Dotdeb packages are now signed!

July 11, 2010 · Guillaume Plessis

After many requests from several users and after many months of promise, the Dotdeb repositories are GPG-signed. Yes, you can now get rid of the annoying " WARNING: The following packages cannot be authenticated!" message!

Waiting for a dotdeb-keyring package, you just have to get the key and add it to your trusted keys’ keyring :

gpg --keyserver keys.gnupg.net --recv-key 89DF5277
gpg -a --export 89DF5277 | sudo apt-key add -

I hope you’ll enjoy it.

acid July 11, 2010
I love you! Seriously, thanx for your work!!
daniel July 11, 2010
gorgeous
danei July 12, 2010
Yes I enjoy that :P
amine July 12, 2010
nice
amine July 12, 2010
Hi have a problem,
i added in the /etc/apt/sources.list
deb http://packages.dotdeb.org stable all deb-src http://packages.dotdeb.org stable all
when i do apt-get update i have this error :
W: GPG error: http://packages.dotdeb.org stable Release: Les signatures suivantes n’ont pas pu être vérifiées car la clé publique n’est pas disponible : NO_PUBKEY E9C74FEEA2098A6E
any idea please ?
DotDeb: The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY E9C74FEEA2098A6E | Admin Serveur July 12, 2010
[…] billet sur le Blog de DotDeb.org indique une méthode, qui chez moi n’a pas fonctionné pour ajouter les clés de […]
Guillaume Plessis July 12, 2010
@amine : just fetch the GnuPG key and add it to your APT keyring, as explained in the above post.
- Mateo August 4, 2014
  How can one add the key in the APT keyring?
  - Mateo August 5, 2014
    E: Unable to locate package php5 is where I am stuck. Can someone help? Thanks.
    - Guillaume Plessis August 5, 2014
      @Mateo : could you please avoid sending 4 messages for the same issue? Did you follow the instructions on this page? /instructions/
      If so, could you please send the result of apt-cache policy php5 and follow the steps here : /2012/08/24/how-to-post-useful-bug-reports/
      Thanks.
gosi July 12, 2010
Thanks for all your effort!
Jockl July 12, 2010
Thank you! Everything worked fine…as always! :)
waiter July 13, 2010
Cool! Thanks a lot!
Tyrael July 13, 2010
thank you! :)
Tyrael
The BLION Corp. July 14, 2010
Hello,
Great. With these signatures, I (or even my customers) can now upgrade directly from Virtualmin panel.
Pandark July 14, 2010
Thank you very much.
If it doesn’t work first, you may have to open the 11371 port as I did.
H.T July 16, 2010
Bonjour,
Merci pour la signature des paquets. Pour chipoter est il vraiment nécessaire d’inscrire “sudo” avant le apt-key add ?
Pour ceux qui utilisent la puissance de root sans autre forme de procès ça peut être perturbant ;)
- Guillaume Plessis July 17, 2010
  @H.T. : à chacun d’adopter la politique de sécurité qui lui sied :)
Joshaven Potter July 16, 2010
I got the following error: W: GPG error: http://php53.dotdeb.org stable Release: The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY E9C74FEEA2098A6E W: You may want to run apt-get update to correct these problems
After trying the above I got: gpg: keyserver timed out gpg: keyserver receive failed: keyserver error
and fixed everything with: wget http://packages.dotdeb.org/dotdeb.gpg && apt-key add dotdeb.gpg && rm dotdeb.gpg
Scott Grayban July 19, 2010
oh hell ya !!!
