Google-chrome failed update due to "SIGNATURE: NOT OK"

kxra · September 7, 2023, 3:26am

Upstream ticket against rpm here:

rpm --import does not replace old keys with new keys

opened 11:25PM - 21 Jul 23 UTC

# Encountering the problem with Google Linux Signing keys When I try to insta…ll new Google Linux Signing keys in Fedora 37 (with the latest stable release of ``rpm``, namely 4.18.1), it fails. However, when I delete the old (pre-installed) keys, and try again, it works. Here is what I typed: ``` wget https://dl.google.com/linux/linux_signing_key.pub sudo rpm --import linux_signing_key.pub rpm -qi gpg-pubkey-d38b4796-* | gpg --show-keys --with-subkey-fingerprint rpm -qa gpg-pubkey* --qf '%{NAME}-%{VERSION}-%{RELEASE} %{PACKAGER}\n' | grep 'linux-packages-keymaster@google.com' | sed 's/ .*$//' | sudo xargs rpm -e sudo rpm --import linux_signing_key.pub rpm -qi gpg-pubkey-d38b4796-* | gpg --show-keys --with-subkey-fingerprint ``` Here is the output. Notice that the first attempt at importing the keys fails silently, whereas the second attempt (after deleting old keys) succeeds. ``` [user@disp8080 ~]$ wget https://dl.google.com/linux/linux_signing_key.pub --2023-07-21 23:26:12-- https://dl.google.com/linux/linux_signing_key.pub Resolving dl.google.com (dl.google.com)... 142.250.178.14, 2a00:1450:4009:81f::200e Connecting to dl.google.com (dl.google.com)|142.250.178.14|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 14605 (14K) [application/octet-stream] Saving to: ‘linux_signing_key.pub’ linux_signing_key.p 100%[===================>] 14.26K --.-KB/s in 0s 2023-07-21 23:26:14 (43.0 MB/s) - ‘linux_signing_key.pub’ saved [14605/14605] [user@disp8080 ~]$ sudo rpm --import linux_signing_key.pub [user@disp8080 ~]$ rpm -qi gpg-pubkey-d38b4796-* | gpg --show-keys --with-subkey-fingerprint gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created pub rsa4096 2016-04-12 [SC] EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796 uid Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com> sub rsa4096 2016-04-12 [S] [expired: 2019-04-12] 3B068FB4789ABE4AEFA3BB491397BC53640DB551 sub rsa4096 2017-01-24 [S] [expired: 2020-01-24] 3E50F6D3EC278FDEB655C8CA6494C6D6997C215E [user@disp8080 ~]$ rpm -qa gpg-pubkey* --qf '%{NAME}-%{VERSION}-%{RELEASE} %{PACKAGER}\n' | grep 'linux-packages-keymaster@google.com' | sed 's/ .*$//' | sudo xargs rpm -e [user@disp8080 ~]$ sudo rpm --import linux_signing_key.pub [user@disp8080 ~]$ rpm -qi gpg-pubkey-d38b4796-* | gpg --show-keys --with-subkey-fingerprint pub rsa4096 2016-04-12 [SC] EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796 uid Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com> sub rsa4096 2016-04-12 [S] [expired: 2019-04-12] 3B068FB4789ABE4AEFA3BB491397BC53640DB551 sub rsa4096 2017-01-24 [S] [expired: 2020-01-24] 3E50F6D3EC278FDEB655C8CA6494C6D6997C215E sub rsa4096 2019-07-22 [S] [expired: 2022-07-21] 2F528D36D67B69EDF998D85778BD65473CB3BD13 sub rsa4096 2021-10-26 [S] [expires: 2024-10-25] 8461EFA0E74ABAE010DE66994EB27DB2A3B88B8B sub rsa4096 2023-02-15 [S] [expires: 2026-02-14] A5F483CD733A4EBAEA378B2AE88979FB9B30ACF2 ``` # The root of the problem Google's Linux Signing keys have an unusual configuration: they retain the same master key, but replace the subkeys which do the actual signing. Since ``rpm`` identifies the whole collection of keys by the master key, the new key looks like the pre-existing key. So it ignores it. # Work around The work around -- as alluded to above -- is to delete the old keys before trying to import the new ones. This can be done with: ``` rpm -qa gpg-pubkey* --qf '%{NAME}-%{VERSION}-%{RELEASE} %{PACKAGER}\n' | grep 'linux-packages-keymaster@google.com' | sed 's/ .*$//' | sudo xargs rpm -e ``` # Discussion This bug is potentially quite serious. Millions of Linux users use Google Chrome, and right now, there is no way for them to install or upgrade it. They will just see that signature verification fails. Most people will give up, or worse, disable signature checks. Those that try to check the signature manually will be thwarted by the same bug again. This means there is a serious usability impact (not being able to install Google Chrome), as well as a serious security impact (not getting security updates, or installing unverified updates for Google Chrome). # Solution Please either fix ``rpm`` so that it correctly imports keys (e.g. by using a timestamp as the key version), or deprecate the use of subkeys.

