Debain repo critical error

[VladislavGatsenko]

After the 8th of the month, I am having a problem adding the mosquitto repository to my Debian 12.5 system.

I use the following set of commands to add the repository (it worked before 8th without problems):

sudo wget -qO- https://repo.mosquitto.org/debian/mosquitto-repo.gpg.key | sudo tee /etc/apt/trusted.gpg.d/mosquitto-repo.asc &&\
sudo wget -O /etc/apt/sources.list.d/mosquitto-bookworm.list https://repo.mosquitto.org/debian/mosquitto-bookworm.list && \
sudo apt update

Now I (and my colleagues) get an error:

W: GPG error: https://repo.mosquitto.org/debian bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 61611AE430993623
E: The repository 'https://repo.mosquitto.org/debian bookworm InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See the apt-secure(8) manpage for repository creation and user configuration details.

Full log:

root@debian:~# sudo wget -qO- https://repo.mosquitto.org/debian/mosquitto-repo.gpg.key | sudo tee /etc/apt/trusted.gpg.d/mosquitto-repo.asc && \
sudo wget -O /etc/apt/sources.list.d/mosquitto-bookworm.list https://repo.mosquitto.org/debian/mosquitto-bookworm.list && \
sudo apt update
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFDnU4UBEADbtHyC/CR1OXZo0s5+nxLYtvXAVSJU0T+I91e+iJAeayyzH0iI
33l12L9N20Q+eYfELelX61NIU++u+xi5wa6/R/L+Aeu3P2E/dQmtYx8zzjjPhQQm
lnX3huaMoqBxHthvD+XJjKwHHJbyDzcdJGodN2nUsqCfUgcAgS7ZME8xYz83U5iH
/deHgpWBjtI5VNV/GDJc/oi1dh8V+I5fzxRjl3/tiCiM8w1zMBs2oxBJ5JgC4wvy
uj7y8c6iysAFXk7fSnplsZFj/bNvIhCKH0Cr93Dv/3kLy5bkZxsmqOd4MdQTVwae
Eb/F7uK8uQ7Hios6mKReWfsFuuDfXZi2D7GYhpQTdg1fZJ3Ca0woSDQPUJe9rIJn
olHC37in1n2g5VtR3chSIqsqgGARDwguyAzEJETYPpZy+sgpLKbN/8mSeGYNihfM
23susBAM+WyKPEdWu9aTkFBsn76WL6SCIyiWMNukQ9UD8XdbM6rNR6LhdBUg7g2y
uu42k3yo7h7Z8t5LkRrack234KE+vCcGP33OgMiOoEivDMR1UvZDn8i0flU/z+O/
oJiUjt1S4TBYeLKknxyKyW0Ducz5GnW7ZRIDT9ibfuhlxN4MmktRIXLY2by9njYB
08F/lAyH1nRASl/UgMp9t4rcqr5fnnLNlxJgBoP11xviyvzAzTey9N/W/QARAQAB
tC1Nb3NxdWl0dG8gQXB0IFJlcG9zaXRvcnkgPHJlcG9AbW9zcXVpdHRvLm9yZz6J
AlUEEwEKAD8CGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAFiEEgnfMtJ7FtZXy
0scTYWEa5DCZNiMFAl4MhdQFCR/xNU8ACgkQYWEa5DCZNiMHaxAAsVZ6VoyQFccA
4q2af5RPSiS+aL9w1dAHlqb5fJSGibEre5Ux2954Qss8EheH1YN9YE/LaCLe9xhg
ZQ8upx2qVahK3QJ0t/Wh71U7ZHN4DdF4owgr5nfPGxGZ7wyEdk2E+eaW1NpS251p
K4K4EIOr++r/cp+T92Jt9z05V5aahurUbwXAstfTgAs/0Qw+U243Gf0i5cLDL436
