Bug#745735: apt: Provide meaningful exit codes for gpg failures

--z3ms7svwukc6xkgn
Content-Type: text/plain; protected-headers=v1; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Subject: Re: Bug#745735: apt: Provide meaningful exit codes for gpg failures
MIME-Version: 1.0

Am Fri, Jul 24, 2026 at 06:15:07PM +0200, schrieb Michael Prokop:
> IMO we should clearly exit with non-zero in case of failures in apt
> in such situations.
>=20
> The behavior in apt v3.0.3 is still like this:
>=20
> | % sudo apt update
> | [=E2=80=A6]
> | Err:5 https://demo.example.org/custom trixie InRelease
> |   The following signatures were invalid: EXPKEYSIG BEFORE1FAILS2342 Aut=
omatic Signing Key <[email protected]>
> | [=E2=80=A6]
> | W: An error occurred during the signature verification. The repository =
is not updated and the previous index files will be used. GPG error: http:/=
/demo.example.org/custom trixie InRelease: The following signatures were in=
valid: EXPKEYSIG BEFORE1FAILS2342 Automatic Signing Key <[email protected]>
> | W: Failed to fetch https://demo.example.org/custom/dists/trixie/InRelea=
se  The following signatures were invalid: EXPKEYSIG BEFORE1FAILS2342 Autom=
atic Signing Key <[email protected]>
> | W: Some index files failed to download. They have been ignored, or old =
ones used instead.
> | % echo $?
> | 0
> | %
>=20
> I've seen too many unpatched + hacked systems which ended up as such
> due to expired GPG keys in their (usually 3rd party) Debian
> repositories. IMO this might even warrant a CVE.

If apt were to exit non-zero in these situations you would "see too many
unpatched + hacked systems" as unattended upgrades from the main
(and security) repositories of your distribution are not applied thanks
to some tiny long forgotten 3rd party repo the user might not even have
any packages installed from any longer=E2=80=A6

So, I don't think there is a trivial black-or-white answer.

I also note that with `--error-on=3Dany` nowadays you can make these types
of problems result in a non-zero exit code. There exists currently no
way of programmatically knowing the difference through.


Best regards

David Kalnischkies

--z3ms7svwukc6xkgn
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE5sn+Q4uCja/tn0GrMRvlz3HQeIMFAmpnKVQACgkQMRvlz3HQ
eIP9jg//UyQCcjqfgJobwpsGFq/oDtiV4HfVZ/EyyPU9sIxFIdq//bHZ0lZRIUhP
W4gjNU9eybF1dq9nUAmgpbmE9XHVYShLMdRcAeZ9qsP9uqzBJlM1Q32VX/TjWB9L
h0DmBdqjPkfLa+0+Tq1O6DR4gmjxk0qTHpb2InUugl//4IFjfjsDNQJm/5eNAE+e
AxJhE518DBrup9xjBcfx0K4L3AzH9vh/SsPZQBHHNFDzsu+O7ilbLSN2tL/fCHV0
cboI5t/cqT57WEK6fwdnhYYRY+/A9gzTC5uU+N667eadGZySUU3BfeEP/SkpAaTi
n81+NzjSbz+VA09cnenrcaMQGmlK8GF6iqOd0AAjcpnSl00OygBpl+44vMIgTw9F
K22Y1LmZ3zLaJp32DqDajLWsgIqGin0w3nzkyTt4YCu8OnsNt9IFAHZaAzse34pj
IJLGYVahQT4G5i4zw2xYcuxB9bYLWAaT6diGykBPHS6ZDtU2a8sUhNKxdl8zcuVk
SVADR1Zpae0zF04cpPDwoPtG9qs6zkNk60XjlIHtAk0RvKqq9z+JvWed+NKjpvI/
aNvT9CkAQsKBnI8dRsLsiZ+bA0fcEBwxgb8KL3v0yqT9REuJcrOAUXO3JFlRNyRV
fV5EWRa24wJEX9n0A81PXlBT13LXWaX+9gMI2K8i/Ylv9QJg1f0=
=TSzW
-----END PGP SIGNATURE-----

--z3ms7svwukc6xkgn--