marko23 · September 9, 2023, 5:55pm

You go to Google website, download .rpm package and install with su/sudo rpm -i google*.rpm that installs a specific repository and choose on the fly stable or other always updated using dnf … simple …

kxra · September 20, 2023, 1:27am

There are workarounds for mutable Fedora installs but that’s not useful for Silverblue users. Google will have use a standard configuration for their packaging while rpm addresses this edge case upstream.

mosesdenny · September 20, 2023, 7:00pm

I rolled up to silverblue 39 beta this morning and tried to use the built in chrome third party repo in software. Got the same error. Downloaded .rpm from google, rpm-ostree installed liberation-fonts, then rpm-ostree installed their .rpm and that landed it.
user@fedora ~/Downloads> ls
google-chrome-stable_current_x86_64.rpm
user@fedora ~/Downloads> sudo rpm-ostree install google-chrome-stable_current_x86_64.rpm…Writing OSTree commit… done
Staging deployment… done
Freed: 67.9 MB (pkgcache branches: 0)
Added:
google-chrome-stable-117.0.5938.88-1.x86_64

bobii · September 26, 2023, 3:13am

So, what exactly is the solution here ?
I’m using Fedora 38 (Workstation) and have been installing Chrome via the .rpm package on Google’s website.
Whenever there is an update on available via the “Software” app, I’m unable to proceed with any system or other updates as long as Chrome is in the way. (Getting the “signature not ok” error message).

computersavvy · September 26, 2023, 3:49am

Are you downloading the rpm then attempting to install it? Or are you installing from the google chrome repo with normal updates.

I have never had an issue with google chrome, but I have the google-chrome repo enabled which is available thru the ‘hamburger menu’ in the gnome software app. Chrome is automatically updated and properly signed when I update in that manner.

You can check if the google-chrome repo is enabled with dnf repolist

bobii · September 26, 2023, 4:24am

I’m downloading and installing Chrome via the .rpm package on Google Chrome’s website everytime a new version becomes available, as the one initially available on the Software app is out of date I believe.

I do have the google-chrome repo enabled as well via the hamburger menu. “dnf repolist” shows it as well.

computersavvy · September 26, 2023, 2:30pm

Not true.
The currently installed chrome on my system is

$ dnf list installed google-chrome-stable
Installed Packages
google-chrome-stable.x86_64                                      117.0.5938.92-1                                      @google-chrome

Trying to install something newer has the potential of installing an unstable version.

That was initially installed using sudo dnf install google-chrome-stable and then is automatically kept up to date with each system upgrade. Installing with rpm-ostree should do the same.

bobii · September 28, 2023, 2:36am

Ah yes you’re right. It does have the latest version on the Software app.

I see what happened. The reason I turned to installing Chrome from outside the Software app via downloading a .rpm package was because I get the “Unable to install “Google Chrome” as not supported” error message whenever I do try to install it through the Software app.

I have the Google Chrome repositories enabled in the hamburger menu.

What would be the reason for this error message ?

straycat · September 28, 2023, 1:45pm

I had the same issue and error trying to install Chrome from Gnome software in Fedora 39. I also downloaded Chrome from the website and it installed with no issues.

bobii · September 28, 2023, 2:58pm

But do you encounter the “signature not ok” error now whenever there are updates for Chrome via the software app ?

straycat · September 29, 2023, 1:08am

No in software it only showed it wasn’t supported.I’m guessing it was an issue that Gnome 45 was still in beta.I have not tried to remove Chrome and try and reinstall it with software now that Gnome 45 has been released.

computersavvy · September 29, 2023, 3:26pm

There seems to be an issue in the way the software manager (gnome software) handles keys.

I just installed google-chrome-stable on my F39 VM with dnf, and other than some messages about expired keys it was able to do the install.

