Dear All,
When trying to install
dnf install skypeforlinux
I am getting the error below transcribed.
Could you please help me with this?
Thanks in advance,
Paul -----------------------------
Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test RPM: error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com): RPM: 1. Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z RPM: 2. Key 1F3045A5DF7587C3 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z RPM: error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com): RPM: 1. Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z RPM: 2. Key 1F3045A5DF7587C3 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z Error: Transaction test error: package skypeforlinux-8.97.0.404-1.x86_64 does not verify: Header V4 RSA/SHA256 Signature, key ID df7587c3: NOTTRUSTED
On Sat, 2023-05-13 at 14:17 +0100, Paul Smith wrote:
When trying to install
dnf install skypeforlinux
I am getting the error below transcribed.
Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test RPM: error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com): RPM: 1. Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z RPM: 2. Key 1F3045A5DF7587C3 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z RPM: error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com): RPM: 1. Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z RPM: 2. Key 1F3045A5DF7587C3 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z Error: Transaction test error: package skypeforlinux-8.97.0.404-1.x86_64 does not verify: Header V4 RSA/SHA256 Signature, key ID df7587c3: NOTTRUSTED
The errors tell you that the certificates are seriously out of date, possibly the package you're trying to install is similarly out of date, either of which could be big problem with something like Skype (not compatible with the current things it needs to connect to, and all the security problems it might have).
You haven't said where you're trying to install it from. And, if that's a local file (which is not what I meant by the prior question), where did you get it from?
On Sat, May 13, 2023 at 3:29 PM Tim via users users@lists.fedoraproject.org wrote:
When trying to install
dnf install skypeforlinux
I am getting the error below transcribed.
Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test RPM: error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com): RPM: 1. Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z RPM: 2. Key 1F3045A5DF7587C3 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z RPM: error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com): RPM: 1. Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z RPM: 2. Key 1F3045A5DF7587C3 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2021-06-21T09:36:35Z Error: Transaction test error: package skypeforlinux-8.97.0.404-1.x86_64 does not verify: Header V4 RSA/SHA256 Signature, key ID df7587c3: NOTTRUSTED
The errors tell you that the certificates are seriously out of date, possibly the package you're trying to install is similarly out of date, either of which could be big problem with something like Skype (not compatible with the current things it needs to connect to, and all the security problems it might have).
You haven't said where you're trying to install it from. And, if that's a local file (which is not what I meant by the prior question), where did you get it from?
Thanks, Tim and Doug, for your answers.
I got the skype rpm from the skype web-site itself:
https://www.skype.com/en/get-skype/
Paul
On Sat, May 13, 2023, at 6:17 AM, Paul Smith wrote:
Dear All,
When trying to install
dnf install skypeforlinux
I am getting the error below transcribed.
Could you please help me with this?
Thanks in advance,
Paul
Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test RPM: error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com):
A google search of that email address will pull up lots of discussion on this.
On Sat, May 13, 2023, at 6:17 AM, Paul Smith wrote:
Dear All,
When trying to install
dnf install skypeforlinux
I am getting the error below transcribed.
Could you please help me with this?
Thanks in advance,
Paul
Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test RPM: error: Verifying a signature using certificate
You can try:
sudo dnf install --nogpgcheck ./skypeforlinux-64.rpm
On Tue, May 16, 2023, at 9:28 AM, Doug Herr wrote:
On Sat, May 13, 2023, at 6:17 AM, Paul Smith wrote:
Dear All,
When trying to install
dnf install skypeforlinux
I am getting the error below transcribed.
Could you please help me with this?
Thanks in advance,
Paul
Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test RPM: error: Verifying a signature using certificate
You can try:
sudo dnf install --nogpgcheck ./skypeforlinux-64.rpm
Or, even better:
First download their GPG key
$ curl https://repo.skype.com/data/SKYPE-GPG-KEY > skype-gpg-key
Then import it to RPM:
#sudo rpm --import skype-gpg-key
And then try your install.