n5CdVLv3JZGT46DDcNkNk1HBYe/INIZH2TSVlSMLvm6L53yfSWtSOufUUWFFvMe8
awpWvKte73Juzh5KvrCklVRLJnQjGZVXc7XwZS9tXvMMnqnwNka+FcHuP0YONepo
yQicktcOXLxkuRoyajMaiHRrXWsa32C9/IjpAkC0Jz3Mz45vr3ElfwJ6bkQshdqR
CcehiMCvTQlwmTQixP9ZXTGceh0Yd3MS8TWwiYP1Rq77cGMaj5thngYfpkOFUUsh
TqHDqfbpEwZMjfaPR9UAH6tbNQeI2qMOxIiE4+ABD3HTyWAMnqrVzHelHjSSrmMv
5/EZ4orXwtw7nlYiwB1VoOTIIK84brQJWFFw82Ktwi6mDdqNJ+sdqB2RefDLTvsP
WBalVWjirUPrCYbQvHln9ldDP0KTkws1J4oKb+PpBxEtaAa7RR3G9HRbiIOpEIBY
ItcCoyWRpCRy+sP6Zxju6eiXD1dDgPK5Ag0EUOdThQEQAMSouQQEEk0V7uS7vWIu
wUrZMwSU9kxh7zqaPJCnezIMY8GLJXFVROL9bWESv+Ny7c9xg8J/fiYfOWp7LJov
u+thrdaQ2x1yWb5zkU4ZmHESX/asb5hqEAggcxHbqzCViqGH94hzD35yXV/PkR3R
BLuSUiOX+F4edyU8OqJ8KgmEsS8xu17877vb4tc6NFhW8tFzzG8ibWF+diIVBsOa
tH2ZIncTX25Er+rW6rT7DUjvAJAkaGmtdbx5Mreyw72Lvs7Pu9/K/wwSsfayE9ob
HzovsQQdwQ75l20y5fQ9Wb3/6LU3rydkDQn7rquqxQIuBMc3e85I/ECGkXv3qVuh
8Las3/78RwRtw5RQNv2D/RO78hgC6wiHPGMpqvHeheHU4OMLZN1aoUxZ3Uiwo6kb
MeFfDlTY2A39wAScjSa+mgipeYQQhnooflomDfqMxDB68bVwPUprAYSpHip++sGx
Sp2Rwpf97QssbAF3LES11X7wsmqCbkXxjAqJkqJyU/OB6TGrdWp3cNvLWodg7ewH
wr17ePw+83MXsUHklYJjk9F/R+Grq4Ut2tkKm03QC3M6Tfa6QZj8JqdOYc+kF1G2
wueiFr23vlnIMm8fGFwgRLNUJQ9a8xHSCk1uhwHnTnyx219I+V987Y6cjLbukCIW
lgVQR9IAlovyNSs35XRy0+6bABEBAAGJAjwEGAEKACYCGwwWIQSCd8y0nsW1lfLS
xxNhYRrkMJk2IwUCXgyGDAUJH/E1hwAKCRBhYRrkMJk2IwHoEADSaT3T0TYIpuzJ
NCOjMHznfHWXYWyI+M89r3yeXfoSYD+kDKfM5MAGptNZrp/AhL8CP9LXI5/yrkYq
d283PBWrSKHmQkLOZIp2iv4b6W4khWniC2dfyPcHfEnOxcdbSag16E4r6sM6oi8W
XwgWVwC9XvGxpJj85og19VyjYmPCYtpEgXQot432sDcxAeIbAdJnDuQBHzm1e4sC
5dW96aDlLkClN5Gd8bzscTnyt7icPpy+QxcJR5Ih49dh/0LyJBNIsrNyE83vtXaa
4Sd78FXA0zdlPCrIVxIh0RQ5soNZUIylh/vXK9LzYJIJYULFZGhsiZ+l5fUU8zSS
Btf5a4jDtkRWOHxc5A76Wm/gJVqJ9JHHJRQOuBeQGL2RpSdKQcLzAN2MHx6il95o
prgSuYpTy4tv/FeI/xItwFwZwc99qy+SPnks831efleFse71v9uzZ9xRd7GTpj5i
1OAP/IcpIFd6dsqTAlVoel+sNvE1HjUlIDre87UoqIzjs+DVXl/FocLDIub7Zcb4
zpLmwZrYQpWMcnDcwFKko3i0Jso2gSZdRkjXahbUrv7yUmehbiUslun3la/Ga++S
Jl+ToCeR7Mwd13j6yl+PhkBHrjE/Mh/mLN3jhFaHEbhn+VecAM5XgDVn3LMmo48U
s0CcAA8PgqiftljzfmpNypsDsO1FmQ==
=pZgG
-----END PGP PUBLIC KEY BLOCK-----
--2024-03-09 17:34:36--  https://repo.mosquitto.org/debian/mosquitto-bookworm.list
Resolving repo.mosquitto.org (repo.mosquitto.org)... 85.119.83.194, 2001:ba8:1f1:f271::2
Connecting to repo.mosquitto.org (repo.mosquitto.org)|85.119.83.194|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 101 [application/octet-stream]
Saving to: ‘/etc/apt/sources.list.d/mosquitto-bookworm.list’

