firefox-nightly giving gpg signing errors

cooler9711 · 2018-02-28 05:46:47

when trying to download firefox-nightly from the AUR, i keep running into this error, no matter if i use yaourt or makepkg. i've tried the solutions online where you use `gpg --recv-keys --keyserver hkp://pgp.mit.edu BBBEBDBB24C6F355` and those didn't help at all.
here is the output of both of these:

yaourt

❯ yaourt -S firefox-nightly

==> Downloading firefox-nightly PKGBUILD from AUR...
x .SRCINFO
x PKGBUILD
x firefox-nightly.desktop
x vendor.js
micman commented on 2017-12-24 22:17			 

Airon90 commented on 2018-01-23 15:51			 

ArchangeGabriel commented on 2018-01-23 19:06			 

Aetf commented on 2018-01-23 19:25			 

ArchangeGabriel commented on 2018-01-23 19:31			 

firefox-nightly 60.0a1.20180123-1  (2018-01-23 19:33)
( Unsupported package: Potentially dangerous ! )
==> Edit PKGBUILD ? [Y/n] ("A" to abort)
==> ------------------------------------
==> n

==> firefox-nightly dependencies:
 - dbus-glib (already installed)
 - gtk3 (already installed)
 - libxt (already installed)
 - nss (already installed)
 - mime-types (already installed)


==> Continue building firefox-nightly ? [Y/n]
==> -----------------------------------------
==> 

==> Building and installing package
==> Making package: firefox-nightly 60.0a1.20180123-1 (Tue Feb 27 22:40:57 MST 2018)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
  -> Found firefox-nightly.desktop
  -> Found vendor.js
  -> Downloading 20180227-firefox-60.0a1.en-US.linux-x86_64.tar.bz2...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 60.2M  100 60.2M    0     0  5263k      0  0:00:11  0:00:11 --:--:-- 6102k
  -> Downloading 20180227-firefox-60.0a1.en-US.linux-x86_64.tar.bz2.asc...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   836  100   836    0     0   2458      0 --:--:-- --:--:-- --:--:--  2458
  -> Downloading 20180227-firefox-60.0a1.en-US.linux-x86_64.txt...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    99  100    99    0     0    289      0 --:--:-- --:--:-- --:--:--   289
==> Validating source files with sha512sums...
    firefox-nightly.desktop ... Passed
    vendor.js ... Passed
==> Validating source_x86_64 files with sha512sums...
    20180227-firefox-60.0a1.en-US.linux-x86_64.tar.bz2 ... Skipped
    20180227-firefox-60.0a1.en-US.linux-x86_64.tar.bz2.asc ... Skipped
    20180227-firefox-60.0a1.en-US.linux-x86_64.txt ... Skipped
==> Verifying source file signatures with gpg...
    20180227-firefox-60.0a1.en-US.linux-x86_64.tar.bz2 ... FAILED
==> ERROR: One or more PGP signatures could not be verified!
==> ERROR: Makepkg was unable to build firefox-nightly.
==> Restart building firefox-nightly ? [y/N]
==> ----------------------------------------
==>