On Tue, May 16, 2023 at 5:38 PM Doug Herr fedoraproject.org@wombatz.com wrote:
When trying to install
dnf install skypeforlinux
I am getting the error below transcribed.
Could you please help me with this?
Thanks in advance,
Paul
Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test RPM: error: Verifying a signature using certificate
You can try:
sudo dnf install --nogpgcheck ./skypeforlinux-64.rpm
Or, even better:
First download their GPG key
$ curl https://repo.skype.com/data/SKYPE-GPG-KEY > skype-gpg-key
Then import it to RPM:
#sudo rpm --import skype-gpg-key
And then try your install.
Thanks, Doug. I tried as you suggested, but again:
---------------------------- [SKIPPED] skypeforlinux_8.97.0.404-1.x86_64.rpm: Already downloaded error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com): 1. Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z 2. Key 1F3045A5DF7587C3 invalid: key is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com): 1. Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z 2. Key 1F3045A5DF7587C3 invalid: key is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z Skypeforlinux - stable 13 kB/s | 1.7 kB 00:00 GPG key at https://repo.skype.com/data/SKYPE-GPG-KEY (0xDF7587C3) is already installed The GPG keys listed for the "Skypeforlinux - stable" repository are already installed but they are not correct for this package. Check that the correct key URLs are configured for this repository.. Failing package is: skypeforlinux-8.97.0.404-1.x86_64 GPG Keys are configured as: https://repo.skype.com/data/SKYPE-GPG-KEY The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: GPG check FAILED ----------------------------
Paul
Paul Smith wrote:
Thanks, Doug. I tried as you suggested, but again:
[SKIPPED] skypeforlinux_8.97.0.404-1.x86_64.rpm: Already downloaded error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com):
- Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z
- Key 1F3045A5DF7587C3 invalid: key is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z
error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com):
- Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z
- Key 1F3045A5DF7587C3 invalid: key is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z
Skypeforlinux - stable 13 kB/s | 1.7 kB 00:00 GPG key at https://repo.skype.com/data/SKYPE-GPG-KEY (0xDF7587C3) is already installed
AFAICT, you have the older key installed, which has expired. You'll need to remove it first, and then run the update again, allowing the updated key to be installed.
You can confirm the right key before removing it with:
rpm -qi gpg-pubkey-df7587c3
and then remove it with:
rpm -e gpg-pubkey-df7587c3
(Notice the "version" is the lower-cased key id, listed in the dnf output as 0xDF7587C3.)
On Tue, May 16, 2023 at 7:44 PM Todd Zullinger tmz@pobox.com wrote:
Paul Smith wrote:
Thanks, Doug. I tried as you suggested, but again:
[SKIPPED] skypeforlinux_8.97.0.404-1.x86_64.rpm: Already downloaded error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com):
- Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z
- Key 1F3045A5DF7587C3 invalid: key is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z
error: Verifying a signature using certificate D4040146BE3972509FD57FC71F3045A5DF7587C3 (Skype Linux Client Repository se-um@microsoft.com):
- Certificiate 1F3045A5DF7587C3 invalid: certificate is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z
- Key 1F3045A5DF7587C3 invalid: key is not alive because: The primary key is not live because: Expired on 2021-06-21T09:36:35Z
Skypeforlinux - stable 13 kB/s | 1.7 kB 00:00 GPG key at https://repo.skype.com/data/SKYPE-GPG-KEY (0xDF7587C3) is already installed
AFAICT, you have the older key installed, which has expired. You'll need to remove it first, and then run the update again, allowing the updated key to be installed.
You can confirm the right key before removing it with:
rpm -qi gpg-pubkey-df7587c3
and then remove it with:
rpm -e gpg-pubkey-df7587c3
(Notice the "version" is the lower-cased key id, listed in the dnf output as 0xDF7587C3.)