/etc/apt/sources.list.d/mosqu 100%[=================================================>]     101  --.-KB/s    in 0s      

2024-03-09 17:34:36 (211 MB/s) - ‘/etc/apt/sources.list.d/mosquitto-bookworm.list’ saved [101/101]

Hit:1 http:https://mirror.mephi.ru/debian bookworm InRelease
Get:2 http:https://mirror.mephi.ru/debian bookworm-updates InRelease [55.4 kB]                                       
Get:3 https://repo.mosquitto.org/debian bookworm InRelease [18.7 kB]                                                   
Err:3 https://repo.mosquitto.org/debian bookworm InRelease                                        
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 61611AE430993623
Get:4 http:https://security.debian.org/debian-security bookworm-security InRelease [48.0 kB]
Get:5 http:https://security.debian.org/debian-security bookworm-security/main Sources [83.7 kB]
Get:6 http:https://security.debian.org/debian-security bookworm-security/main amd64 Packages [145 kB]
Get:7 http:https://security.debian.org/debian-security bookworm-security/main Translation-en [86.3 kB]
Reading package lists... Done                                   
W: GPG error: https://repo.mosquitto.org/debian bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 61611AE430993623
E: The repository 'https://repo.mosquitto.org/debian bookworm InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
root@debian:~# 

[Daedaluz]

If you open mosquitto-bookworm.list you'll see that there is a signed-by attribute before the repo location.
It doesn't look like you placed the public key there.

[VladislavGatsenko]

So the problem is that previously adding the repository worked correctly. And since yesterday it started to happen (key error). I tested it on different machines, and the picture is the same everywhere: error when adding repository.
Somewhere on the mosquitto server there was a change. That's why this ticket was created.

By the way, there were no changes in the documentation on the official mosqutto site in terms of adding a repository for Debian.

[VladislavGatsenko]

Ok, that's fix changes in mosquitto-bookworm.list after 8th march.

sudo wget -qO- https://repo.mosquitto.org/debian/mosquitto-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/mosquitto-repo.gpg && \
sudo wget -O /etc/apt/sources.list.d/mosquitto-bookworm.list https://repo.mosquitto.org/debian/mosquitto-bookworm.list && \
sudo apt update

[Daedaluz]

I guess there is a "new" way to connect to third party repos? Or rather a more the-debian-way to add third party repo?

Maybe this can shed some light.
And the README.txt seems to have the correct instructions.

I don't know which instructions you have been following but the mosquitto.org version seems a bit out of date as it doesn't even list bullseye, and I don't know if it is still relevant.

I havent personally aware of any direct changes to how to install mosquitto broker, but then again, i usually run it in a docker environment.