MySQL Bugs: #106492: he following signatures were invalid: EXPKEYSIG 8C718D3B5072E1F5

Bug #106492	he following signatures were invalid: EXPKEYSIG 8C718D3B5072E1F5
Submitted:	17 Feb 2022 14:37	Modified:	16 Mar 2022 15:04
Reporter:	Alex Skoropad	Email Updates:
Status:	Won't fix	Impact on me:	None
Category:	MySQL Server: Installing	Severity:	S3 (Non-critical)
Version:	5.7	OS:	Debian (stretch)
Assigned to:		CPU Architecture:	Any

Description:
I'm tring to update mysql on debian stretch and can't add key. Looks like apt-key works:

sudo apt-key adv --keyserver pgp.mit.edu --recv-keys 5072E1F5
Executing: /tmp/apt-key-gpghome.AjhVhSMGEt/gpg.1.sh --keyserver pgp.mit.edu --recv-keys 5072E1F5
gpg: key 8C718D3B5072E1F5: 3 duplicate signatures removed
gpg: key 8C718D3B5072E1F5: 106 signatures not checked due to missing keys
gpg: key 8C718D3B5072E1F5: "MySQL Release Engineering <mysql-build@oss.oracle.com>" 2 new signatures
gpg: Total number processed: 1
gpg:         new signatures: 2

But sudo apt update fails with:

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://repo.mysql.com/apt/debian stretch InRelease: The following signatures were invalid: EXPKEYSIG 8C718D3B5072E1F5 MySQL Release Engineering <mysql-build@oss.oracle.com>
W: Failed to fetch http://repo.mysql.com/apt/debian/dists/stretch/InRelease  The following signatures were invalid: EXPKEYSIG 8C718D3B5072E1F5 MySQL Release Engineering <mysql-build@oss.oracle.com>
W: Some index files failed to download. They have been ignored, or old ones used instead.

Stretch repo wasn't updated since May 2021 (even jessie which is older was updated this year :))

How to repeat:
Try to update repo on debian stretch

Suggested fix:
Sign this repo with actual key

Hi,

As Debian 9 is eol, it is no longer supported by MySQL, and the repo is no longer being updated. The MySQL repo signing key was replaced, because the old one (5072E1F5) is no longer considered to have secure encryption.

The jessie repo directories having updated timestamps is odd, but not it's only the directories. The repo files themselves are not updated, and no jessie files are being uploaded.

So now not posible t install even previous versions of mysql packages on stretch?

Rather than using repo.mysql.com for unsupported platforms, you could download package bundles from https://downloads.mysql.com/archives/community/ (5.7.34 and 8.0.25 would be the newest server versions available for Stretch, I believe).

Ok, thanks, it's less convenient than repo in case of automatization but usable

May be you can provide current MySQL repo signing key ID?

Debian 8 MySQL support ended when Debian 8 LTS ended.
It appears MySQL changed its policy and ended Debian 9 support a year early.

We're certainly miffed about the change in policy and about not having received timely notice of it!

What's the best approach to getting automatically hit upside the head if we miss another end of support?  Learning it this way comes a little late!

Simplest way to get the key is to download with gpg
You can use apt-key adv --keyserver pgp.mit.edu --recv-keys 3A79BD29 (https://dev.mysql.com/doc/mysql-apt-repo-quick-guide/en/#repo-qg-apt-repo-manual-setup)

We have a list of platform EOL notices at https://www.mysql.com/support/eol-notice.html

It works for me in Debian Jessie with Expired Keys.

1 - Download package bundles from https://downloads.mysql.com/archives/community
(mysql-server_5.7.30-1debian8_amd64.deb-bundle.tar)

2 - Create a Local Apt Repository with dpkg-scanpackages tool and MySQL packages downloaded
(https://rpmdeb.com/devops-articles/how-to-create-local-debian-repository/)

3 - Update MySQL from 5.7.16 to 5.7.30 (to use OpenSSL TLSv1.2) 

apt-get update
apt-get install mysql-server

Thanks for all!