Thanks a lot, Todd: I could finally install skype!
Paul
On Tue, 2023-05-16 at 14:43 -0400, Todd Zullinger wrote:
AFAICT, you have the older key installed, which has expired.
Tangentially, I'm not sure of the value of expiring keys, other than for timebombing things.
On 16 May 2023, at 22:51, Tim via users users@lists.fedoraproject.org wrote:
On Tue, 2023-05-16 at 14:43 -0400, Todd Zullinger wrote:
AFAICT, you have the older key installed, which has expired.
Tangentially, I'm not sure of the value of expiring keys, other than for timebombing things.
In the general case it puts a limit on how long a compromised key will be usable. Let’s encrypt keys only live for 3 months (?) for example.
But it all depends on security threat model.
Barry
--
uname -rsvp Linux 3.10.0-1160.90.1.el7.x86_64 #1 SMP Thu May 4 15:21:22 UTC 2023 x86_64
Boilerplate: All unexpected mail to my mailbox is automatically deleted. I will only get to see the messages that are posted to the mailing list.
users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Tim:
Tangentially, I'm not sure of the value of expiring keys, other than for timebombing things.
Barry:
In the general case it puts a limit on how long a compromised key will be usable. Let’s encrypt keys only live for 3 months (?) for example.
If they've compromised it, couldn't *they* renew it, too?
On Wed, 2023-05-17 at 17:45 +0930, Tim via users wrote:
Tim:
Tangentially, I'm not sure of the value of expiring keys, other than for timebombing things.
Barry:
In the general case it puts a limit on how long a compromised key will be usable. Let’s encrypt keys only live for 3 months (?) for example.
If they've compromised it, couldn't *they* renew it, too?
Not in general. Most key compromises are due to leaks and don't enable the adversary to generate new valid keys.
poc
Are you sure you even need to install an app? https://www.skype.com/en/features/skype-web/
On Wed, May 17, 2023 at 12:26 PM Neal Becker ndbecker2@gmail.com wrote:
Are you sure you even need to install an app? https://www.skype.com/en/features/skype-web/
Yes, Neal, as the web-version of Skype cannot blur the video background.
Paul
On Wed, May 17, 2023 at 2:47 AM Barry barry@barrys-emacs.org wrote:
On 16 May 2023, at 22:51, Tim via users users@lists.fedoraproject.org wrote:
On Tue, 2023-05-16 at 14:43 -0400, Todd Zullinger wrote:
AFAICT, you have the older key installed, which has expired.
Tangentially, I'm not sure of the value of expiring keys, other than for timebombing things.
In the general case it puts a limit on how long a compromised key will be usable. Let’s encrypt keys only live for 3 months (?) for example.
But it all depends on security threat model.
The reason for short lived certificates is to keep CRLs small, especially for mobile devices. In the past, mobile clients were asked to download 60 MB CRLs over a 2G or 3G connection. UI's literally hung while trying to perform the revocation checks.
Google experimented with a 30 day expiration, if I recall correctly.
Key continuity is much more valuable than gratuitous key rotation. Never throw away a perfectly good key (or password). In fact, unexpected key changes - from the relying party's view - should be considered a red flag.
Key continuity and Public Key Pinning is what revealed the DigiNotar compromise. Here's the Iranian kid's message that started the whole thing off: http://productforums.google.com/forum/#!category-topic/gmail/share-and-discu... .
Unfortunately, Google's asshole webmaster broke the link. Where can I get a job breaking shit like a webmaster?
Jeff
On Wed, 2023-05-17 at 19:20 -0400, Jeffrey Walton wrote:
The reason for short lived certificates is to keep CRLs small, especially for mobile devices. In the past, mobile clients were asked to download 60 MB CRLs over a 2G or 3G connection. UI's literally hung while trying to perform the revocation checks.