makepkg

❯ makepkg -Sri 
==> Making package: firefox-nightly 60.0a1.20180123-1 (Tue Feb 27 22:43:24 MST 2018)
==> Retrieving sources...
  -> Found firefox-nightly.desktop
  -> Found vendor.js
  -> Downloading 20180227-firefox-60.0a1.en-US.linux-i686.tar.bz2...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 56.7M  100 56.7M    0     0  5091k      0  0:00:11  0:00:11 --:--:-- 6163k
  -> Downloading 20180227-firefox-60.0a1.en-US.linux-i686.tar.bz2.asc...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   836  100   836    0     0   2416      0 --:--:-- --:--:-- --:--:--  2416
  -> Downloading 20180227-firefox-60.0a1.en-US.linux-i686.txt...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    99  100    99    0     0    292      0 --:--:-- --:--:-- --:--:--   291
  -> Found 20180227-firefox-60.0a1.en-US.linux-x86_64.tar.bz2
  -> Found 20180227-firefox-60.0a1.en-US.linux-x86_64.tar.bz2.asc
  -> Found 20180227-firefox-60.0a1.en-US.linux-x86_64.txt
==> Validating source files with sha512sums...
    firefox-nightly.desktop ... Passed
    vendor.js ... Passed
==> Validating source_i686 files with sha512sums...
    20180227-firefox-60.0a1.en-US.linux-i686.tar.bz2 ... Skipped
    20180227-firefox-60.0a1.en-US.linux-i686.tar.bz2.asc ... Skipped
    20180227-firefox-60.0a1.en-US.linux-i686.txt ... Skipped
==> Validating source_x86_64 files with sha512sums...
    20180227-firefox-60.0a1.en-US.linux-x86_64.tar.bz2 ... Skipped
    20180227-firefox-60.0a1.en-US.linux-x86_64.tar.bz2.asc ... Skipped
    20180227-firefox-60.0a1.en-US.linux-x86_64.txt ... Skipped
==> Verifying source file signatures with gpg...
    20180227-firefox-60.0a1.en-US.linux-i686.tar.bz2 ... FAILED (unknown public key BBBEBDBB24C6F355)
    20180227-firefox-60.0a1.en-US.linux-x86_64.tar.bz2 ... FAILED (unknown public key BBBEBDBB24C6F355)
==> ERROR: One or more PGP signatures could not be verified!

Lone_Wolf · 2018-02-28 12:46:23

I would expect a different error, something like untrusted key.

What is the output of

gpg --keyserver hkp://pgp.mit.edu --search-keys BBBEBDBB24C6F355

?

eschwartz · 2018-02-28 15:09:11

cooler9711 wrote:

when trying to download firefox-nightly from the AUR, i keep running into this error, no matter if i use yaourt or makepkg. i've tried the solutions online where you use `gpg --recv-keys --keyserver hkp://pgp.mit.edu BBBEBDBB24C6F355` and those didn't help at all.

When you say they didn't help, what do you actually mean by that? Because your error is consistent with --recv-keys failing to actually download the key, but if the proposed solution failed to execute properly then it is not "didn't help at all", it is "failed horribly and therefore I cannot tell if they would help".

In which case I expect Lone_Wolf's command to also return an error.

cooler9711 · 2018-02-28 23:41:41

Lone_Wolf wrote:

I would expect a different error, something like untrusted key.
What is the output of
gpg --keyserver hkp://pgp.mit.edu --search-keys BBBEBDBB24C6F355
?

❯ gpg --keyserver hkp://pgp.mit.edu --search-keys BBBEBDBB24C6F355
gpg: error searching keyserver: Server indicated a failure
gpg: keyserver search failed: Server indicated a failure

jasonwryan · 2018-02-28 23:45:30

┌─[Veles ~]
└─╼ gpg --keyserver hkp://pgp.mit.edu --search-keys BBBEBDBB24C6F355
gpg: data source: http://pgp.mit.edu:11371
(1)     Mozilla Software Releases <release@mozilla.com>
          4096 bit RSA key 61B7B526D98F0353, created: 2015-07-17
Keys 1-1 of 1 for "BBBEBDBB24C6F355".  Enter number(s), N)ext, or Q)uit > q

loqs · 2018-03-01 00:46:35

What is the output for

gpg --recv-keys --keyserver hkp://pgp.mit.edu BBBEBDBB24C6F355

If you have not added a default keyserver what is the output of

$ gpg -v --search-keys BBBEBDBB24C6F355

If you have added a default keyserver the output of

$ gpg -v --search-keys --keyserver hkps://hkps.pool.sks-keyservers.net BBBEBDBB24C6F355

cooler9711 · 2018-03-01 02:26:12

loqs wrote:

What is the output for
gpg --recv-keys --keyserver hkp://pgp.mit.edu BBBEBDBB24C6F355
If you have not added a default keyserver what is the output of
$ gpg -v --search-keys BBBEBDBB24C6F355

as i don't believe that i've added a default keyserver, here you go:

❯ gpg --recv-keys --keyserver hkp://pgp.mit.edu BBBEBDBB24C6F355
gpg: keyserver receive failed: Server indicated a failure
~
❯ gpg -v --search-keys --keyserver hkps://hkps.pool.sks-keyservers.net BBBEBDBB24C6F355
gpg: error searching keyserver: Server indicated a failure
gpg: keyserver search failed: Server indicated a failure

