From 67d6d30cc4c86eb46e767e63e73ac1458ce95594 Mon Sep 17 00:00:00 2001 From: Jens Ahrensfeld Date: Sun, 26 Jul 2026 20:55:36 +0200 Subject: [PATCH] Fix stale ondrej/php RSA-1024 key warning on alpha; document the gotcha add-apt-repository --remove silently no-op'd against the existing non-standard-named .sources file left over from an earlier release upgrade. Removed the stale source/key manually and re-added the PPA fresh - now embeds Signed-By inline, no more separate trusted.gpg.d keyring file. Verified clean apt update, no package churn, dyndns and sanity-check still pass. --- SETUP.md | 23 +++++++++++++++++++++++ TODO.md | 34 +++++++++++++++++++++++----------- 2 files changed, 46 insertions(+), 11 deletions(-) diff --git a/SETUP.md b/SETUP.md index 80f6251..3f4c286 100644 --- a/SETUP.md +++ b/SETUP.md @@ -645,6 +645,29 @@ the release upgrade completes is what actually finishes the job. Check assuming a completed `do-release-upgrade` run means everything is current. +**A `Signature ... uses weak algorithm (rsa1024)` warning on this PPA is +a Launchpad-wide artifact, not a sign this PPA is untrustworthy or +compromised** — Launchpad signed every PPA with one shared RSA-1024 key +from 2009 until re-signing everything with RSA-4096 by August 2024; +newer apt versions just started warning about the *old* cached copy of +that key wherever it's still present locally. If it shows up, don't +just live with it or assume something's wrong with the PPA — remove the +stale source file and key and re-add the PPA fresh: +```bash +sudo rm /etc/apt/sources.list.d/ondrej-ubuntu-php-*.sources \ + /etc/apt/trusted.gpg.d/ondrej_ubuntu_php.gpg # if present - old key file +sudo add-apt-repository -y ppa:ondrej/php +``` +**`add-apt-repository --remove` doesn't reliably work here if the +existing source file has a non-standard name** (e.g. a +`...-focal.sources` file left over from an earlier release-upgrade +rename, as happened on this host) — its matching logic can silently no-op +or touch an unrelated entry instead. Deleting the old `.sources`/key +files directly and re-adding fresh, as above, is the reliable path. +A freshly-added PPA now embeds the signing key inline via `Signed-By:` +in the `.sources` file itself (modern deb822 style) rather than a +separate `/etc/apt/trusted.gpg.d/*.gpg` keyring file. + For each subdomain (static site, dyndns, mail webmail-proxy, any Docker-backed app): create `/etc/apache2/sites-available/.conf` with a `:80` vhost, `a2ensite`, then let certbot handle TLS + the redirect: diff --git a/TODO.md b/TODO.md index face5eb..eeb6e03 100644 --- a/TODO.md +++ b/TODO.md @@ -672,8 +672,8 @@ Nothing here is urgent; all are low-risk, no-downtime changes. Root usage barely moved (already 10% with 136G free beforehand) - this was dead-weight removal, not a space-pressure fix. -- [ ] **Stale RSA-1024 signing-key warning from the `ondrej/php` PPA** — found 2026-07-26 - `apt update` on alpha prints: "Signature by key +- [x] **Stale RSA-1024 signing-key warning from the `ondrej/php` PPA** — found and fixed 2026-07-26 + `apt update` on alpha printed: "Signature by key 14AA40EC0831756756D7F66C4F4EA0AAE5267A6C uses weak algorithm (rsa1024)" for `ppa:ondrej/php`. Researched before acting rather than assuming the PPA itself is compromised or poorly run: this is @@ -684,14 +684,26 @@ Nothing here is urgent; all are low-risk, no-downtime changes. in noble) only just started warning about it everywhere. Launchpad finished re-signing every affected PPA with RSA-4096 by August 2024 (confirmed via Launchpad's own answers/support tracker); the - warning persists here only because apt's local keyring still has + warning persisted here only because apt's local keyring still had the *old* cached key. No evidence of any compromise or malware incident tied to this PPA. - **Fix, not yet applied**: remove and re-add the PPA - (`sudo add-apt-repository --remove ppa:ondrej/php && sudo - add-apt-repository ppa:ondrej/php`) to force-fetch the current - RSA-4096 key and clear the warning. Purely cosmetic/stale-cache, - not an active security exposure, so low priority - but worth doing - next time other apt maintenance is being done on alpha. Also - update `SETUP.md`'s `ondrej/php` note (currently just says "check - the `Suites:` line") to mention this exact warning and fix. + Fixed: `add-apt-repository --remove ppa:ondrej/php` didn't + actually touch anything - the existing source file was a leftover + non-standard name (`ondrej-ubuntu-php-focal.sources`, a naming + artifact from an earlier release-upgrade rename) that its removal + logic didn't match, and it added/removed an unrelated + launchpadcontent.net entry instead. Backed up the old + `.sources` file and the old key (`/etc/apt/trusted.gpg.d/ + ondrej_ubuntu_php.gpg`) to `/root/apt-backup-ondrej-php/`, + deleted both manually, then `add-apt-repository ppa:ondrej/php` + fresh - created a correctly-named `ondrej-ubuntu-php-noble.sources` + pointing at `https://ppa.launchpadcontent.net/ondrej/php/ubuntu/` + with the current key embedded inline via `Signed-By:` (modern + deb822 style, no more separate `trusted.gpg.d` keyring file at + all). Verified: `apt update` clean, no rsa1024 warning; same + package version still installed/candidate (no unwanted churn); + `dyndns.jayfield.org` still `401`s; `sanity-check.sh` full pass + (48/48) immediately after. Noted in passing: Ondřej's own PPA + description says this repo "is in process of being merged into + https://packages.sury.org/php/" - a future migration to watch for, + not an action item yet.