://community.solid-run.com/u/jnettlet)\ **Post date:** [March 17, 2022, 7:06am UTC](https://community.solid-run.com/t/debian-buster-keys-expired/266/2 "2022-03-17T07:06:15Z")
I have pinged our Debian package maintainer. They will get back to you shortly. ---
**Author:** ![Josua](https://avatars.discourse-cdn.com/v4/letter/j/e47774/32.png) [@Josua](https://community.solid-run.com/u/Josua)\ **Post date:** [March 17, 2022, 8:48am UTC](https://community.solid-run.com/t/debian-buster-keys-expired/266/3 "2022-03-17T08:48:45Z")
\o/ You are correct in your findings, the signing key has expired. I can assure you that you are not losing out on any updates, as there are none. However we are currently transitioning our infrastructure targeting Debian to a new solution, and will provide new repositories as new images are going to be available. ---
**Author:** ![Gareth.Halbert](https://avatars.discourse-cdn.com/v4/letter/g/dfb087/32.png) [@Gareth.Halbert](https://community.solid-run.com/u/Gareth.Halbert)\ **Post date:** [March 25, 2022, 1:11am UTC](https://community.solid-run.com/t/debian-buster-keys-expired/266/4 "2022-03-25T01:11:52Z")
Hi all, is their any update to when this will be fixed? ---
**Author:** ![dahmage](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@dahmage](https://community.solid-run.com/u/dahmage)\ **Post date:** [March 30, 2022, 3:34pm UTC](https://community.solid-run.com/t/debian-buster-keys-expired/266/5 "2022-03-30T15:34:57Z")
I have this same issue. ---
**Author:** ![fff](https://avatars.discourse-cdn.com/v4/letter/f/9de053/32.png) [@fff](https://community.solid-run.com/u/fff)\ **Post date:** [April 27, 2022, 12:53am UTC](https://community.solid-run.com/t/debian-buster-keys-expired/266/6 "2022-04-27T00:53:09Z")
This issue means “apt-get upgrade” fails before other installed packages upgrade. The only workaround I’ve found is to individually update other packages with "sudo apt-get install --only-upgrade ". This is a pain for your customers, that can’t be that hard to fix. ---
**Author:** ![stef](https://avatars.discourse-cdn.com/v4/letter/s/76d3ee/32.png) [@stef](https://community.solid-run.com/u/stef)\ **Post date:** [September 11, 2022, 5:49am UTC](https://community.solid-run.com/t/debian-buster-keys-expired/266/7 "2022-09-11T05:49:22Z")
Still not updated 🙃 ---
**Author:** ![fair](https://dub1.discourse-cdn.com/flex005/user_avatar/community.solid-run.com/fair/32/218_2.png) [@fair](https://community.solid-run.com/u/fair)\ **Post date:** [July 23, 2023, 5:16pm UTC](https://community.solid-run.com/t/debian-buster-keys-expired/266/8 "2023-07-23T17:16:09Z")
This is still an issue. Given that Debian 12 / Bookworm has been released, are there any plans for ever fixing this? Also, are Bookworm builds planned? [Index of /debian/](https://repo.solid-build.xyz/debian/) still only goes up to Bullseye. ---
**Author:** ![505](https://avatars.discourse-cdn.com/v4/letter/5/97f17d/32.png) [@505](https://community.solid-run.com/u/505)\ **Post date:** [September 15, 2023, 2:20pm UTC](https://community.solid-run.com/t/debian-buster-keys-expired/266/9 "2023-09-15T14:20:46Z")
Not sure if it was ever written here, but I just discovered there is a new keyring package, version 2022.07.04 that seems to fix this. But it fails to update because the old key is invalid. The easiest solution appears to be a temporary change to the sources list. For each of the solidrun repos, add: `deb [allow-insecure=yes] https://repo.solid-build.xyz/debian/bullseye/bsp-any ./` Add the thing between square brackets. Now just do a regular update/upgrade and it will install the new key package. After that you can remove the `allow-insecure` again.