Last edited by cooler9711 (2018-03-01 02:42:40)

jasonwryan · 2018-03-01 02:32:48

Don't paste screenshots of text, paste the actual text: https://wiki.archlinux.org/index.php/Co … s_and_code

cooler9711 · 2018-03-01 02:43:13

jasonwryan wrote:

Don't paste screenshots of text, paste the actual text: https://wiki.archlinux.org/index.php/Co … s_and_code

got it. thanks

loqs · 2018-03-01 02:44:05

So it appears something is interfering with your use of both hkp and hkps to connect to key servers. Try anyway to confirm hkps is also affected

$ gpg -v --search-keys --keyserver hkps://hkps.pool.sks-keyservers.net BBBEBDBB24C6F355

and please post the output as text in code tags. Also you code try some of the other server pools sks-keyservers.net supply.

Lone_Wolf · 2018-03-01 12:54:56

cooler9711,

I agree with loqs someting is not right wrt connecting to key servers.
please post your ~/.gnupg/gpg.conf

----------------------------------

Eschwartz wrote:

When you say they didn't help, what do you actually mean by that? Because your error is consistent with --recv-keys failing to actually download the key, but if the proposed solution failed to execute properly then it is not "didn't help at all", it is "failed horribly and therefore I cannot tell if they would help".
In which case I expect Lone_Wolf's command to also return an error.

That was exatly my reasoning, but when i posted that i had little time. thanks for the assist.

eschwartz · 2018-03-01 14:51:59

Yup, as expected.
Obviously the OP will get gpg signing errors if gpg itself is having network issues.

Obviously the network issues should be resolved in order to properly use gpg, and this is pretty weird that the default hkps:// server fails as this should be available over the common HTTPS port 443 so it is unlikely to be caused by a simple workplace firewall blocking the hkp:// keyserver port 11371.

In addition to the gpg.conf, I'd like to see nsswitch.conf.

...

As a temporary and extremely awkward workaround for recv-keys not working, you can download the key file via actual HTTPS using the form https://pgp.key-server.io/download/0x${gpg_fingerprint} and gpg --import gpgkey.asc

curl https://pgp.key-server.io/download/0x84818A6819AF4A9B | gpg --import - # Eschwartz's key

cooler9711 · 2018-03-12 02:10:10

Lone_Wolf wrote:

please post your ~/.gnupg/gpg.conf

❯ cat ~/.gnupg/gpg.conf
cat: /home/aus/.gnupg/gpg.conf: No such file or directory

loqs wrote:

Also you code try some of the other server pools sks-keyservers.net supply.

i tried a lot of them, and they all gave the same error message:

❯ gpg -v --search-keys --keyserver hkps://hkps.pool.sks-keyservers.net BBBEBDBB24C6F355
gpg: error searching keyserver: Server indicated a failure
gpg: keyserver search failed: Server indicated a failure
~
❯ gpg -v --search-keys --keyserver https://na.pool.sks-keyservers.net BBBEBDBB24C6F355
gpg: error searching keyserver: Server indicated a failure
gpg: keyserver search failed: Server indicated a failure

Last edited by cooler9711 (2018-03-13 00:23:54)

Lone_Wolf · 2018-03-12 11:16:34

Let's see if adding a config file helps .

create ~/.gnupg/gpg.conf and put this line in it :

keyserver hkp://keys.gnupg.net

Cooler9711, I just realised all your posts are in this thread. are you new to archlinux ?

Maniaxx · 2018-03-12 14:30:09

Try this. Im affected by this as well.
https://bbs.archlinux.org/viewtopic.php?id=220996

loqs · 2018-03-12 20:12:50

@Maniaxx that works around if /etc/nsswitch.conf contains a misconfigured hosts line but I would suggest it is better to fix nsswitch if that is the case.

cooler9711 · 2018-03-12 23:55:22

Lone_Wolf wrote:

Let's see if adding a config file helps .
create ~/.gnupg/gpg.conf and put this line in it :
keyserver hkp://keys.gnupg.net
Cooler9711, I just realised all your posts are in this thread. are you new to archlinux ?

i added the gpg.conf file, rebooted, and it's still giving the same error. also, i've been using arch for about a month now, so i am new, but not a complete newbie at things.

loqs · 2018-03-13 00:02:26

What is the contents of the systems /etc/nsswitch.conf?

cooler9711 · 2018-03-13 00:06:46

loqs wrote:

What is the contents of the systems /etc/nsswitch.conf?

