# Apt update fails on Debian Bullseye **URL:** \ **Category:** ZYMKEY4\ **Created:** [October 3, 2024, 2:37pm UTC](https://community.zymbit.com/t/apt-update-fails-on-debian-bullseye/1698 "2024-10-03T14:37:50Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![afunix](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.zymbit.com/afunix/32/412_2.png) [@afunix](https://community.zymbit.com/u/afunix)\ **Post date:** [October 3, 2024, 2:37pm UTC](https://community.zymbit.com/t/apt-update-fails-on-debian-bullseye/1698/1 "2024-10-03T14:37:50Z")
Hello. Recently apt update for Bullseye started to fail with expired GPG key: ```auto ... Err:6 https://zk-sw-repo.s3.amazonaws.com/apt-repo-bullseye bullseye InRelease The following signatures were invalid: EXPKEYSIG CAA5E9C8755D21A0 scott@zymbit.com ... W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://zk-sw-repo.s3.amazonaws.com/apt-repo-bullseye bullseye InRelease: The following signatures were invalid: EXPKEYSIG CAA5E9C8755D21A0 scott@zymbit.com W: Failed to fetch https://zk-sw-repo.s3.amazonaws.com/apt-repo-bullseye/dists/bullseye/InRelease The following signatures were invalid: EXPKEYSIG CAA5E9C8755D21A0 scott@zymbit.com ``` I’ve tried to remove /etc/apt/sources.list.d/zymbit.list file and re-run the latest install\_zk\_sw.sh. It actually downloaded /usr/share/keyrings/zymbit.gpg and created /etc/apt/sources.list.d/zymbit.list in the new format. However apt update still fails: ```auto ... Err:7 https://zk-sw-repo.s3.amazonaws.com/apt-repo-bullseye-aarch64 bullseye InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY CAA5E9C8755D21A0 ... W: GPG error: https://zk-sw-repo.s3.amazonaws.com/apt-repo-bullseye-aarch64 bullseye InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY CAA5E9C8755D21A0 E: The repository 'https://zk-sw-repo.s3.amazonaws.com/apt-repo-bullseye-aarch64 bullseye InRelease' is not signed. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details. ``` Note: URL changed and it looks like the signature does not match the downloaded key. ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [October 4, 2024, 3:12pm UTC](https://community.zymbit.com/t/apt-update-fails-on-debian-bullseye/1698/2 "2024-10-04T15:12:24Z")
@afunix - Let me double-check this for you today. I think all you should need to do is update the local key if you already had everything installed. ```bash curl -L https://zk-sw-repo.s3.amazonaws.com/apt-zymkey-pubkey.gpg | sudo gpg --dearmor --yes -o /usr/share/keyrings/zymbit.gpg ``` ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [October 4, 2024, 6:02pm UTC](https://community.zymbit.com/t/apt-update-fails-on-debian-bullseye/1698/3 "2024-10-04T18:02:16Z")
A clean install works for me, but I see the same thing with an `apt update` on an old install. In most cases, /etc/apt/sources.list.d/zymbit.list is already correct and all you need to do is pull the new key: ```bash curl -L https://zk-sw-repo.s3.amazonaws.com/apt-zymkey-pubkey.gpg | sudo gpg --dearmor --yes -o /usr/share/keyrings/zymbit.gpg ``` To get an old install to work, I had to edit my `/etc/apt/sources.list.d/zymbit.list`. Make sure the `signed-by` option is included in `/etc/apt/sources.list.d/zymbit.list`, This parameter - `[signed-by=/usr/share/keyrings/zymbit.gpg]` The following will check and fix for you, ```bash sudo sed -i 's/^deb https/deb [signed-by=\/usr\/share\/keyrings\/zymbit.gpg] https/' /etc/apt/sources.list.d/zymbit.list ``` ---
**Author:** ![afunix](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.zymbit.com/afunix/32/412_2.png) [@afunix](https://community.zymbit.com/u/afunix)\ **Post date:** [October 7, 2024, 4:59pm UTC](https://community.zymbit.com/t/apt-update-fails-on-debian-bullseye/1698/4 "2024-10-07T16:59:11Z")
Bob, My zymbit.list looks like: ```auto deb [signed-by=/usr/share/keyrings/zymbit.gpg] https://zk-sw-repo.s3.amazonaws.com/apt-repo-bullseye-aarch64/ bullseye main ``` The key itself: ```auto # md5sum /usr/share/keyrings/zymbit.gpg 455260a5db93cb9a113cac4df04916a0 /usr/share/keyrings/zymbit.gpg ``` Still apt update complains: ```auto Err:7 https://zk-sw-repo.s3.amazonaws.com/apt-repo-bullseye-aarch64 bullseye InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY CAA5E9C8755D21A0 ``` ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [October 7, 2024, 6:47pm UTC](https://community.zymbit.com/t/apt-update-fails-on-debian-bullseye/1698/5 "2024-10-07T18:47:28Z")
That key matches my working setup. Can you maybe try the deprecated method with apt-key? The new method runs fine with bullseye and later for me, but just in case… ```auto sudo su curl -L https://zk-sw-repo.s3.amazonaws.com/apt-zymkey-pubkey.gpg | apt-key add - ``` ---
**Author:** ![afunix](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.zymbit.com/afunix/32/412_2.png) [@afunix](https://community.zymbit.com/u/afunix)\ **Post date:** [October 7, 2024, 9:22pm UTC](https://community.zymbit.com/t/apt-update-fails-on-debian-bullseye/1698/6 "2024-10-07T21:22:25Z")
It complains apt-key is deprecated, but works, so apt update is successful. So it looks like install\_zk\_sw.sh does not support Debian 11 anymore ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [October 7, 2024, 10:02pm UTC](https://community.zymbit.com/t/apt-update-fails-on-debian-bullseye/1698/7 "2024-10-07T22:02:54Z")
Ok thanks. Like I said, I did a clean install\_zk\_sw.sh on Debian 11 to verify the new key worked.