1828775 - deb: regression: Failed to fetch https://packages.mozilla.org/apt/dists/apt/InRelease 403 Forbidden

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Darkspirit]

KDE Wayland, Debian Testing.

$ LANG=C sudo apt update

Hit:1 http://security.debian.org/debian-security testing-security InRelease
Hit:2 https://mirror.eu.oneandone.net/debian testing InRelease
Hit:3 https://dl.google.com/linux/chrome/deb stable InRelease
Hit:4 https://mirror.eu.oneandone.net/debian testing-updates InRelease
Err:5 https://packages.mozilla.org/apt apt InRelease
403 Forbidden [IP: 34.160.78.70 443]
Reading package lists... Done
E: Failed to fetch https://packages.mozilla.org/apt/dists/apt/InRelease 403 Forbidden [IP: 34.160.78.70 443]
E: The repository 'https://packages.mozilla.org/apt apt InRelease' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

https://packages.mozilla.org/apt/dists/apt/InRelease

Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/moz-fx-productdelivery-pr-38b5/locations/us/repositories/apt" (or it may not exist)

Comment 1

[Johan Lorenzo [:jlorenzo]]

Thank you very much for this bug report and for your help with bug 1824327, Darkspirit! I'm personally glad that we already have a user on our upcoming nightly .deb package, even though we haven't communicated about it! 😃 (That will happen in bug 1826540)

Speaking of which, we seized this opportunity to rename our deb repository. You can get your setup back in working state by deleting the current packages.mozilla.org entry you have and then use:

echo "deb [signed-by=/etc/apt/trusted.gpg.d/packages.mozilla.org.gpg] https://packages.mozilla.org/apt mozilla main" | sudo tee -a /etc/apt/sources.list.d/mozilla.list > /dev/null

Let me know if you run into any issues.

Comment 2

[Darkspirit]

Thanks for the help!
With that command, the old repo was still there in the first line and the gpg key was missing. These commands are needed:

$ sudo rm /etc/apt/sources.list.d/mozilla.list
$ echo "deb [signed-by=/etc/apt/trusted.gpg.d/packages.mozilla.org.gpg] https://packages.mozilla.org/apt mozilla main" | sudo tee -a /etc/apt/sources.list.d/mozilla.list > /dev/null
$ curl -sSf https://packages.mozilla.org/apt/repo-signing-key.gpg | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/packages.mozilla.org.gpg > /dev/null

---

What I tested:

$ sudo rm /etc/apt/sources.list.d/mozilla.list
$ echo "deb [signed-by=/etc/apt/trusted.gpg.d/packages.mozilla.org.gpg] https://packages.mozilla.org/apt mozilla main" | sudo tee -a /etc/apt/sources.list.d/mozilla.list > /dev/null
$ cat /etc/apt/sources.list.d/mozilla.list
deb [signed-by=/etc/apt/trusted.gpg.d/packages.mozilla.org.gpg] https://packages.mozilla.org/apt mozilla main

$ LANG=C sudo apt update
Hit:1 http://security.debian.org/debian-security testing-security InRelease
Hit:2 https://dl.google.com/linux/chrome/deb stable InRelease                                  
Hit:3 https://mirror.eu.oneandone.net/debian testing InRelease                                 
Hit:4 https://mirror.eu.oneandone.net/debian testing-updates InRelease                
Get:5 https://packages.mozilla.org/apt mozilla InRelease [1311 B]
Err:5 https://packages.mozilla.org/apt mozilla InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY C0BA5CE6DC6315A3
Reading package lists... Done
W: GPG error: https://packages.mozilla.org/apt mozilla InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY C0BA5CE6DC6315A3
E: The repository 'https://packages.mozilla.org/apt mozilla InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

$ ls /etc/apt/trusted.gpg.d/*
/etc/apt/trusted.gpg.d/debian-archive-bookworm-automatic.asc           /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.asc  /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.asc  /etc/apt/trusted.gpg.d/google-chrome.gpg
/etc/apt/trusted.gpg.d/debian-archive-bookworm-security-automatic.asc  /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.asc              /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
/etc/apt/trusted.gpg.d/debian-archive-bookworm-stable.asc              /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.asc             /etc/apt/trusted.gpg.d/debian-archive-buster-stable.asc
/etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.asc           /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg             /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg

$ curl -sSf https://packages.mozilla.org/apt/repo-signing-key.gpg | sudo tee /etc/apt/trusted.gpg.d/packages.mozilla.org.gpg
-----BEGIN PGP PUBLIC KEY BLOCK-----

