9

I have an Ansible script that setup google chrome apt repo. I keep Google's signing key together with the scripts (rather than download it every time) because I think it minimizes the chance of getting malicious key (TOFU security model).

Now the key no longer works:

W: GPG error: http://dl.google.com/linux/chrome/deb stable Release: 
   The following signatures couldn't be verified because the public key
   is not available: NO_PUBKEY 78BD65473CB3BD13
E: The repository 'http://dl.google.com/linux/chrome/deb stable Release' is not signed.

The url from which I've originally downloaded it points to a different key (as in: the files differ). Moreover, I tried getting the key by fingerprint from a different source:

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 78BD65473CB3BD13
apt-key export 78BD65473CB3BD13

And I got yet another, different file. Which one should I use? How do I make sure that I can trust it? Is there a way to check that the old key just expired and the new one is a valid successor?

Improve this question
1
  • I am having this problem with the Brave browser, which depends on Chrome. I'd very much like to know how to handle it.
    – Diagon
    Commented Mar 24, 2020 at 0:05

1 Answer 1

Reset to default
1

I'd get in touch with the maintainers and ask for the fingerprint of their valid key and whether it has (or should have) changed.

The short answer, given this security model, is don't use the new key until you can verify it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .