Issues with deb-sources directly after installing

Bunsenbrenner · 2025-08-07 08:04:01

Hello everyone,

Yesterday I installed Bunsenlabs, because Im a very big fan of this distro. On my older laptop it runs already about one year or something.
But with the new installation there are some issues with the sources.
If I try to update, I got following messages:

 sudo apt-get update 
OK:1 htps://deb.debian.org/debian bookworm InRelease
Holen:2 htps://deb.debian.org/debian-security bookworm-security InRelease [48,0 kB]
Holen:3 htps://deb.debian.org/debian bookworm-updates InRelease [55,4 kB]
Holen:4 htps://pkg.bunsenlabs.org/debian bookworm-backports InRelease [4.081 B]
Holen:5 htps://deb.debian.org/debian bookworm-backports InRelease [59,4 kB]
Holen:6 htps://pkg.bunsenlabs.org/debian boron InRelease [6.359 B]
Holen:7 htps://deb.debian.org/debian-security bookworm-security/main amd64 Packages [272 kB]
Fehl:4 htps://pkg.bunsenlabs.org/debian bookworm-backports InRelease
  Die folgenden Signaturen waren ungültig: EXPKEYSIG 7C38E34CAED6420C BunsenLabs Release Key <bunsen-release@bunsenlabs.org>
Holen:8 htps://deb.debian.org/debian bookworm-backports/main amd64 Packages.diff/Index [63,3 kB]
Holen:9 htps://deb.debian.org/debian bookworm-backports/main Translation-en.diff/Index [63,3 kB]
Fehl:6 htps://pkg.bunsenlabs.org/debian boron InRelease
  Die folgenden Signaturen waren ungültig: EXPKEYSIG 7C38E34CAED6420C BunsenLabs Release Key <bunsen-release@bunsenlabs.org>
Holen:10 ttps://deb.debian.org/debian bookworm-backports/main amd64 Packages T-2025-08-07-0205.44-F-2025-08-07-0205.44.pdiff [1.042 B]
Holen:10 ttps://deb.debian.org/debian bookworm-backports/main amd64 Packages T-2025-08-07-0205.44-F-2025-08-07-0205.44.pdiff [1.042 B]
Holen:11 ttps://deb.debian.org/debian bookworm-backports/main Translation-en T-2025-08-07-0205.44-F-2025-08-07-0205.44.pdiff [175 B]
Holen:11 ttps://deb.debian.org/debian bookworm-backports/main Translation-en T-2025-08-07-0205.44-F-2025-08-07-0205.44.pdiff [175 B]
Paketlisten werden gelesen… Fertig                       
W: GPG-Fehler: ttps://pkg.bunsenlabs.org/debian bookworm-backports InRelease: Die folgenden Signaturen waren ungültig: EXPKEYSIG 7C38E34CAED6420C BunsenLabs Release Key <bunsen-release@bunsenlabs.org>
E: Das Depot »htps://pkg.bunsenlabs.org/debian bookworm-backports InRelease« ist nicht signiert.
N: Eine Aktualisierung von solch einem Depot kann nicht auf eine sichere Art durchgeführt werden, daher ist es standardmäßig deaktiviert.
N: Weitere Details zur Erzeugung von Paketdepots sowie zu deren Benutzerkonfiguration finden Sie in der Handbuchseite apt-secure(8).
W: Während der Überprüfung der Signatur trat ein Fehler auf. Das Depot wurde nicht aktualisiert und die vorherigen Indexdateien werden verwendet. GPG-Fehler: htps://pkg.bunsenlabs-org/debian boron InRelease: Die folgenden Signaturen waren ungültig: EXPKEYSIG 7C38E34CAED6420C BunsenLabs Release Key <bunsen-release@bunsenlabs.org>

I already tried to get it manually

 wget htps://github.com/BunsenLabs/bunsenlabs/raw/master/repo/bunsenlabs.gpg.key -O bunsenlabs.gpg.key
--2025-08-06 17:00:33--  ps://github.com/BunsenLabs/bunsenlabs/raw/master/repo/bunsenlabs.gpg.key
Auflösen des Hostnamens github.com (github.com)… 140.82.121.3
Verbindungsaufbau zu github.com (github.com)|140.82.121.3|:443 … verbunden.
HTTP-Anforderung gesendet, auf Antwort wird gewartet … 404 Not Found
2025-08-06 17:00:34 FEHLER 404: Not Found.

Whats the matter?! ^^

P.S.: shorten the https was a "quick&dirty way" because the forum does not allow me posting links...

EDIT: Added code blocks for ease of trading. - Sector11

Last edited by Bunsenbrenner (2025-08-07 08:08:38)

close2zero · 2025-08-07 09:49:36

I use Arch Linux and have been away from using deb-based distros for many years. But have you tried to update your gpg keys first:

sudo apt-key update

And then:

sudo apt-get update

Just a hunch

PackRat · 2025-08-07 09:50:47

I think this is the fix -

https://forums.bunsenlabs.org/viewtopic.php?id=9471

close2zero · 2025-08-07 10:02:05

@PackRat, that looks like the definitive cause and fix.