Njko July 19, 2010
Great news!
honestly i tought lets go to see dotdeb if the packages are now signed.. and first message I see was this one.
Thanks a lot man!
MySQL-Installation unter Debian - Delphi-PRAXiS July 20, 2010
[…] […]
Vide July 22, 2010
Thanks!
Adub July 23, 2010
@Joshaven Potter Thank you so much! Your solution worked wonders for me.
JarekMk July 24, 2010
Guillaume, did you checked mailbox?
Guillaume Plessis July 24, 2010
@JarekMk : I’ll answer soon
JarekMk July 25, 2010
OK I wait. Thank you.
petr July 27, 2010
hello, file on http://packages.dotdeb.org/dotdeb.gpg is not found? :-( . this file is for download on another location? help.pls.
Guillaume Plessis July 27, 2010
@petr : it’s back. Sorry. You could use keys.gnupg.net to receive the key instead.
petr July 27, 2010
@Guillaume Plessis thx , all ok new :-)
Dotdeb GPG zu Keyring hinzufügen August 5, 2010
[…] der Key in den eigenen Keyring aufgenommen werden. Auf der Seite von dotdeb selber wird gezeigt wie das funktioniert. Mit folgenden Befehlen sollte alles getan […]
kepi August 13, 2010
Finally, thanks!
vixns August 20, 2010
http://packages.dotdeb.org/dotdeb.gpg => 404
Guillaume Plessis August 20, 2010
@vixns : Please use keys.gnupg.net tu get the key.
Speckles August 30, 2010
Note: if your system doesn’t have the gpg command, the package to get it is called gnupg. Since it took me several hours to figure this out, I figured I should post this here to save any fellow newbs some time.
karfes September 1, 2010
am new with this keyring issue, how do you fetch for the GnuPG key? i need some guide
Burn September 3, 2010
> gpg –keyserver keys.gnupg.net –recv-key 89DF5277 gpg: requesting key 89DF5277 from hkp server keys.gnupg.net gpg: keyserver timed out gpg: keyserver receive failed: keyserver error > wget http://packages.dotdeb.org/dotdeb.gpg && apt-key add dotdeb.gpg && rm dotdeb.gpg –2010-09-03 04:43:17– http://packages.dotdeb.org/dotdeb.gpg Resolving packages.dotdeb.org… 79.125.3.21 Connecting to packages.dotdeb.org|79.125.3.21|:80… connected. HTTP request sent, awaiting response… 404 Not Found 2010-09-03 04:43:17 ERROR 404: Not Found.
Mentalow September 5, 2010
Hey The key isnt found with your guide! The key doesnt exist in the database
Scott Grayban September 6, 2010
Wow people really do not read anything these days.
The error was “keyserver timed out” doh !! So for the newbies with no education that means the keyserver is having a issue not “key not found”.
Second read /2010/07/11/dotdeb-packages-are-now-signed/#comment-2556
Start reading instead of being spoon fed here.
Burn September 6, 2010
after disabling the firewall, I got the key successufly
tim September 7, 2010
sweet
kirk1h September 17, 2010
i have no idea why the key is not on this server nor on keys.gnupg.net anymore. if anyone need the key, you can download it from my server:
wget http://88.198.62.123/randomstuff/dotdeb.gpg sudo apt-key add dotdeb.gpg
Guillaume Plessis September 17, 2010
Here it is : /dotdeb.gpg
Scott Grayban September 26, 2010
Gui are you going to make a signing package people can install instead ?
I think that would be best if not having the key imported automatically when they update there apt.
I think all you have to do is create Release.gpg with your pubkey in it.

