GPG Key should be stored in extra keyring

[xendon]

Operating System

Ubuntu 22.xx

My Question or Issue

Hi, the instructions to install the spotify client via APT are outdated.
Nowadays the GPG Key should be stored in a extra keyring.

curl -sS https://download.spotify.com/debian/pubkey_5E3C45D7B312C643.gpg | sudo apt-key add - 
echo "deb http://repository.spotify.com stable non-free" | sudo tee /etc/apt/sources.list.d/spotify.list

should be

curl -fsSL https://download.spotify.com/debian/pubkey_7A3A762FAFD4A51F.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/spotify.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/spotify.gpg] http://repository.spotify.com stable non-free" | sudo tee /etc/apt/sources.list.d/spotify.list

if not ... Ubuntu (apt) will throw an deprecation warning.

UPDATED: The instruction take care about the new signing key now.

[jooon]

The download page now uses the gpg command directly instead of apt-key. https://www.spotify.com/download/linux/

Using signed-by is also a very good idea. A ticket has been added internally to fix this. There is unfortunately some more work internally to be done before we can use that solution.

[IBreakCellPhones]

I'm having issues getting updates lately:

$ sudo apt update
[...]
Get:16 http://repository.spotify.com stable InRelease [3,316 B]
Err:16 http://repository.spotify.com stable InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7A3A762FAFD4A51F
Fetched 4,873 B in 3s (1,415 B/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://repository.spotify.com stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7A3A762FAFD4A51F
W: Failed to fetch http://repository.spotify.com/dists/stable/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7A3A762FAFD4A51F
W: Some index files failed to download. They have been ignored, or old ones used instead.
$ cat /etc/apt/sources.list.d/spotify.list
deb [signed-by=/etc/apt/trusted.gpg.d/spotify.gpg] http://repository.spotify.com stable non-free
$ gpg --show-keys /etc/apt/trusted.gpg.d/spotify.gpg
pub   rsa4096 2021-10-27 [SC] [expires: 2023-01-20]
      F9A211976ED662F00E59361E5E3C45D7B312C643
uid                      Spotify Public Repository Signing Key <**bleep**>

$

Do I need to grab a new public key? I believe this is the right one based on the current instructions. 

[dorothyMolloy]

This seems to be a recurring problem.  Try looking at the Spotify download instructions here: https://www.spotify.com/uk/download/linux/

This fixed my problem

[IBreakCellPhones]

That refers to 

pubkey_7A3A762FAFD4A51F.gpg

which: 

1. Expires today
2. Is the key that I'm using--see the NO_PUBKEY issues above.

[Alternize]

key is now expired and causes apt to fail

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://repository.spotify.com testing InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7A3A762FAFD4A51F
W: Failed to fetch http://repository.spotify.com/dists/testing/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7A3A762FAFD4A51F
W: Some index files failed to download. They have been ignored, or old ones used instead.

[giparra]

Hello everybody,

You have to use the new GPG cert: 

https://download.spotify.com/debian/pubkey_7A3A762FAFD4A51F.gpg

It will expire 2024-02-07

Best regards,

Giorgiogiulio

[IBreakCellPhones]

Looks like it's working now! 

[xendon]

Hi @all I've upgraded the instructions 🙂

[IBreakCellPhones]

Looks like the second line of the instructions to install the key needs to change from: 

echo "deb http://repository.spotify.com stable non-free" | sudo tee /etc/apt/sources.list.d/spotify.list

to

echo "deb [signed-by=/etc/apt/trusted.gpg.d/spotify.gpg] http://repository.spotify.com stable non-free" | sudo tee /etc/apt/sources.list.d/spotify.list

This will tell apt to use the downloaded key to check the signature.

[charlesmelara]

Hi, I'm using extrepo to manage extra repositories and they rely on the gpg key available in public server (such as pgp.surf.nl). Currently the availabe key is the expired one.

Could you please push the renewed key to public pgp servers?

Thanks.