Zenn
💡

nginxの署名鍵が期限切れとなった時の対応

2024/07/19に公開
nginx
tech

apt updateを実行したら怒られたので、原因と対応方法のメモ

エラー内容

$ sudo apt update
Hit:1 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu focal InRelease
Get:2 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu focal-updates InRelease [128 kB]
Hit:3 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu focal-backports InRelease
Get:4 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages [3428 kB]
Hit:5 http://security.ubuntu.com/ubuntu focal-security InRelease                                 
Get:6 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu focal-updates/universe amd64 Packages [1210 kB]
Get:7 https://nginx.org/packages/mainline/ubuntu focal InRelease [3602 B]                         
Err:7 https://nginx.org/packages/mainline/ubuntu focal InRelease
  The following signatures were invalid: EXPKEYSIG ABF5BD827BD9BF62 nginx signing key <signing-key@nginx.com>
Fetched 4769 kB in 1s (3694 kB/s)
Reading package lists... Done
Building dependency tree       
Reading state information... Done
16 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://nginx.org/packages/mainline/ubuntu focal InRelease: The following signatures were invalid: EXPKEYSIG ABF5BD827BD9BF62 nginx signing key <signing-key@nginx.com>
W: Failed to fetch https://nginx.org/packages/mainline/ubuntu/dists/focal/InRelease  The following signatures were invalid: EXPKEYSIG ABF5BD827BD9BF62 nginx signing key <signing-key@nginx.com>
W: Some index files failed to download. They have been ignored, or old ones used instead.

原因

調べてみると、どうやら登録済みのnginxの署名鍵の期限が[expired: 2024-06-14]となっているため、有効期限が超過していたのがエラーの原因っぽい。下記を実行するとnginxの署名キーの確認が可能。

$ gpg --dry-run --quiet --no-keyring --import --import-options import-show /usr/share/keyrings/nginx-archive-keyring.gpg

対応方法

新しいnginxの署名鍵をインポートし直して更新する。その後、apt updateが実行できました！

$ curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
    | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
$ sudo apt update

Discussion