What a brain-dead way to do things! I would have created a system that worked long these lines:
You try to connect to https://example.com and find that it's certificate was issued by https://example.org, so you poll example.org about the veracity of the specific certificate for example.com.
Back in my early days of browsing I noticed that the web browsers came preconfigured not to check on the revocation status of certificates, operating in a "trust me, you fool" mode (no double-checks).
If you enabled the check, various proper web sites failed. Another lot of people who like to appear to be doing the right thing, without actually doing the job properly.
Key continuity is much more valuable than gratuitous key rotation. Never throw away a perfectly good key (or password). In fact, unexpected key changes - from the relying party's view - should be considered a red flag.
Yes, I'm suspicious of new keys/certificates. If this was created yesterday, *HOW* do I know it's the same entity as I was dealing with last month? (As a quick process, rather than having to do an in-depth investigation.)
Key continuity and Public Key Pinning is what revealed the DigiNotar compromise. Here's the Iranian kid's message that started the whole thing off: http://productforums.google.com/forum/#!category-topic/gmail/share-and-discu... .
Unfortunately, Google's asshole webmaster broke the link. Where can I get a job breaking shit like a webmaster?
Just about any website, it seems. The idea that information is worth keeping for more than two days seems foreign to some people. I get the impression many have ADHD. On the other hand some news services pop up recommended stories in the middle of the one you're reading that are 10 years out of date, with only the tiniest of clues that they are. And I mean recommended reading because it's somewhat similar, or not at all, to the current story. Not that it's been suggested as associated further reading.
I assume you meant that the link you provided was not going to work (it didn't). A quick google of "DigiNotar compromise" provided a page on Wikipedia summarising the thing. People decry the website, but I find a good starting point for a moderately brief description, at least, with links for further reading.
https://discussion.fedoraproject.org/t/dnf-update-failed-skype-gpg-key-expir...
sudo rm /etc/yum.repos.d/skype-stable.repo rpm -qa gpg-pubkey --qf "gpg-pubkey-%{version}-%{release} %{summary}\n" sudo rpm -e gpg-pubkey-df7587c3-576a5c23 sudo rpm -e gpg-pubkey-df7587c3-576a5c23 sudo curl -o /etc/yum.repos.d/skype-stable.repo https://repo.skype.com/rpm/stable/skype-stable.repo dnf clean all sudo dnf update skypeforlinux -y sudo dnf install skypeforlinux -y
Hope this help Dario
Il giorno sab, 13/05/2023 alle 14.17 +0100, Paul Smith ha scritto:
Dear All,
When trying to install
dnf install skypeforlinux
I am getting the error below transcribed.
Could you please help me with this?
Thanks in advance,
Paul
Dario Lesca wrote:
https://discussion.fedoraproject.org/t/dnf-update-failed-skype-gpg-key-expir...
sudo rm /etc/yum.repos.d/skype-stable.repo rpm -qa gpg-pubkey --qf "gpg-pubkey-%{version}-%{release} %{summary}\n" sudo rpm -e gpg-pubkey-df7587c3-576a5c23 sudo rpm -e gpg-pubkey-df7587c3-576a5c23 sudo curl -o /etc/yum.repos.d/skype-stable.repo https://repo.skype.com/rpm/stable/skype-stable.repo dnf clean all sudo dnf update skypeforlinux -y sudo dnf install skypeforlinux -y
That's a lot more work than necessary. :)
All that's really needed is:
rpm -e gpg-pubkey-df7587c3-576a5c23 dnf upgrade skypeforlinux
It's also worth noting that `update` is a deprecated alias for `upgrade` in dnf. It's best to get out of the habit of using it, should it eventually be removed. :)
On Wed, 2023-05-17 at 22:29 +0200, Dario Lesca wrote:
sudo rpm -e gpg-pubkey-df7587c3-576a5c23 sudo rpm -e gpg-pubkey-df7587c3-576a5c23
So much fun it's worth doing twice? ;-)