Yarn Debian key expiry date updated (EXPKEYSIG 23E7166788B63E1E)

[Daniel15]

If you see an error like this:

The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>

Or like this:

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
W: Failed to fetch https://dl.yarnpkg.com/debian/dists/stable/InRelease  The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>

It means that you still have an older version of the GPG key used to sign Yarn releases. The expiry date for this key was extended from 2020 to 2021. To get the updated key, run this:

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -

This will likely be automated in the future.

[dario23]

re automation, the distributions usually have a -keyring package that can be updated with newer keys, maybe you want to look into that? e.g. https://packages.debian.org/buster/debian-archive-keyring

[Daniel15]

@dario23 Yeah, that's what I've been meaning to do, however I just haven't gotten around to it. I think I could add a yarn-keyring package to our repo, add it as a dependency of the yarn package (to ensure everyone has it), and then update that package whenever we change the key.

[alexcdot]

sudo apt-key adv --refresh-keys --keyserver keyserver.ubuntu.com also works to fix this issue for many different packages that have this issue

[Daniel15]

Thanks @alexcdot! That command relies on package repository maintainers uploading their public keys to the Ubuntu keyserver, but most do, so it's usually not an issue :)

[jijothic]

Thank you! @alexcdot

[Shekelme]

Why there's nothing happens after sudo apt-key add - command? I am waiting for several minutes already. Looks like the system is waiting for something...

[mschaaf]

@Shekelme It is waiting for input because you split the command. The command should be taken as it curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -

[Shekelme]

Huge thanks, it helped now!

[millette]

Should 1.22.0 be available for debian ?

[stefanproell]

I needed to enclose the echoed text with quotes, @madzohan

export YARNKEY=yarn-keyring.gpg
curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo gpg --dearmour -o /usr/share/keyrings/$YARNKEY
echo "deb [signed-by=/usr/share/keyrings/$YARNKEY] https://dl.yarnpkg.com/debian stable main" | sudo tee /etc/apt/sources.list.d/yarn.list

[sbekx]

@sbekx don't use apt-key it is deprecated (on latest LTS debian|ubuntu releases)

@madzohan I am aware it is deprecated, however in the 'codebuild/standard/5.0' image when we use the alternative, it continues to fail our builds. Perhaps this is an AWS specific thing. I just wanted to highlight this for anyone using this AWS image specifically.

That said, there are a number of other stacks we need to look at, so I'll re-test and report back.

[mbrodala]

Anyone interested here is what I've put in my Dockerfile now:

RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmour -o /usr/share/keyrings/yarn-keyring.gpg \
    && sed -i '1s;^deb;deb [signed-by=/usr/share/keyrings/yarn-keyring.gpg];' /etc/apt/sources.list.d/yarn.list

This assumes that /etc/apt/sources.list.d/yarn.list already exists and contains deb https://dl.yarnpkg.com/debian/ stable main

[sagepe]

Just to note that Apt (on Debian Bullseye at least) will accept ascii-armoured keys with an .asc extension, so you could, if desired, simply download the key directly as-is without the intermediate pass through gpg --dearmour.

[mbrodala]

Thanks for the hint, this also works fine:

RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg -o /usr/share/keyrings/yarn-keyring.asc \
    && sed -i '1s;^deb;deb [signed-by=/usr/share/keyrings/yarn-keyring.asc];' /etc/apt/sources.list.d/yarn.list

[plumdog]

For AWS Codebuild users, Ubuntu images have now been patched, see aws/aws-codebuild-docker-images#594 (comment).

[evagabond]

Solved by re-installing:

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -
echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list

sudo apt update
sudo apt install yarn

Ref: https://linuxize.com/post/how-to-install-yarn-on-ubuntu-20-04/

[volkert-fastned]

That's funny. I just now noticed that GPG allows both --dearmor and --dearmour, apparently to satisfy both the people who insist on British spelling and those who prefer American spelling. 😁

[elbrashdy]

@Shekelme It is waiting for input because you split the command. The command should be taken as it curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -

worked thanks Bro

[sangnguyendev]

sudo apt-key adv --refresh-keys --keyserver keyserver.ubuntu.com also works to fix this issue for many different packages that have this issue

thanks Bro

[gzamaury]

For those using Docker, since apt-key was deprecated, this works for me:

ENV YARNKEY=yarn-keyring.gpg
RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo gpg --dearmour -o /usr/share/keyrings/$YARNKEY && \
echo "deb [signed-by=/usr/share/keyrings/$YARNKEY] https://dl.yarnpkg.com/debian stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
RUN apt-get update 

Source: https://tickets.dominodatalab.com/hc/en-us/articles/12830637385364-Yarn-Package-invalid-key