Ubuntu linux repository failure

[Graeme T.1]

I'm updating Dropbox through apt on Ubuntu 22.04, and run my usual command for updating all my packages.

This time, I received the following error message:

E: The repository 'http://linux.dropbox.com/ubuntu disco Release' no longer has a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Obviously I'm not running Ubuntu disco (19.04) any more, but jammy (22.04). Manually deleting the line in my /etc/apt/sources.list.d/dropbox.list did stop the error occurring, but trying to add the sources line

deb https://linux.dropbox.com/ubuntu jammy main

gives a similar error: 

E: The repository 'https://linux.dropbox.com/ubuntu jammy Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Will removing the line completely cause an issue with updating Dropbox for new versions?

[Walter]

Hey @Graeme T.1, sorry to hear about this.

Can you please clarify if you tried updating the app by downloading and installing the latest version from this page?

If you did and still get an error or you notice an issue with the desktop app not working, please let us know.

Thanks!

[Graeme T.1]

I installed it using the download from the website, which added the entry to the sources list. It's been continually updated (automatically) without needing this line

[Hannah]

Hey @Graeme T.1, thanks for the update here and sorry for the delay in our response. 

May we reach out to you via email, so we can investigate further?

[matte90]

Hi there,

I'm facing the same issue here. It seems the keyring for Dropbox is expired!? In the past I followed the instruction at this link, but now with the March update it seems to not be working anymore... Let me know whether is an issue form Dropbox side, thanks

Matteo

[BenDBX]

Hello and thanks for reporting these issues,

@Graeme T.1 the repository issue was fixed last week. You should be able to update without receiving this error message.

@matte90 Our engineering team says that this is a warning message that shouldn't cause a block. They are currently investigating why this is happening. In the meantime, it would help us if you could tell us what OS you are using and the specific error message you're receiving.

Regards,

Ben

[matte90]

Hi @BenDBX,

I'm currently on Ubuntu 22.04.2 "Jammy Jellyfish". Unfortunately, I uninstalled DB because it prevented me from running successfully sudo apt update. In fact, what I was getting was a warning related to deprecated keyring.

However, playing around I got to the same issue @Graeme T.1 was facing, without any option to solve concretely. Before I relied on an external GPG key as per here.

[vhertz]

Hi, everyone.

I have the same issue with @matte90 on the same environment (Ubuntu 22.04.2 LTS).

I have updated my /etc/apt/sources.list.d/dropbox.list like this:

-deb [arch=i386,amd64] http://linux.dropbox.com/ubuntu disco main
+deb [arch=i386,amd64] http://linux.dropbox.com/ubuntu jammy main

Then, I've run `apt update` and it says:

W: GPG error: http://linux.dropbox.com/ubuntu jammy Release: The following signatures were invalid: BADSIG FC918B335044912E Dropbox Automatic Signing Key <linux@dropbox.com>
E: The repository 'http://linux.dropbox.com/ubuntu jammy Release' is not signed.

Any solutions?

[mitszo]

I downloaded Release and Release.gpg from https://linux.dropbox.com/ubuntu/dists/jammy/ and verified the signature with the GPG key `1C61A2656FB57B7E4DE0F4C1FC918B335044912E` , but it was invalid.

```

$ gpg --verify jammy/Release.gpg jammy/Release
gpg: Signature made Thu Mar 5 08:22:09 2020 JST
gpg: using RSA key FC918B335044912E
gpg: BAD signature from "Dropbox Automatic Signing Key <linux@dropbox.com>" [unknown]

```

[Здравко]

---

@BenDBX wrote:

...

@Graeme T.1 the repository issue was fixed last week. You should be able to update without receiving this error message.

...

---

Hi @BenDBX,

What you mean "fixed"? 🧐 Did you take a look on the Release.gpg file both in "disco" and in "jammy" sections of the repository? 🤔 Did you see that they are the same file actually (or 2 copies of the same file)? 😯 How you expect this key to match 2 different Release files simultaneously? That would be a big security issue! 🤫 Fortunately it's not.

---

@BenDBX wrote:

...

@matte90 Our engineering team says that this is a warning message that shouldn't cause a block. They are currently investigating why this is happening. In the meantime, it would help us if you could tell us what OS you are using and the specific error message you're receiving.

...

---

Can you ask your "engineering team" how incorrect signing key depends on OS or anything else out of signing algorithm? 🤷🤦 Ask them why the key file is copied instead of recreated (corresponding to what's signed),  as has to be... Do you and some of your neighbors have the same door' keys? In the same context you have to be surprised why you can't unlock your neighbor' door using the key of your door! Would you do it there? Why are you doing it here? It's the same!... In this context - "warning message" - 🧐 what's a warning for you?

All others: Why do you intent use particular name? Using any available release name, that works (signed with proper key), would be fine. 😉 All they point to the same pool; there are no different pools/application releases for different OS' releases, so the name doesn't matter (if we ignore wrong signing 😁).

Good luck.