GPG error: https://cli.github.com/packages stable InRelease: EXPKEYSIG C99B11DEB97541F0 [closed]

Question

Trying to update the GitHub CLI with the apt package manager fails with this error:

Failed to fetch https://cli.github.com/packages/dists/stable/InRelease: The following signatures couldn't be verified because the public key is not available: EXPKEYSIG C99B11DEB97541F0
GPG error: The following signatures were invalid: EXPKEYSIG C99B11DEB97541F0

Donahue

Answer 1

You're seeing this error because the issuer of this certificate (https://github.com/vilmibm) has allowed it to expire. They've stated that this may not be fixed soon, or at all. Your options are:

1. Wait for the certificate to be renewed, so that everything will go back to normal.
2. Ignore the error and install the package anyway with sudo apt install gh --allow-unauthenticated (note this is not a good idea from a security standpoint)
3. Download the latest release and install manually instead of using apt. If you do this you should also remove the source from your packages list so that you won't see the error on update: sudo apt-key del C99B11DEB97541F0 && sudo rm /etc/apt/sources.list.d/github-cli.list

Update 2022-09-07:

A new certificate has now been issued for this package. As per answers from FourDollars and Adam Sherwood below, you can fix/update by following these instructions.

Trawler

Answer 2

You can run the following commands again to fix the GPG error.

curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
&& sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
&& sudo apt update \
&& sudo apt install gh -y

It is noted on https://github.com/cli/cli/blob/trunk/docs/install_linux.md#debian-ubuntu-linux-raspberry-pi-os-apt.

Bor

Answer 3

I am currently running Pop_os (20.04) and had to do the following (note: the first two lines were undoing the previous attempt to use the new accepted method in the docs):

sudo rm /usr/share/keyrings/githubcli-archive-keyring.gpg \
&& sudo rm /etc/apt/sources.list.d/github-cli.list \
&& sudo apt-key del C99B11DEB97541F0 \
&& sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-key 23F3D4EA75716059 \
&& sudo apt-add-repository https://cli.github.com/packages \
&& sudo apt install gh -y

Source: https://github.com/cli/cli/issues/5810#issuecomment-1240200365

Sniffle