$ sudo dnf install google-chrome-stable
Last metadata expiration check: 0:18:54 ago on Fri 29 Sep 2023 10:04:02 AM CDT.
Dependencies resolved.
====================================================================================================================================
 Package                              Architecture           Version                          Repository                       Size
====================================================================================================================================
Installing:
 google-chrome-stable                 x86_64                 117.0.5938.132-1                 google-chrome                   104 M
Installing dependencies:
 liberation-fonts                     noarch                 1:2.1.5-7.fc39                   updates-testing                 7.5 k

Transaction Summary
====================================================================================================================================
Install  2 Packages

Total download size: 104 M
Installed size: 324 M
Is this ok [y/N]: y
Downloading Packages:
(1/2): liberation-fonts-2.1.5-7.fc39.noarch.rpm                                                      72 kB/s | 7.5 kB     00:00    
(2/2): google-chrome-stable-117.0.5938.132-1.x86_64.rpm                                              49 MB/s | 104 MB     00:02    
------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                41 MB/s | 104 MB     00:02     
google-chrome                                                                                       969  B/s |  14 kB     00:15    
Importing GPG key 0xD38B4796:
 Userid     : "Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>"
 Fingerprint: EB4C 1BFD 4F04 2F6D DDCC EC91 7721 F63B D38B 4796
 From       : https://dl.google.com/linux/linux_signing_key.pub
Is this ok [y/N]: y
warning: Certificate 7721F63BD38B4796:
  Subkey 1397BC53640DB551 is expired: The subkey is not live
  Subkey 78BD65473CB3BD13 is expired: The subkey is not live
  Subkey 6494C6D6997C215E is expired: The subkey is not live
Key imported successfully
Importing GPG key 0x7FAC5991:
 Userid     : "Google, Inc. Linux Package Signing Key <linux-packages-keymaster@google.com>"
 Fingerprint: 4CCA 1EAF 950C EE4A B839 76DC A040 830F 7FAC 5991
 From       : https://dl.google.com/linux/linux_signing_key.pub
Is this ok [y/N]: y
warning: Certificate A040830F7FAC5991:
  Policy rejects subkey 4F30B6B4C07CB649: Policy rejected asymmetric algorithm
Key imported successfully
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                            1/1 
  Installing       : liberation-fonts-1:2.1.5-7.fc39.noarch                                                                     1/2 
  Running scriptlet: google-chrome-stable-117.0.5938.132-1.x86_64                                                               2/2 
  Installing       : google-chrome-stable-117.0.5938.132-1.x86_64                                                               2/2 
  Running scriptlet: google-chrome-stable-117.0.5938.132-1.x86_64                                                               2/2 
  Verifying        : liberation-fonts-1:2.1.5-7.fc39.noarch                                                                     1/2 
  Verifying        : google-chrome-stable-117.0.5938.132-1.x86_64                                                               2/2 

Installed:
  google-chrome-stable-117.0.5938.132-1.x86_64                        liberation-fonts-1:2.1.5-7.fc39.noarch                       

Complete!

marko23 · September 29, 2023, 7:15pm

Install : OK, fine but does it work, synchronizing same account on other devices, Google Workspace, Drive cloud ressources … otherwise you’re just lost in space …

eshfield · November 16, 2023, 8:15pm

Thanks a lot — that helped with Fedora 39 and Google Chrome update error

ds225 · March 2, 2024, 4:51am

Fixed it for me:

download latest rpm
sudo rpm -U google-chrome-stable_current_x86_64.rpm

anon91881872 · March 29, 2024, 7:42am

something interesting i found on online and it actually works so this is something to share on upstream and others to see/check and test since i found that there is difrent URL and GPG key paths on Fedora repo file than what i found online and editing the google-chrome.repo on details down i can layer google chrome and dont get any gpg signature errors and this is tested on F39 silverblue and F40 beta silverblue

[google-chrome]
name=google-chrome
baseurl=http://dl.google.com/linux/chrome/rpm/stable/$basearch
enabled=1
gpgcheck=1
gpgkey=https://dl-ssl.google.com/linux/linux_signing_key.pub

there is also at first installation i edit the repo file and take gpg check 0 install chrome and then put gpg check back to 1 and again all works so i guess using default repo files are still valid, but on first install gpg check need to be off and after that seems fine again to use

richardfinicky · April 4, 2024, 5:20am

Using kinoite 39, setting gpgcheck=0 made it possible to install chrome but after restoring it to 1, upgrades fail with a signature error.

Topic		Replies	Views
Chrome GPG key failure on silverblue status updates? Ask Fedora silverblue	1	317	May 29, 2024
Setup gives an error message and wont install Ask Fedora workstation	1	177	August 9, 2024
Can't install Google Chrome from GNOME Software: package cannot be verified and repo google-chrome is GPG enabled Ask Fedora google-chrome , chrome , h264 , gnome	3	11855	April 27, 2024
Google-chrome-stable gpg key error Ask Fedora google-chrome , dnf	5	17661	March 7, 2024
Problem with Fedora updates Ask Fedora gnome , f39	7	1167	January 24, 2024

Google-chrome failed update due to "SIGNATURE: NOT OK"

Related topics