xsBNBGCRt7MBCADkYJHHQQoL6tKrW/LbmfR9ljz7ib2aWno4JO3VKQvLwjyUMPpq
/SXXMOnx8jXwgWizpPxQYDRJ0SQXS9ULJ1hXRL/OgMnZAYvYDeV2jBnKsAIEdiG/
e1qm8P4W9qpWJc+hNq7FOT13RzGWRx57SdLWSXo0KeY38r9lvjjOmT/cuOcmjwlD
T9XYf/RSO+yJ/AsyMdAr+ZbDeQUd9HYJiPdI04lGaGM02MjDMnx+monc+y54t+Z+
ry1WtQdzoQt9dHlIPlV1tR+xV5DHHsejCZxu9TWzzSlL5wfBBeEz7R/OIzivGJpW
QdJzd+2QDXSRg9q2XYWP5ZVtSgjVVJjNlb6ZABEBAAHNVEFydGlmYWN0IFJlZ2lz
dHJ5IFJlcG9zaXRvcnkgU2lnbmVyIDxhcnRpZmFjdC1yZWdpc3RyeS1yZXBvc2l0
b3J5LXNpZ25lckBnb29nbGUuY29tPsLAjgQTAQoAOBYhBDW6oLM+nrOW9ZyoOMC6
XObcYxWjBQJgkbezAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEMC6XObc
YxWj+igIAMFh6DrAYMeq9sbZ1ZG6oAMrinUheGQbEqe76nIDQNsZnhDwZ2wWqgVC
7DgOMqlhQmOmzm7M6Nzmq2dvPwq3xC2OeI9fQyzjT72deBTzLP7PJok9PJFOMdLf
ILSsUnmMsheQt4DUO0jYAX2KUuWOIXXJaZ319QyoRNBPYa5qz7qXS7wHLOY89IDq
fHt6Aud8ER5zhyOyhytcYMeaGC1g1IKWmgewnhEq02FantMJGlmmFi2eA0EPD02G
C3742QGqRxLwjWsm5/TpyuU24EYKRGCRm7QdVIo3ugFSetKrn0byOxWGBvtu4fH8
XWvZkRT+u+yzH1s5yFYBqc2JTrrJvRU=
=QnvN
-----END PGP PUBLIC KEY BLOCK-----

$ LANG=C sudo apt update
Hit:1 http://security.debian.org/debian-security testing-security InRelease
Hit:2 https://dl.google.com/linux/chrome/deb stable InRelease                                                 
Hit:3 https://mirror.eu.oneandone.net/debian testing InRelease                                                
Hit:4 https://mirror.eu.oneandone.net/debian testing-updates InRelease               
Get:5 https://packages.mozilla.org/apt mozilla InRelease [1311 B]
Err:5 https://packages.mozilla.org/apt mozilla InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY C0BA5CE6DC6315A3
Reading package lists... Done
W: http://security.debian.org/debian-security/dists/testing-security/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/packages.mozilla.org.gpg are ignored as the file has an unsupported filetype.
W: https://dl.google.com/linux/chrome/deb/dists/stable/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/packages.mozilla.org.gpg are ignored as the file has an unsupported filetype.
W: https://mirror.eu.oneandone.net/debian/dists/testing/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/packages.mozilla.org.gpg are ignored as the file has an unsupported filetype.
W: https://mirror.eu.oneandone.net/debian/dists/testing-updates/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/packages.mozilla.org.gpg are ignored as the file has an unsupported filetype.
W: GPG error: https://packages.mozilla.org/apt mozilla InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY C0BA5CE6DC6315A3
E: The repository 'https://packages.mozilla.org/apt mozilla InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

$ sudo rm /etc/apt/trusted.gpg.d/packages.mozilla.org.gpg

$ curl -sSf https://packages.mozilla.org/apt/repo-signing-key.gpg | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/packages.mozilla.org.gpg
M``A

ҫ[ۙ}<Zz8$)
                   <0j%05hP`4I$K
vʰv!{ZV%ϡ69=wG1G{IIz4)7e8Ι?ܸ& COR;
                                                          21+yv    HӉFhc42|~.x~-Vs
tڶ]mT͕TArtifact Registry Repository Signer <[e-mail]>H>UuWǣ      n5)K3#8▒VAsw
8!5>8\c`
                                
        

        ca:`ǪՑ+u!xd@glB82aBcngo?
-x_C,Ox,&=<N1 Ry;H}R!ui
                                                     DOajϺK,<|{z|s#+\`ǚ▒-`Ԃ*aZ      ▒Y-AM
                                                                                                                ~Gk&6F
D`T7RzҫF;n]kّ[9V

$ LANG=C sudo apt update
Hit:1 http://security.debian.org/debian-security testing-security InRelease
Hit:2 https://mirror.eu.oneandone.net/debian testing InRelease                                                                                                            
Hit:3 https://dl.google.com/linux/chrome/deb stable InRelease                                                                                                             
Hit:4 https://mirror.eu.oneandone.net/debian testing-updates InRelease
Get:5 https://packages.mozilla.org/apt mozilla InRelease [1311 B]
Get:6 https://packages.mozilla.org/apt mozilla/main amd64 Packages [3212 B]
Get:7 https://packages.mozilla.org/apt mozilla/main all Packages [183 kB]
Fetched 187 kB in 2s (111 kB/s)  
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
2 packages can be upgraded. Run 'apt list --upgradable' to see them.

$ LANG=C sudo apt upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  firefox-nightly firefox-nightly-l10n-de
2 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 65.6 MB of archives.
After this operation, 166 kB of additional disk space will be used.
Do you want to continue? [Y/n] 
Get:1 https://packages.mozilla.org/apt mozilla/main amd64 firefox-nightly amd64 114.0a1~20230419094414 [65.1 MB]
Get:2 https://packages.mozilla.org/apt mozilla/main all firefox-nightly-l10n-de all 114.0a1~20230419094414 [522 kB]                                                                                                                                                                                                        
Fetched 65.6 MB in 11s (5793 kB/s)                                                                                                                                                                                                                                                                                         
Reading changelogs... Done
(Reading database ... 304100 files and directories currently installed.)
Preparing to unpack .../firefox-nightly_114.0a1~20230419094414_amd64.deb ...
Unpacking firefox-nightly (114.0a1~20230419094414) over (114.0a1~20230417092144) ...
Preparing to unpack .../firefox-nightly-l10n-de_114.0a1~20230419094414_all.deb ...
Unpacking firefox-nightly-l10n-de (114.0a1~20230419094414) over (114.0a1~20230417092144) ...
Setting up firefox-nightly (114.0a1~20230419094414) ...
Setting up firefox-nightly-l10n-de (114.0a1~20230419094414) ...