I guess my old apt-key hunch was a little outdated – I haven’t touched deb-based systems since the CrunchBang days ?

Cheers for the pointer – and thanks for keeping the forums alive and helpful as always.

DeepDayze · 2025-08-08 03:21:36

If the ISO you installed from is an older one then the key would need updating as the current key expired recently thus the error you encountered.

Great that you got it resolved now!

johnraff · 2025-08-08 05:09:08

If there are likely to be a lot of ongoing downloads and installs of the Boron iso, then I suppose it would mean a new build is in order. Coming in the middle of preparations for Carbon, not totally welcome...

DeepDayze · 2025-08-08 15:11:32

johnraff wrote:

If there are likely to be a lot of ongoing downloads and installs of the Boron iso, then I suppose it would mean a new build is in order. Coming in the middle of preparations for Carbon, not totally welcome...

Would it be possible to have the key installed from within the installer so that the key is always updated at install?

greenjeans · 2025-08-08 23:20:36

johnraff wrote:

If there are likely to be a lot of ongoing downloads and installs of the Boron iso, then I suppose it would mean a new build is in order. Coming in the middle of preparations for Carbon, not totally welcome...

It's a gorgeous piece of work dude, and there's always some of us who are more excited about the final state of maturity of the current stable version, than we are about a new edition and pending changes.

It's like the last model year of a given car design back in the day was always the best version of that body/powertrain/suspension version, the '78 280z, the '85 RX7 etc.

I'll personally be rolling with bookworm based systems for several years to come, it's nice and stable, a real workhorse now, and Boron is a superb example of that.

johnraff · 2025-08-09 01:45:32

DeepDayze wrote:

johnraff wrote:
If there are likely to be a lot of ongoing downloads and installs of the Boron iso, then I suppose it would mean a new build is in order. Coming in the middle of preparations for Carbon, not totally welcome...
Would it be possible to have the key installed from within the installer so that the key is always updated at install?

That's an interesting idea! Let's have a think about it.

But meanwhile it wouldn't be a huge task to do a fresh build of the current iso, so I'll get to it, maybe some time this week. The packages will all get upgraded too which would save users a lot of post-install upgrades.

The new key is valid for several years, so the issue shouldn't arise again until a more solid solution is in place - like a "keyring" package holding both old and new keys that users can install well in advance and get a smooth transition. I think that's what Debian do.

DeepDayze · 2025-08-09 02:54:25

johnraff wrote:

DeepDayze wrote:
johnraff wrote:
If there are likely to be a lot of ongoing downloads and installs of the Boron iso, then I suppose it would mean a new build is in order. Coming in the middle of preparations for Carbon, not totally welcome...
Would it be possible to have the key installed from within the installer so that the key is always updated at install?
That's an interesting idea! Let's have a think about it.
But meanwhile it wouldn't be a huge task to do a fresh build of the current iso, so I'll get to it, maybe some time this week. The packages will all get upgraded too which would save users a lot of post-install upgrades.
The new key is valid for several years, so the issue shouldn't arise again until a more solid solution is in place - like a "keyring" package holding both old and new keys that users can install well in advance and get a smooth transition. I think that's what Debian do.

A keyring package that has the last old key and the current key sounds like a good approach for situations like what the original poster ran into when installing Boron as the key had already expired. Perhaps revisit this idea for Nitrogen (which comes after Carbon)?

Last edited by DeepDayze (2025-08-09 02:58:15)

johnraff · 2025-08-09 03:27:25

^Anyway, maybe 6 months or even a year before the current key is about to expire, we release such a "bunsen-archive-keyring" package, so everybody can upgrade and have the new key in plenty of time.

The current key expires in 2028.

#1 2025-08-07 08:04:01

Issues with deb-sources directly after installing

#2 2025-08-07 09:49:36

Re: Issues with deb-sources directly after installing

#3 2025-08-07 09:50:47

Re: Issues with deb-sources directly after installing

#4 2025-08-07 10:02:05

Re: Issues with deb-sources directly after installing

#5 2025-08-08 03:21:36

Re: Issues with deb-sources directly after installing

#6 2025-08-08 05:09:08

Re: Issues with deb-sources directly after installing

#7 2025-08-08 15:11:32

Re: Issues with deb-sources directly after installing

#8 2025-08-08 23:20:36

Re: Issues with deb-sources directly after installing

#9 2025-08-09 01:45:32

Re: Issues with deb-sources directly after installing

#10 2025-08-09 02:54:25

Re: Issues with deb-sources directly after installing

#11 2025-08-09 03:27:25

Re: Issues with deb-sources directly after installing

Board footer