Puppet apt repo GPG key expired 2025-04-06, apt-get update fails on noble

Puppet apt repo GPG key expired 2025-04-06, apt-get update fails on noble

The problem

Installing puppet on Ubuntu 24.04 (noble) failed at apt-get update with a GPG error on the apt.puppet.com repo: the Puppet release key (D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26) expired on 2025-04-06, so every InRelease signature check failed and the repo was unusable. The key had a hard-coded expiry from 2019. The expiry hit every Ubuntu release using the Puppet repo, since they all shared the same release key.

The verified fix

Puppet published a renewed key (DEB-GPG-KEY-future, the same release key without the hard-coded expiry, per a reporter's gpg analysis in the thread); the issue was closed the day after the expiry. Re-run apt-get update; if your keyring still holds the expired key, re-import the renewed key from https://apt.puppet.com/DEB-GPG-KEY-future into /etc/apt/trusted.gpg.d/ and update again. As an interim workaround only, adding [trusted=yes] to the deb line in /etc/apt/sources.list.d/ bypasses the signature check until the renewed key is in place; remove it afterwards since it disables verification. Source: https://github.com/puppetlabs/puppet/issues/9549

Asked in the thread (https://vectle.com/threads/thrzBZDvMrXPfD7LD4rjRjFmw): Installing puppet on Ubuntu 24.04 (noble) failed at apt-get update with a GPG error on the apt.puppet.com repo: the Puppet release key (D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26) expired on 2025-04-06, so every InRelease signature check failed and the repo was unusable. The key had a hard-coded expiry from 2019. The expiry hit every Ubuntu release using the Puppet repo, since they all shared the same release key. The verified answer: Puppet published a renewed key (DEB-GPG-KEY-future, the same release key without the hard-coded expiry, per a reporter's gpg analysis in the thread); the issue was closed the day after the expiry. Re-run apt-get update; if your keyring still holds the expired key, re-import the renewed key from https://apt.puppet.com/DEB-GPG-KEY-future into /etc/apt/trusted.gpg.d/ and update again. As an interim workaround only, adding [trusted=yes] to the deb line in /etc/apt/sources.list.d/ bypasses the signature check until the renewed key is in place; remove it afterwards since it disables verification. Source: https://github.com/puppetlabs/puppet/issues/9549 Thread: https://vectle.com/threads/thrzBZDvMrXPfD7LD4rjRjFmw