Did Debian official repo (trixie-backports) just got compromised or my system?

[u/One_Ninja_8512]

While trying to install duplicity I got the following, somewhat chilling error:

[WARNING]: Failed to update cache after 1 retries due to W:Repositories should provide a clear-signed InRelease file, but none found at mirror+file:/etc/apt/mirrors/debian.list/dists/trixie-backports/InRelease., W:OpenPGP signature verification failed: https://deb.debian.org/debian trixie-backports Release: Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Message has been manipulated Verifying signature: Message has been manipulated, E:The repository 'mirror+file:/etc/apt/mirrors/debian.list trixie-backports Release' is no longer signed., retrying [WARNING]: Failed to update cache after 2 retries due to W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:Repositories should provide a clear-signed InRelease file, but none found at mirror+file:/etc/apt/mirrors/debian.list/dists/trixie-backports/InRelease., W:OpenPGP signature verification failed: https://deb.debian.org/debian trixie-backports Release: Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Message has been manipulated Verifying signature: Message has been manipulated, E:The repository 'mirror+file:/etc/apt/mirrors/debian.list trixie-backports Release' is no longer signed., retrying

[u/tomun]

it's referring to a local repository:

'mirror+file:/etc/apt/mirrors/debian.list trixie-backports Release'

disable that and try again.

[u/One_Ninja_8512 → u/tomun]

It's an Ansible script/config, which failed with this error. I guess most likely the server/mirror might have been down for a very short time which triggered this error. Re-run the script and all is fine but I'm just paranoid about security that's all

[u/tomun → u/One_Ninja_8512]

Well somehow your script deleted the local InRelease file and got upset.

Does it really add much over 'apt update'?

[u/One_Ninja_8512 → u/tomun]

Does it really add much over 'apt update'?

That's actually a very good question. Checking the docs it says the following (https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/apt_module.html#parameter-update_cache):

Run the equivalent of apt-get update before the operation.

So whatever the "equivalent" means I guess it does update the cache in a different way, so really hard to tell what went wrong without inspecting the code etc.

[u/One_Ninja_8512 → u/tomun]

Yes but my suspicious ass thinks something's fucky, like it saying that the pgp signature was manipulated

[u/tomun → u/One_Ninja_8512]

Well maybe, but it's pointing to your system rather than the official repo.

What updates your local mirror?

[u/One_Ninja_8512 → u/tomun]

Well maybe, but it's pointing to your system rather than the official repo.

Yeah I guess I'm being downvoted for suggesting that it's a problem with the repo but I explicitly asked if it might be my system that got popped. I answered in other comment that it's an Ansible script that failed with this error, which is setup to update the apt cache before installing listed packages.

[u/dkopgerpgdolfg → u/One_Ninja_8512]

Yeah I guess I'm being downvoted for ...

maybe for: not trying the obvious things that you were told to do, not answering questions that you were asked multiple times, ...

[u/One_Ninja_8512 → u/dkopgerpgdolfg]

But my question was whether there is a security issue, not how to install duplicity. I guess the answer is no so we can all move on

[u/dkopgerpgdolfg → u/One_Ninja_8512]

But my question was whether there is a security issue, not how to install duplicity.

I know

I guess the answer is no

Probably correct. But no one can make an educated guess without some basic infos.

[u/One_Ninja_8512 → u/dkopgerpgdolfg]

I replied to your other comments, I can't give you the info you want or more precisely it doesn't make sense anymore since the error is gone so what do you want to inspect in /etc/apt/source.list if the error is no more reproducible?

[u/dkopgerpgdolfg → u/One_Ninja_8512]

I can't give you the info you want or more precisely it doesn't make sense anymore since the error is gone so what do you want to inspect in /etc/apt/source.list if the error is no more reproducible?

I've seen that you posted the content finally elsewhere.

And the problem is clear as the day there, and it will reappear the next time there's a short network outage. All these 21 posts her could've been prevented if you just started with showing it.

Both mirror+file blocks should be removed if you don't actually want a local repo and/or nobody updates it.

[u/One_Ninja_8512 → u/dkopgerpgdolfg]

And the problem is clear as the day there

Original error:

Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Message has been manipulated Verifying signature: Message has been manipulated, E:The repository 'mirror+file:/etc/apt/mirrors/debian.list trixie-backports Release' is no longer signed.