❯ cat /etc/nsswitch.conf
# Name Service Switch configuration file.
# See nsswitch.conf(5) for details.
passwd: files mymachines systemd
group: files mymachines systemd
shadow: files
publickey: files
hosts: files mymachines mdns_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns myhostname
networks: files
protocols: files
services: files
ethers: files
rpc: files
netgroup: files

loqs · 2018-03-13 00:24:46

If you remove avahi support from nsswitch as a test by chaning the hosts line to

hosts: files mymachines myhostname resolve [!UNAVAIL=return] dns

edit:
grammar missing a

Last edited by loqs (2018-03-13 00:27:04)

cooler9711 · 2018-03-13 00:32:51

loqs wrote:

If you remove avahi support from nsswitch as a test by chaning the hosts line to
hosts: files mymachines myhostname resolve [!UNAVAIL=return] dns
edit:
grammar missing a

did it, rebooted, and still failing

loqs · 2018-03-13 00:38:48

What is the output of

$ host hkps.pool.sks-keyservers.net

cooler9711 · 2018-03-13 00:42:48

loqs wrote:

What is the output of
$ host hkps.pool.sks-keyservers.net

❯ host hkps.pool.sks-keyservers.net
hkps.pool.sks-keyservers.net has address 193.224.163.43
hkps.pool.sks-keyservers.net has address 18.9.60.141
hkps.pool.sks-keyservers.net has address 192.94.109.73
hkps.pool.sks-keyservers.net has address 37.191.226.104
hkps.pool.sks-keyservers.net has address 193.164.133.100
hkps.pool.sks-keyservers.net has address 51.15.0.17
hkps.pool.sks-keyservers.net has address 92.43.111.21
hkps.pool.sks-keyservers.net has address 216.66.15.2
hkps.pool.sks-keyservers.net has address 94.142.242.225
hkps.pool.sks-keyservers.net has IPv6 address 2a02:c205:3001:3626::1
hkps.pool.sks-keyservers.net has IPv6 address 2606:1c00:2802::b
hkps.pool.sks-keyservers.net has IPv6 address 2a02:898:31:0:48:4558:73:6b73
hkps.pool.sks-keyservers.net has IPv6 address 2001:470:1:116::6
hkps.pool.sks-keyservers.net has IPv6 address 2001:bc8:214f:200::1
hkps.pool.sks-keyservers.net has IPv6 address 2001:738:0:600:216:3eff:fe02:42
hkps.pool.sks-keyservers.net has IPv6 address 2a01:4a0:59:1000:223:9eff:fe00:100f

loqs · 2018-03-13 00:54:06

killall dirmngr
dirmngr --standard-resolver

In a seperate terminal

gpg -v --search-keys --keyserver hkps://hkps.pool.sks-keyservers.net BBBEBDBB24C6F355

cooler9711 · 2018-03-13 01:07:49

loqs wrote:

killall dirmngr
dirmngr --standard-resolver

In a seperate terminal

gpg -v --search-keys --keyserver hkps://hkps.pool.sks-keyservers.net BBBEBDBB24C6F355

❯ killall dirmngr
dirmngr: no process found

~ 
❯ dirmngr --standard-resolver
dirmngr[6849]: error opening '/home/aus/.gnupg/dirmngr_ldapservers.conf': No such file or directory
dirmngr[6849.0]: permanently loaded certificates: 136
dirmngr[6849.0]:     runtime cached certificates: 0
dirmngr[6849.0]:            trusted certificates: 136 (135,0,0,1)
# Home: /home/aus/.gnupg
# Config: [none]
OK Dirmngr 2.2.5 at your service

❯ gpg -v --search-keys --keyserver hkps://hkps.pool.sks-keyservers.net BBBEBDBB24C6F355
gpg: error searching keyserver: Server indicated a failure
gpg: keyserver search failed: Server indicated a failure

Arch Linux

#1 2018-02-28 05:46:47