Scott Grayban September 26, 2010

Setting up a secure apt repository

From man apt-secure

If you want to provide archive signatures in an archive under your maintenance you have to:

* Create a toplevel Release file. if it does not exist already. You can do this by running apt-ftparchive release (provided inftp apt-utils).
* Sign it. You can do this by running gpg -abs -o Release.gpg Release.
* Publish the key fingerprint, that way your users will know what key they need to import in order to authenticate the files in the archive.

Whenever the contents of the archive changes (new packages are added or removed) the archive maintainer has to follow the first two steps previously outlined.

Guillaume Plessis September 27, 2010
@Scott Grayban : the repository is signed using the two steps you described. I just have to make a dotdeb-keyring package but I need some more work on it.
Toxic292 September 30, 2010
Ports used with command “gpg –keyserver […]” are the followings :
hkp 11371/tcp # OpenPGP HTTP Keyserver hkp 11371/udp # OpenPGP HTTP Keyserver
For the lucky ones that can configure there firewall…
mysql 5.1.51 sobre debian lenny (a lo fácil) — Mis Historias October 7, 2010
[…] www.dotdeb.org […]
flo November 25, 2010
Just use this:
wget /dotdeb.gpg && apt-key add dotdeb.gpg && rm dotdeb.gpg
Where can I find the gpg key for dotdeb.org November 29, 2010
[…] Answers nbartolomeo Accord to this: /2009/03/11/php-529-is-packaged-at-last/#comment-1332 the packages in that repo are not GPG signed so there is no key. Considering that comment is 6 months old now I could be wrong but I can’t find anything to the contrary. April 23, 2010 12:29 pm ax The Dotdeb repositories just (July 11th, 2010) got GPG-signed: […]
JP January 3, 2011
This took me a little while to figure out, so this is what worked for me:
wget -q -O - /dotdeb.gpg | sudo apt-key add -
Scott January 3, 2011
There are a number of ways to import the key.
neissa January 18, 2011
Open port out tpc 11371 ;-) for gpg
Scott January 18, 2011
Port 11371 has nothing to do with gpg package signing.
Installing PHP 5.3.x in Ubuntu through apt-get or aptitude - Night Dreaming (by Sudar) January 25, 2011
[…] packages are GPGsigned. Issue the following commands to add the keys to key-ring {"error":"Not Found"}<html> […]
DEBIAN – MISE À JOUR DU SYSTÈME ET DOTDEB January 31, 2011
[…] stable all deb-src http://php53.dotdeb.org stable allAjout des clés GPG pour DotdebLes paquets Dotdeb sont signés, pour ne pas avoir de message d’alerte, tapez donc les commandes suivantes pour télécharger […]
Ellis Software » Archives du blog » Debian – Mise à jour du système et Dotdeb February 14, 2011
[…] Les paquets Dotdeb sont signés, pour ne pas avoir de message d’alerte, tapez donc les commandes suivantes pour télécharger et ajouter la clé Dotdeb : […]
Using Munin to monitor a Debian Squeeze server | Kevin Deldycke July 19, 2011
[…] if you don’t want to get those error messages about untrusted packages, don’t forget to add Dotdeb’s keys to your keyring.We can now test that nginx is working by starting it up then fetch the default served page: $ […]
Where can I find the gpg key for dotdeb.org - Admins Goodies August 20, 2011
[…] The Dotdeb repositories just (July 11th, 2010) got GPG-signed: […]
Paulo Graça November 3, 2011
For me it worked the following: > wget -q -O – /dotdeb.gpg > sudo apt-key add dotdeb.gpg
- Marcelo February 27, 2013
  Paulo!
  worked for me too! thks a lot.
Installing PHP 5.3.x in Ubuntu through apt-get or aptitude | Web Development Blog March 22, 2012
[…] packages are GPGsigned. Issue the following commands to add the keys to key-ring gpg –keyserver keys.gnupg.net […]
さくらのVPSでDebian 6をセットアップ #3(Dotdeb) | input*output September 30, 2012
[…] ググってみると、Dotdebの公式ブログの記事がでてきたので、記事に書かれているコマンドを実行してみます。 […]
Where can I find the gpg key for dotdeb.org - Just just easy answers September 6, 2013
[…] The Dotdeb repositories just (July 11th, 2010) got GPG-signed: […]
Mateo August 5, 2014
I think I am ready to go here, but when I attempt to install php55 or any version of php I get the following msg: “E: Unable to locate package php55”
Scott August 7, 2014
I cant believe that people can be so lazy as to not read the whole post describing how to add your signed key into apt.