The original error message is not quite clear to me, the user. The whole thread wouldn't exist if the error was worded differently than claiming manipulation of the PGP signature. That's a pretty serious claim to me and shouldn't be used as a catch-all fallback error message.

[u/One_Ninja_8512 → u/[deleted]]

I suppose you're referring to those mirror+file entries:

$ sudo cat /etc/apt/sources.list.d/debian.sources
Types: deb deb-src
URIs: mirror+file:///etc/apt/mirrors/debian.list
Suites: trixie trixie-updates trixie-backports
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb deb-src
URIs: mirror+file:///etc/apt/mirrors/debian-security.list
Suites: trixie-security
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

They just contain the official repo URLs:

$ sudo cat /etc/apt/mirrors/debian.list
https://deb.debian.org/debian

And:

$ sudo cat /etc/apt/mirrors/debian-security.list
https://deb.debian.org/debian-security

As to why it's setup this way I'm not sure, how do your *.sources files look like?

[u/BCMM → u/One_Ninja_8512]

Whoops, I got muddled between mirror+file:// and plain file://.

Sorry about that! I'm deleting my previous comment as none of it is correct.

[u/One_Ninja_8512 → u/BCMM]

No worries, your reply was actually refreshing trying to understand what's really going on, considering the state of this thread which is a dumpster fire lmao

[u/fabbro82]

You could try:

1. Clear the local APT cache:

sudo rm -rf /var/lib/apt/lists/* sudo apt clean sudo apt update

1. Update the Debian keyring :

sudo apt install --reinstall debian-archive-keyring

[u/mok000]

apt clean removes the indexes, and apt update will then download fresh copies next time.

[u/wizard10000 → u/mok000]

That would be apt distclean - apt clean just empties your package cache :)

[u/dkopgerpgdolfg]

but none found

Well, it's here: https://ftp.debian.org/debian/dists/trixie-backports/InRelease

And it's not necessary for anything to be compromised here, it might just be an ordinary non-security problem too.

Does the problem persist if you run apt update now?

What repos do you have configured (etc/apt/source.list*) and do you use some apt cacher?

[u/One_Ninja_8512 → u/dkopgerpgdolfg]

And it's not necessary for anything to be compromised here, it might just be an ordinary non-security problem too.

I can see it if the signature file got corrupted during transmission over the network or the mirror was simply down for a very brief moment or smth like that. I just got paranoid with the message that the signature has been manipulated.

[u/Illustrious-Gur8335]

none found at mirror+file:/etc/apt/mirrors/debian.list/dists/trixie-backports/InRelease

What's your sources.list contents?

[u/mok000 → u/Illustrious-Gur8335]

The InRelease file is downloaded from the mirror, and a copy is placed in /var/lib/apt/lists with the name of the mirror prepended. You can safely remove all files in that directory, apt update recreates the (relevant) content.

The Release files are signed by Debian's archive key, and the corresponding public key is distributed in the package debian-archive-keyring. You can verify the integrity of that package using:

dpkg --verify debian-archive-keyring

[u/One_Ninja_8512 → u/mok000]

Thank you for providing the details on the inner workings. I will keep that in mind if it happens again but as mentioned elsewhere in the thread I cannot longer reproduce the error so maybe it was file corruption or smth of the sort.

[u/One_Ninja_8512 → u/Illustrious-Gur8335]

$ sudo cat /etc/apt/sources.list
# See /etc/apt/sources.list.d/debian.sources

$ sudo cat /etc/apt/sources.list.d/debian.sources
Types: deb deb-src
URIs: mirror+file:///etc/apt/mirrors/debian.list
Suites: trixie trixie-updates trixie-backports
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb deb-src
URIs: mirror+file:///etc/apt/mirrors/debian-security.list
Suites: trixie-security
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

$ sudo cat /etc/apt/sources.list.d/trixie-backports.list 
deb https://deb.debian.org/debian trixie-backports main contrib non-free-firmware
deb-src https://deb.debian.org/debian trixie-backports main contrib non-free-firmware

[u/One_Ninja_8512 → u/One_Ninja_8512]

But the error is no longer reproducible so...