GPG error for APT when accessing Google repositories

[stideswell]

Hello

Recently (July 2022) 2020Sanoj and MrBenGriffin have reported that this issue has resurfaced. I can report that I too am seeing it on Ubuntu 20. The original issue was "GPG error: https://dl.google.com/linux/mod-pagespeed/deb stable Release: The following signatures were invalid #1979".

Here's the output when I try to run apt-get update ...

Err:8 http://dl.google.com/linux/mod-pagespeed/deb stable Release.gpg The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <[email protected]> Reading package lists... Done W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://dl.google.com/linux/mod-pagespeed/deb stable Release: The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <[email protected]> W: Failed to fetch http://dl.google.com/linux/mod-pagespeed/deb/dists/stable/Release.gpg The following signatures were invalid: EXPKEYSIG 78BD65473CB3BD13 Google Inc. (Linux Packages Signing Authority) <[email protected]> W: Some index files failed to download. They have been ignored, or old ones used instead.

My APT repository simply has ...
deb http://dl.google.com/linux/mod-pagespeed/deb/ stable main

And I have added the APT key https://dl.google.com/linux/linux_signing_key.pub mentioned here https://www.google.com/linuxrepositories/. The fingerprints displayed when I run apt-key list are the same ones referenced in the documentation.

`pub dsa1024 2007-03-08 [SC]
4CCA 1EAF 950C EE4A B839 76DC A040 830F 7FAC 5991
uid [ unknown] Google, Inc. Linux Package Signing Key [email protected]
sub elg2048 2007-03-08 [E]

pub rsa4096 2016-04-12 [SC]
EB4C 1BFD 4F04 2F6D DDCC EC91 7721 F63B D38B 4796
uid [ unknown] Google Inc. (Linux Packages Signing Authority) [email protected]
sub rsa4096 2021-10-26 [S] [expires: 2024-10-25]`

[jmarantz]

Yes the problem is that Google is no longer officially driving the mod_pagespeed effort, the old download's signature has expired, and the signing infrastructure has evolved.

The latest release (1.14) was issued under the Apache Software Foundation and can be downloaded directly from https://www.modpagespeed.com/doc/download . Can you switch to that?