Mosquitto - Source Repository GPG Key Expired

[bwright86]

I have downloaded the Dev-Release of v1.2 image, and noticed an issue with the Mosquitto repo for apt. I was getting the following error:

Err https://repo.mosquitto.org jessie InRelease
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://repo.mosquitto.org jessie InRelease: The following signatures were invalid: KEYEXPIRED 1577823874 KEYEXPIRED 1577823874 KEYEXPIRED 1577823874

W: Failed to fetch https://repo.mosquitto.org/debian/dists/jessie/InRelease

It looks like the following will download a new key, and resolve the issue:

wget http://repo.mosquitto.org/debian/mosquitto-repo.gpg.key
sudo apt-key add mosquitto-repo.gpg.key

I can take a look to see if a build script adds this information, and can submit a PR for it.

[hestiahacker]

I believe the 1.2-dev image was built manually, so there are not any official build scripts to patch. However, I did create some unofficial scripts to build HestiaPi images.

The manual build instructions say to compile Mosquitto from source.

I vaguely remember disregarding this advice and trying to use the repo version of Mosquitto. I don't remember exactly what failed, but the punchline is that it didn't work. I ended up with going with the recommended "build it from source" approach in my scripts as you can see here. I also left my comments in there about how to delete the old key and download their new one.

We are working on upgrading from Debian 8 (jessie) to at least Debian 9 (stretch) in #51. At some point we'll probably switch the the version of Mosquitto from the repo and when we do, I'll make sure that the repo doesn't have any expired keys.

If you can help test out the Stretch edition of the 1.2-dev build (see https://community.hestiapi.com/t/automated-build-process-stretch/1965 for a download link) and find that it's fixed there (and all other features still work) it might be reasonable to close this issue. I've verified that running apt update on that image does not report any issues with any repos, but I'd be happy to have more people verify my findings. 🙂