Nexus IQ CLI - GPG signature key is expired

Sonatype Lifecycle & Repository Firewall
,
1

Attempting to install nexus iq cli on ubuntu but facing the below error

GPG error: https://repo.sonatype.com/repository/sonatype-apt-hosted stable InRelease: The following signatures were invalid: EXPKEYSIG 68930BE5F3F28EFF Integrations Group <integrations-shared-group@sonatype.com>
The repository 'https://repo.sonatype.com/repository/sonatype-apt-hosted stable InRelease' is not signed.
2

Same here.
Issue occurs on Ubuntu as well as Debian.

3

Thanks for bringing this to our attention, @pav.g and @imgq. The team is aware of the issue and is working towards resolving it. Will keep you posted on a fix!

1 Like
5

Hello,

@mfrost could you please take a look at https://community.sonatype.com/t/nexus-repository-manager-oss-via-apt-no-pubkey/13084 when there’s time for it?
Seems to be the same issue. The Release files have to be resigned again, I think. Maybe you could notify any member of the maintaining team.

Thanks in advance!
Best regards

6

Hi @zyzonix! I’ve put a note into the team about this (the Nexus Repository Manager OSS post) - I’ll let you know when I hear back from someone. Thanks for bringing this to our attention!

1 Like
7

Hi @mfrost , any news on this topic?
Best regards!

8

@zyzonix No news yet - I did send another note, so stay tuned!

1 Like
9

Hi @mfrost ,
the repository was recently updated, all files have been signed again, but it’s still impossible to get the signing key. As I alredy said, the key provided under: https://repo.sonatype.com/#browse/browse:community-hosted:pki%2Fdeb-gpg%2FDEB-GPG-KEY-Sonatype.asc is not the signing key. APT refuses to update securely. It actually makes me sad, that there’s no one just solving this problem by uploading the correct key… Or if already uploaded to provide a URL to it. Why is there no chance to get contact to those people maintaining this repository?

Best regards
Zyzonix