Signing key not appearing on my PPA page

[Adrianna Pińska]

As requested, I am converting this question to a bug report, since it seems to be a bug. Original question:

I have previously noticed that some PPAs publish a signing key and fingerprint in the "technical details" dropdown, but some do not, and I don't understand what determines this. My PPA (https://launchpad.net/~cartavis-team/+archive/ubuntu/carta) does not display this information. I know that the key exists, because I have built packages in the PPA, and I had to import the key into my pbuilder chroot when setting up dependencies. Does it just take time for the key to be published on the page, or is there something that I need to do to make it appear?

[Colin Watson (cjwatson)]

I have the beginnings of a fix for this, but need to spend some more time writing tests.

[SOURAV DAS (pipewire-debian)]

same here for https://launchpad.net/~pipewire-debian/+archive/ubuntu/pipewire-upstream this.

[Ethan Trevor (elaunch)]

I have the same problem on https://launchpad.net/~elaunch/+archive/ubuntu/ppa . In the "Technical details about this PPA" I cannot see any signing key, although the packages are signed. How can I set up a ppa repository with the trusted key on a debian system manually?

[Ethan Trevor (elaunch)]

Is there any other documented API to get the PPA signing key?

[Adrianna Pińska (confluence)]

My repository is still having this issue.

Ethan, you could use `add-apt-repository` to add the PPA on an Ubuntu system (e.g. in a container) and then use `sudo apt-key list` to look at all the installed keys and find the fingerprint of the key for that PPA (matching it using the description and possibly also the filename -- I believe that `add-apt-repository` saves keys to individual files in `/etc/apt/trusted.gpg.d/`).

You can apparently also install `add-apt-repository` on Debian, which would be simpler (it's in the `python-software-properties` package).

[Ethan Trevor (elaunch)]

Hello Adrianna,
thank you for your reply! You are right, `sudo apt-key list` shows the PPA key on an Ubuntu system.

I am trying to use the PPA on a Raspberry Pi (which has a Debian-based OS).
I could get the `add-apt-repository` command by installing the `software-properties-common` package. Unfortunately, `sudo add-apt-repository ppa:elaunch/ppa` still adds only the APT source, but not the key. `sudo apt update` prints the error `NO_PUBKEY D80E587E7E12369C`.

So, as a workaround, I note down the key ID from the error message and use the following script to install the PPA key and source:
```
curl 'https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xD80E587E7E12369C' | gpg --dearmor | sudo tee /usr/share/keyrings/elaunch-ppa-focal.gpg > /dev/null
echo 'deb [signed-by=/usr/share/keyrings/elaunch-ppa-focal.gpg] https://ppa.launchpadcontent.net/elaunch/ppa/ubuntu focal main' | sudo tee /etc/apt/sources.list.d/elaunch-ppa-focal.list > /dev/null
```

I think also for security there should be a way to check the correct key ID in the Launchpad web interface to prevent MITM attacks.

Launchpad developers, can you please show the PPA key in the web interface?

[Adrianna Pińska (confluence)]

This issue is still affecting my PPA. Is there any more information about a fix?

[MattRose (mattrose)]

This issue also affects my PPA https://launchpad.net/~mattrose/+archive/ubuntu/terminator. With the recent changes to apt-key add and the way that debian is dealing with gpg package keys this is becoming more and more important.

[MattRose (mattrose)]

Any progress on this? It looks like a fix is just waiting for review?

[Colin Watson (cjwatson)]

Sorry for the delay - this is now fixed.