New Linux Repository Signing Keys for Jenkins 2.397 and 2.387.2

Using Jenkins
, ,
21

Getting the same " The repository ‘Debian Jenkins Packages binary/ Release’ is not signed." on a fresh install of Ubuntu 20.04 after running the commands specified in this post:

~$  curl -fsSL https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key | sudo tee   /usr/share/keyrings/jenkins-keyring.asc > /dev/null
~$ echo deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc]   https://pkg.jenkins.io/debian-stable binary/ | sudo tee   /etc/apt/sources.list.d/jenkins.list > /dev/null
~$ sudo apt update
Ign:1 https://pkg.jenkins.io/debian-stable binary/ InRelease
Hit:2 https://pkg.jenkins.io/debian-stable binary/ Release
Get:3 https://pkg.jenkins.io/debian-stable binary/ Release.gpg [833 B]
Ign:3 https://pkg.jenkins.io/debian-stable binary/ Release.gpg
 ...
Reading package lists... Done
W: GPG error: https://pkg.jenkins.io/debian-stable binary/ Release: Unknown error executing apt-key
E: The repository 'https://pkg.jenkins.io/debian-stable binary/ Release' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

This worked for me on a different system about 2 weeks ago so not sure if something changed

22

Googling says its an issue with your system, something with gpg. Which would probably make sense for a fresh install not having gpg installed by default?

23

saw that, but no, it’s installed

:~$ gpg --version
gpg (GnuPG) 2.2.19
libgcrypt 1.8.5
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
24

I just created a fresh Ubuntu 20.04 machine on Google Cloud, installed Java 17, and followed the installation instructions. Installation proceeded without an issue.

One possible difference is that Google Cloud installation images are probably installed with the most recent Ubuntu 20.04 packages. Have you updated your operating system to assure that it has the most recent Ubuntu 20.04 updates installed?

25

Well apt upgrade shows no packages are available to update, but I’m not running Java 17 (wouldn’t think that would make a difference). But since it’s working for you, it leads me to think that IT did something to this system before turning it over to me so I’ll dig some more. Thanks for the help.

26

This looks to have resolved itself overnight. I don’t really understand what went on, but it might have been a CDN issue or something as I could pull the correct cert from one device and on another it would pull the 2023 cert rather than the older one. Most odd. Glitch in a Matrix?

27

Did you try with CIS Ubuntu Linux 20.04 LTS Benchmark v1.1.0.24 - Level 1 on AWS ? For me, it doesn’t work.

28

At this point I’m tempted to lock the thread. It’s not up to mark to spend time and money testing every flavor of Linux, especially ones that are 3+ years old.

That being said, recommend you create a jira ticket with any steps you’ve run, anything you can note about your network. The output of commands you ran.

“It doesn’t work” is never enough to get help

1 Like
29

After reading the man-page of apt-key, on CIS Ubuntu Linux 20.04 LTS, I had to do these:

  • Added the new key
$ sudo apt-key add /usr/share/keyrings/jenkins-keyring.asc
OK
  • List all the existing keys to be sure:
$ apt-key list
/etc/apt/trusted.gpg
--------------------
[...]

pub   rsa4096 2023-03-27 [SC] [expires: 2026-03-26]
      6366 7EE7 4BBA 1F0A 08A6  9872 5BA3 1D57 EF59 75CA
uid           [ unknown] Jenkins Project <jenkinsci-board@googlegroups.com>
sub   rsa4096 2023-03-27 [E] [expires: 2026-03-26]

[...]
  • Updated the file /etc/apt/sources.list.d/jenkins.list like this:
deb https://pkg.jenkins.io/debian-stable binary/
  • Re-run the apt update command:
$ sudo apt update
Hit:1 http://eu-west-1.ec2.archive.ubuntu.com/ubuntu focal InRelease
Hit:2 http://eu-west-1.ec2.archive.ubuntu.com/ubuntu focal-updates InRelease
Hit:3 http://eu-west-1.ec2.archive.ubuntu.com/ubuntu focal-backports InRelease
Ign:4 https://pkg.jenkins.io/debian-stable binary/ InRelease
Hit:5 https://pkg.jenkins.io/debian-stable binary/ Release
Hit:6 http://security.ubuntu.com/ubuntu focal-security InRelease
Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.
30

You are right. My bad.

I tested a new approach for the CIS flavor in my previous post and it seems to work. I will need to test further in my script to be sure.

31

just wanted to post in case it helps someone else - I was able to resolve my issue by doing

sudo chmod 644 /usr/share/keyrings/jenkins-keyring.asc

something I found from another post on a different package having the same issue

1 Like