4

When running 'sudo apt update' I get the following error:

user@gitlab:~$ sudo apt update
Hit:1 http://security.debian.org/debian-security stretch/updates InRelease
Ign:2 http://ftp.fi.debian.org/debian stretch InRelease
Hit:3 http://ftp.fi.debian.org/debian stretch-updates InRelease
Hit:4 http://ftp.fi.debian.org/debian stretch Release
Get:6 https://packages.gitlab.com/gitlab/gitlab-ee/debian stretch InRelease [23.3 kB]
Err:6 https://packages.gitlab.com/gitlab/gitlab-ee/debian stretch InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3F01618A51312F3F
Fetched 23.3 kB in 2s (11.0 kB/s)
Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://packages.gitlab.com/gitlab/gitlab-ee/debian stretch InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3F01618A51312F3F
W: Failed to fetch https://packages.gitlab.com/gitlab/gitlab-ee/debian/dists/stretch/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3F01618A51312F3F
W: Some index files failed to download. They have been ignored, or old ones used instead.

1 Answer 1

5

The problem is that the key installed by the Gitlab installation script has expired. This can be verified by running sudo apt-key list

user@gitlab:~$ sudo apt-key list
/etc/apt/trusted.gpg
--------------------
pub   rsa4096 2015-04-17 [SC] [expired: 2020-04-15]
      1A4C 919D B987 D435 9396  38B9 1421 9A96 E15E 78F4
uid           [ expired] GitLab B.V. (package repository signing key) <[email protected]>
-------Output Snipped----------

This is easily fixed by running the same command that the Gitlab installation script runs, which will fetch the new key from Gitlab and install it in the APT keyring.

curl -L "https://packages.gitlab.com/gitlab/gitlab-ce/gpgkey" 2> /dev/null | sudo apt-key add - &>/dev/null

After this, the apt-key list command can be rerun to verify that the key was installed properly.

user@gitlab:~$ sudo apt-key list
/etc/apt/trusted.gpg
--------------------
pub   rsa4096 2015-04-17 [SC] [expired: 2020-04-15]
      1A4C 919D B987 D435 9396  38B9 1421 9A96 E15E 78F4
uid           [ expired] GitLab B.V. (package repository signing key) <[email protected]>

pub   rsa4096 2020-03-02 [SC] [expires: 2022-03-02]
      F640 3F65 44A3 8863 DAA0  B6E0 3F01 618A 5131 2F3F
uid           [ unknown] GitLab B.V. (package repository signing key) <[email protected]>
sub   rsa4096 2020-03-02 [E] [expires: 2022-03-02]
3
  • 1
    +1, this was super helpful. Thanks for sharing. Here is a blog that Gitlab put out about the new key.
    – Dominic P
    May 18, 2020 at 20:32
  • 1
    Cheers mate, I had to fix this previously for another repository, but at the time I couldn't find anything concrete on how to do it specifically for Gitlab, so I thought I'd document it here if somebody else runs into the same problem!
    – Stuggi
    May 19, 2020 at 18:29
  • The relevant GitLab document can be found here: docs.gitlab.com/omnibus/update/…
    – 0xA3
    Mar 3, 2022 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .