flatpak icon indicating copy to clipboard operation
flatpak copied to clipboard
verified publisher icon flatpak

[Bug]: flatpak repositories not working: BAD signature (Unix epoch)

Open smtchahal opened this issue 3 years ago • 10 comments

Checklist

  • [X] I agree to follow the Code of Conduct that this project adheres to.
  • [X] I have searched the issue tracker for a bug that matches the one I want to file, without success.
  • [X] If this is an issue with a particular app, I have tried filing it in the appropriate issue tracker for the app (e.g. under https://github.com/flathub/) and determined that it is an issue with Flatpak itself.
  • [X] This issue is not a report of a security vulnerability (see here if you need to report a security issue).

Flatpak version

1.6.5

What Linux distribution are you using?

Ubuntu

Linux distribution version

20.04

What architecture are you using?

x86_64

How to reproduce

  1. Run flatpak update.

Expected Behavior

Flatpak updates all my apps.

Actual Behavior

All the updates fail to install and I see the following output in my terminal:

$ flatpak update
Looking for updates…

        ID                                                        Branch             Op             Remote             Download
 1. [✗] org.freedesktop.Platform.GL.nvidia-450-102-04             1.4                u              flathub            < 100.4 MB
        ID                                                        Branch             Op             Remote             Download
 1. [✗] org.freedesktop.Platform.GL.nvidia-450-102-04             1.4                u              flathub            < 100.4 MB
        ID                                                        Branch             Op             Remote             Download
 1. [✗] org.freedesktop.Platform.GL.nvidia-450-102-04             1.4                u              flathub            < 100.4 MB
 2. [✗] org.freedesktop.Platform.GL.nvidia-450-80-02              1.4                u              flathub            < 101.0 MB
 3. [ ] org.freedesktop.Platform.GL.nvidia-460-91-03              1.4                u              flathub            < 135.5 MB
        ID                                                        Branch             Op             Remote             Download
 1. [✗] org.freedesktop.Platform.GL.nvidia-450-102-04             1.4                u              flathub            < 100.4 MB
 2. [✗] org.freedesktop.Platform.GL.nvidia-450-80-02              1.4                u              flathub            < 101.0 MB
 3. [|] org.freedesktop.Platform.GL.nvidia-460-91-03              1.4                u              flathub            < 135.5 MB
        ID                                                        Branch             Op             Remote             Download
 1. [✗] org.freedesktop.Platform.GL.nvidia-450-102-04             1.4                u              flathub            < 100.4 MB
 2. [✗] org.freedesktop.Platform.GL.nvidia-450-80-02              1.4                u              flathub            < 101.0 MB
 3. [✗] org.freedesktop.Platform.GL.nvidia-460-91-03              1.4                u              flathub            < 135.5 MB
 4. [ ] org.freedesktop.Platform.GL.nvidia-470-103-01             1.4                u              flathub            < 273.3 MB

        ID                                                        Branch             Op             Remote             Download
 1. [✗] org.freedesktop.Platform.GL.nvidia-450-102-04             1.4                u              flathub            < 100.4 MB
 2. [✗] org.freedesktop.Platform.GL.nvidia-450-80-02              1.4                u              flathub            < 101.0 MB
 3. [✗] org.freedesktop.Platform.GL.nvidia-460-91-03              1.4                u              flathub            < 135.5 MB
 4. [|] org.freedesktop.Platform.GL.nvidia-470-103-01             1.4                u              flathub            < 273.3 MB

        ID                                                        Branch             Op             Remote             Download
 1. [✗] org.freedesktop.Platform.GL.nvidia-450-102-04             1.4                u              flathub            < 100.4 MB
 2. [✗] org.freedesktop.Platform.GL.nvidia-450-80-02              1.4                u              flathub            < 101.0 MB
 3. [✗] org.freedesktop.Platform.GL.nvidia-460-91-03              1.4                u              flathub            < 135.5 MB
 4. [✗] org.freedesktop.Platform.GL.nvidia-470-103-01             1.4                u              flathub            < 273.3 MB

Warning: Signature made Thursday 01 January 1970 05:30:00 AM using [unknown name] key ID 562702E9E3ED7EE8
BAD signature from "Flathub Repo Signing Key <[email protected]>"
        ID                                                        Branch             Op             Remote             Download
 1. [✗] org.freedesktop.Platform.GL.nvidia-450-102-04             1.4                u              flathub            < 100.4 MB
 2. [✗] org.freedesktop.Platform.GL.nvidia-450-80-02              1.4                u              flathub            < 101.0 MB
 3. [✗] org.freedesktop.Platform.GL.nvidia-460-91-03              1.4                u              flathub            < 135.5 MB
 4. [✗] org.freedesktop.Platform.GL.nvidia-470-103-01             1.4                u              flathub            < 273.3 MB

Warning: Signature made Thursday 01 January 1970 05:30:00 AM using [unknown name] key ID 562702E9E3ED7EE8
BAD signature from "Flathub Repo Signing Key <[email protected]>"
Primary key ID 4184DD4D907A7CAE
Primary key expires Monday 14 June 2027 06:48:56 PM
Warning: Signature made Thursday 01 January 1970 05:30:00 AM using [unknown name] key ID 562702E9E3ED7EE8
BAD signature from "Flathub Repo Signing Key <[email protected]>"
Primary key ID 4184DD4D907A7CAE
Primary key expires Monday 14 June 2027 06:48:56 PM
Warning: Signature made Thursday 01 January 1970 05:30:00 AM using [unknown name] key ID 562702E9E3ED7EE8
BAD signature from "Flathub Repo Signing Key <[email protected]>"
Primary key ID 4184DD4D907A7CAE
Primary key expires Monday 14 June 2027 06:48:56 PM
Warning: Signature made Thursday 01 January 1970 05:30:00 AM using [unknown name] key ID 562702E9E3ED7EE8
BAD signature from "Flathub Repo Signing Key <[email protected]>"
Primary key ID 4184DD4D907A7CAE
Primary key expires Monday 14 June 2027 06:48:56 PM
Updates complete.

Additional Information

Apparently it's the same as #3657 but that got closed because apparently the issue fixed itself for them.

smtchahal avatar Apr 02 '22 03:04 smtchahal

Your computer's clock is set correctly?

mwleeds avatar Apr 05 '22 17:04 mwleeds

Yes. And it just resolved itself on its own after a while, just like the other referenced issue. But my system time was always correct. It seems to be a server-side issue, especially if it's affecting other people as well.

smtchahal avatar Apr 06 '22 19:04 smtchahal

No amount of reboots, or waiting seems to resolve it for me. My system time is set correctly, connected to NTP server and no ntp issues. Flatpak update doesn't do anything either.

I ran sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo, and it appears to have added the repo, but it's in a broken state. So I removed it with sudo flatpak remote-delete flathub. Then, after reading flatpak remote-add --help, that gave me this useful flag --no--gpg--verify. Not ideal, but oh well.

I was finally able to install apps from flathub by using this command: sudo flatpak remote-add --if-not-exists --no-gpg-verify flathub https://flathub.org/repo/flathub.flatpakrepo

I installed flatpak from the default Ubuntu 20.04 repositories. flatpak/focal 1.6.3-1 amd64

japtain-cack avatar Oct 06 '22 05:10 japtain-cack

Ok, found a guide for installing the "latest" version of flatpak. After using this ppa, sudo add-apt-repository ppa:flatpak/stable, which is flatpak/focal 1.14.0-2flatpak1~20.04.1 amd64, it seems to not throw the gpg error anymore.

The install guide here, says

With older Ubuntu versions, the official Flatpak PPA is the recommended way to install Flatpak.

But I think I prefer using this PPA for 20.04, because it gives me the latest version of flatpak.

japtain-cack avatar Oct 06 '22 05:10 japtain-cack

I am getting something similar:

Looking for updates…
F: Warning: Treating remote fetch error as non-fatal since runtime/org.freedesktop.Sdk/x86_64/22.08 is already installed: Unable to load summary from remote flathub: Signature made Thu 01 Jan 1970 01:00:00 BST using [unknown name] key ID 562702E9E3ED7EE8
BAD signature from "Flathub Repo Signing Key <[email protected]>"
Primary key ID 4184DD4D907A7CAE
Primary key expires Mon 14 Jun 2027 14:18:56 BST
F: Warning: Can't find runtime/org.freedesktop.Sdk/x86_64/22.08 metadata for dependencies: Unable to load metadata from remote flathub: summary fetch error: Signature made Thu 01 Jan 1970 01:00:00 BST using [unknown name] key ID 562702E9E3ED7EE8
BAD signature from "Flathub Repo Signing Key <[email protected]>"
Primary key ID 4184DD4D907A7CAE
Primary key expires Mon 14 Jun 2027 14:18:56 BST

And then many more repeats of the warning about "Unable to load metadata from remote flathub" for different paks.

I have Flatpak 1.6.5, on Ubuntu 20.04 focal. My clock looks accurate.

I attach the output of flatpak update.

flatpak.log

tomwhoiscontrary avatar Oct 17 '22 08:10 tomwhoiscontrary

I am getting something similar:

Looking for updates…
F: Warning: Treating remote fetch error as non-fatal since runtime/org.freedesktop.Sdk/x86_64/22.08 is already installed: Unable to load summary from remote flathub: Signature made Thu 01 Jan 1970 01:00:00 BST using [unknown name] key ID 562702E9E3ED7EE8
BAD signature from "Flathub Repo Signing Key <[email protected]>"
Primary key ID 4184DD4D907A7CAE
Primary key expires Mon 14 Jun 2027 14:18:56 BST
F: Warning: Can't find runtime/org.freedesktop.Sdk/x86_64/22.08 metadata for dependencies: Unable to load metadata from remote flathub: summary fetch error: Signature made Thu 01 Jan 1970 01:00:00 BST using [unknown name] key ID 562702E9E3ED7EE8
BAD signature from "Flathub Repo Signing Key <[email protected]>"
Primary key ID 4184DD4D907A7CAE
Primary key expires Mon 14 Jun 2027 14:18:56 BST

And then many more repeats of the warning about "Unable to load metadata from remote flathub" for different paks.

I have Flatpak 1.6.5, on Ubuntu 20.04 focal. My clock looks accurate.

I attach the output of flatpak update.

flatpak.log

All my issues went away, after I installed the latest version. I recommend doing that.

japtain-cack avatar Oct 18 '22 03:10 japtain-cack

We're facing the same challenge here on a device. To temporarily resolved this challenge, we manually updated the Flatpak local "repo GPG key". Steps at https://github.com/flatpak/flatpak/issues/5263#issuecomment-1399316612

Francewhoa avatar Jan 21 '23 19:01 Francewhoa

The solution linked in the above comment does not work and I am facing the same error

While pulling runtime/org.freedesktop.Platform.GL.default/x86_64/21.08 from remote flathub: Commit 455319fb180e673a05b1156dabba36dd41fd13ccaa71a9fe477710eddbc8f2a0: Signature made Thursday 01 January 1970 05:30:00 AM using [unknown name] key ID 562702E9E3ED7EE8 BAD signature from "Flathub Repo Signing Key <[email protected]>" Primary key ID 4184DD4D907A7CAE Primary key expires Monday 14 June 202

wolfdael avatar Apr 17 '23 15:04 wolfdael

For developers interested to contribute to resolving this challenge, one likely cause of this challenge is maybe the https_proxy environment variable. Which seems to be case-sensitive. Depending on the environment, it is either UPPERCASE or lowercase. If so, to resolve this challenge, maybe the Flatpak's code needs to be adapted accordingly. Details in comment https://github.com/flatpak/flatpak/issues/2540#issuecomment-1486273352 by @mpilawa

For users interested to contribute and speed up the resolution of this challenge, when you add a comment about flagging a challenge, if not already done, I suggest to always include which operating system you're using and which version (environment). For example, Debian 10 Buster. In turn, developers are able to test with the appropriate environment.

Francewhoa avatar Apr 17 '23 16:04 Francewhoa

For developers interested to contribute to resolving this challenge, one likely cause of this challenge is maybe the https_proxy environment variable.

I'm facing this problem today, with Ubuntu 20.04, but I do not use any proxy, just a direct Internet connection. The solution suggested at https://github.com/flatpak/flatpak/issues/5263#issuecomment-1399316612 does not work for me.

Update: seems to have solved itself automatically, not sure if due to some attempt (which anyway was reporting an error) or not.

mauromol avatar May 24 '24 16:05 mauromol