2

I get a warning about unsafe ownership of ~/.gnupg:

curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo gpg --dearmor -o /usr/share/keyrings/githubcli-archive-keyring.gpg
  gpg: WARNING: unsafe ownership on homedir '/home/USER/.gnupg'
  • I have tried the following and nothing worked:
    chown -R $(USER) ~/.gnupg/
    
    find ~/.gnupg -type f -exec chmod 600 {} \;
    find ~/.gnupg -type d -exec chmod 700 {} \;
    
    sudo gpgconf --kill dirmngr
    sudo chown -R USER:USER /home/USER/.gnupg
    chmod 700 /home/USER/.gnupg
    chmod 600 ~/.gnupg/*
    
  • ls -al /home/elias/.gnupg
    
      drwx------  4 USER USER  4096 Jul  1 19:33 .
      drwxr-xr-x 96 USER USER 20480 Jul 10 11:19 ..
      drw-------  2 USER USER  4096 Feb 13  2019 crls.d
      drw-------  2 USER USER  4096 Aug 13  2018 private-keys-v1.d
      -rw-------  1 USER USER  2305 Feb 13  2019 pubring.kbx
      -rw-------  1 USER USER   584 Feb 13  2019 pubring.kbx~
      -rw-------  1 USER USER  1200 Aug 13  2018 trustdb.gpg
    


May be of relevance:

error:45 http://ppa.launchpad.net/hugin/hugin-builds/ubuntu bionic Release    
  404  Not Found [IP: 91.189.95.85 80]

Hit:32 https://www.icesi.edu.co/CRAN/bin/linux/ubuntu xenial-cran35/ InRelease

error:25 https://repo.skype.com/deb stable InRelease
  The following signatures were not valid: EXPKEYSIG 1F3045A5DF7587C3 Skype Linux Client Repository <se-um@microsoft.com>

error:30 http://apt.insynchq.com/ubuntu bionic InRelease
  The following signatures were not valid: EXPKEYSIG A684470CACCAF35C Insynchq Inc <services@insynchq.com>

E: The repository 'https://packages.sury.org/php bionic Release' does not have a Release file.
   N: Updating from such a repository cant be done securely, and is therefore disabled by default.
   N: See apt-secure(8) manpage for repository creation and user configuration details.

E: The repository 'http://ppa.launchpad.net/hugin/hugin-builds/ubuntu bionic Release' does not have a Release file.
   N: Updating from such a repository cant be done securely, and is therefore disabled by default.
   N: See apt-secure(8) manpage for repository creation and user configuration details.

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used.
   GPG error: https://repo.skype.com/deb stable InRelease: The following signatures were not valid: EXPKEYSIG 1F3045A5DF7587C3 Skype Linux Client Repository <se-um@microsoft.com>

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used.
   GPG error: http://apt.insynchq.com/ubuntu bionic InRelease: The following signatures were not valid: EXPKEYSIG A684470CACCAF35C Insynchq Inc <services@insynchq.com>

Extra info that it was asked:

ls -al /usr/share/keyrings/

results:

drwxr-xr-x   2 root root  4096 Jul 10 11:13 .
drwxr-xr-x 621 root root 20480 Jul 10 13:50 ..
-rw-r--r--   1 root root  1795 Jul 10 11:52 githubcli-archive-keyring.gpg
-rw-r--r--   1 root root  2274 May 11 13:19 ubuntu-advantage-cis.gpg
-rw-r--r--   1 root root  2236 May 11 13:19 ubuntu-advantage-esm-apps.gpg
-rw-r--r--   1 root root  2264 May 11 13:19 ubuntu-advantage-esm-infra-trusty.gpg
-rw-r--r--   1 root root  2275 May 11 13:19 ubuntu-advantage-fips.gpg
-rw-r--r--   1 root root  7399 Sep 18  2018 ubuntu-archive-keyring.gpg
-rw-r--r--   1 root root  6713 Oct 27  2016 ubuntu-archive-removed-keys.gpg
-rw-r--r--   1 root root  4097 Feb  6  2018 ubuntu-cloudimage-keyring.gpg
-rw-r--r--   1 root root     0 Jan 17  2018 ubuntu-cloudimage-removed-keys.gpg
-rw-r--r--   1 root root  1227 May 27  2010 ubuntu-master-keyring.gpg

Extra info 2:

sudo env | grep '^HOME='

results:

HOME=/home/elias
6
  • You probably should use ‘gpg‘ alone, not ‘sudo gpg‘.
    – Tomek
    Jul 10, 2021 at 8:38
  • Dont work.... it says "refuse access" Jul 10, 2021 at 8:50
  • If sudoers isn't configured for elias to execute commands as elias, it's going to default to root, leading to the warnings, as in that context, ~/.gnupg isn't owned by root. Also, gpg shouldn't require sudo - do you know why you're unable to access it without sudo? Is /usr/share/keyrings/githubcli-archive-keyring.gpg not accessible to elias; if so, it seems it would be easier to copy the keyring to ~, use gpg, the copy it back with sudo?
    – JW0914
    Jul 10, 2021 at 11:16
  • @JW0914 the info that you asked was added to the question. All keyrings are owned by root:root. Please elaborate more on the final proposition of yours. Jul 10, 2021 at 11:53
  • Does sudo env | grep '^HOME=' give your home directory or root's? If it's yours then I have an answer for you
    – roaima
    Jul 10, 2021 at 12:03

1 Answer 1

5

Let's look a moment at what this command is doing (simplified for the illustration)

curl … | sudo gpg … -o /usr/share/keyrings/githubcli-archive-keyring.gpg

The curl part goes off and gets something we are going to give to gpg; no problem there.

The sudo gpg command runs gpg as root, but with an unchanged HOME directory. When gpg runs it checks $HOME/.gpg for ownership and permissions. In this case it is running as root but finds that instead of the directory being owned by root it's being owned by USER. Appropriately it complains, loudly

gpg: WARNING: unsafe ownership on homedir '/home/USER/.gnupg'

You mentioned that you cannot omit the sudo, and I would assume this is because you need root permissions to write to /usr/share/keyrings/. The solution in this case may be to tell sudo to change the HOME directory value to match the root user

sudo -H gpg --dearmor -o /usr/share/keyrings/githubcli-archive-keyring.gpg

The documentation (man sudo) explains,

-H, --set-home Request that the security policy set the HOME environment variable to the home directory specified by the target user's password database entry.

Another option is to run gpg without sudo and write the key to your own HOME directory, and then use sudo to move it to the target directory

gpg --dearmor -o githubcli-archive-keyring.gpg &&
    sudo mv -f githubcli-archive-keyring.gpg /usr/share/keyrings/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.