How to apt-update when apt is not accepting the repository?

Question

I want to do apt-get update on my debian machine. However, I am getting this.

Get:4 http://deb.torproject.org squeeze Release [2,951 B]
Err http://deb.torproject.org squeeze Release (other repositories that are OK) W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.torproject.org squeeze Release: The following signatures were invalid: KEYEXPIRED 1346668560 KEYEXPIRED 1346668560 KEYEXPIRED 1346668560 KEYEXPIRED 1346668560

W: Failed to fetch http://deb.torproject.org/torproject.org/dists/squeeze/Release

W: Some index files failed to download, they have been ignored, or old ones used instead.

What should I do? I don't want to remove the torproject repository, I still use tor time from time...

Answer 1

You could try updating the repository key. When I try to use the tor repository by adding this line to my sources.lst:

deb http://deb.torproject.org/torproject.org squeeze main

I get the following error:

W: GPG error: http://deb.torproject.org squeeze InRelease: The following 
signatures couldn't be verified because the public key is not available: 
NO_PUBKEY 74A941BA219EC810

So, the missing key is 74A941BA219EC810. To add (or update in your case) the key run:

sudo apt-key adv --recv-keys --keyserver keys.gnupg.net  74A941BA219EC810

You should now be able to run `apt-get update with no errors.

Answer 2

To find any expired repository keys and their IDs, use apt-key as follows:

apt-key list | grep expired

You will get a result similar to the following:

pub   4096R/BE1DB1F1 2011-03-29 [expired: 2014-03-28]

The key ID is the bit after the / i.e. BE1DB1F1 in this case.

To update the key, as terdon points out, run

sudo apt-key adv --recv-keys --keyserver keys.gnupg.net BE1DB1F1

Answer 3

You don't have to remove the repository but only disable it. This won't remove tor, just stop it from being updated.

In any case there's a problem with the repository's signature. You might try to remove the repository and add it again. It might solve the problem.