Google-chrome failed update due to "SIGNATURE: NOT OK"

kxra · September 7, 2023, 3:26am

Upstream ticket against rpm here:

rpm --import does not replace old keys with new keys

opened 11:25PM - 21 Jul 23 UTC

# Encountering the problem with Google Linux Signing keys When I try to insta…ll new Google Linux Signing keys in Fedora 37 (with the latest stable release of ``rpm``, namely 4.18.1), it fails. However, when I delete the old (pre-installed) keys, and try again, it works. Here is what I typed: ``` wget https://dl.google.com/linux/linux_signing_key.pub sudo rpm --import linux_signing_key.pub rpm -qi gpg-pubkey-d38b4796-* | gpg --show-keys --with-subkey-fingerprint rpm -qa gpg-pubkey* --qf '%{NAME}-%{VERSION}-%{RELEASE} %{PACKAGER}\n' | grep 'linux-packages-keymaster@google.com' | sed 's/ .*$//' | sudo xargs rpm -e sudo rpm --import linux_signing_key.pub rpm -qi gpg-pubkey-d38b4796-* | gpg --show-keys --with-subkey-fingerprint ``` Here is the output. Notice that the first attempt at importing the keys fails silently, whereas the second attempt (after deleting old keys) succeeds. ``` [user@disp8080 ~]$ wget https://dl.google.com/linux/linux_signing_key.pub --2023-07-21 23:26:12-- https://dl.google.com/linux/linux_signing_key.pub Resolving dl.google.com (dl.google.com)... 142.250.178.14, 2a00:1450:4009:81f::200e Connecting to dl.google.com (dl.google.com)|142.250.178.14|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 14605 (14K) [application/octet-stream] Saving to: ‘linux_signing_key.pub’ linux_signing_key.p 100%[===================>] 14.26K --.-KB/s in 0s 2023-07-21 23:26:14 (43.0 MB/s) - ‘linux_signing_key.pub’ saved [14605/14605] [user@disp8080 ~]$ sudo rpm --import linux_signing_key.pub [user@disp8080 ~]$ rpm -qi gpg-pubkey-d38b4796-* | gpg --show-keys --with-subkey-fingerprint gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created pub rsa4096 2016-04-12 [SC] EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796 uid Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com> sub rsa4096 2016-04-12 [S] [expired: 2019-04-12] 3B068FB4789ABE4AEFA3BB491397BC53640DB551 sub rsa4096 2017-01-24 [S] [expired: 2020-01-24] 3E50F6D3EC278FDEB655C8CA6494C6D6997C215E [user@disp8080 ~]$ rpm -qa gpg-pubkey* --qf '%{NAME}-%{VERSION}-%{RELEASE} %{PACKAGER}\n' | grep 'linux-packages-keymaster@google.com' | sed 's/ .*$//' | sudo xargs rpm -e [user@disp8080 ~]$ sudo rpm --import linux_signing_key.pub [user@disp8080 ~]$ rpm -qi gpg-pubkey-d38b4796-* | gpg --show-keys --with-subkey-fingerprint pub rsa4096 2016-04-12 [SC] EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796 uid Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com> sub rsa4096 2016-04-12 [S] [expired: 2019-04-12] 3B068FB4789ABE4AEFA3BB491397BC53640DB551 sub rsa4096 2017-01-24 [S] [expired: 2020-01-24] 3E50F6D3EC278FDEB655C8CA6494C6D6997C215E sub rsa4096 2019-07-22 [S] [expired: 2022-07-21] 2F528D36D67B69EDF998D85778BD65473CB3BD13 sub rsa4096 2021-10-26 [S] [expires: 2024-10-25] 8461EFA0E74ABAE010DE66994EB27DB2A3B88B8B sub rsa4096 2023-02-15 [S] [expires: 2026-02-14] A5F483CD733A4EBAEA378B2AE88979FB9B30ACF2 ``` # The root of the problem Google's Linux Signing keys have an unusual configuration: they retain the same master key, but replace the subkeys which do the actual signing. Since ``rpm`` identifies the whole collection of keys by the master key, the new key looks like the pre-existing key. So it ignores it. # Work around The work around -- as alluded to above -- is to delete the old keys before trying to import the new ones. This can be done with: ``` rpm -qa gpg-pubkey* --qf '%{NAME}-%{VERSION}-%{RELEASE} %{PACKAGER}\n' | grep 'linux-packages-keymaster@google.com' | sed 's/ .*$//' | sudo xargs rpm -e ``` # Discussion This bug is potentially quite serious. Millions of Linux users use Google Chrome, and right now, there is no way for them to install or upgrade it. They will just see that signature verification fails. Most people will give up, or worse, disable signature checks. Those that try to check the signature manually will be thwarted by the same bug again. This means there is a serious usability impact (not being able to install Google Chrome), as well as a serious security impact (not getting security updates, or installing unverified updates for Google Chrome). # Solution Please either fix ``rpm`` so that it correctly imports keys (e.g. by using a timestamp as the key version), or deprecate the use of subkeys.

marko23 · September 9, 2023, 5:55pm

You go to Google website, download .rpm package and install with su/sudo rpm -i google*.rpm that installs a specific repository and choose on the fly stable or other always updated using dnf … simple …

kxra · September 20, 2023, 1:27am

There are workarounds for mutable Fedora installs but that’s not useful for Silverblue users. Google will have use a standard configuration for their packaging while rpm addresses this edge case upstream.

mosesdenny · September 20, 2023, 7:00pm

I rolled up to silverblue 39 beta this morning and tried to use the built in chrome third party repo in software. Got the same error. Downloaded .rpm from google, rpm-ostree installed liberation-fonts, then rpm-ostree installed their .rpm and that landed it.
user@fedora ~/Downloads> ls
google-chrome-stable_current_x86_64.rpm
user@fedora ~/Downloads> sudo rpm-ostree install google-chrome-stable_current_x86_64.rpm…Writing OSTree commit… done
Staging deployment… done
Freed: 67.9 MB (pkgcache branches: 0)
Added:
google-chrome-stable-117.0.5938.88-1.x86_64

bobii · September 26, 2023, 3:13am

So, what exactly is the solution here ?
I’m using Fedora 38 (Workstation) and have been installing Chrome via the .rpm package on Google’s website.
Whenever there is an update on available via the “Software” app, I’m unable to proceed with any system or other updates as long as Chrome is in the way. (Getting the “signature not ok” error message).

computersavvy · September 26, 2023, 3:49am

Are you downloading the rpm then attempting to install it? Or are you installing from the google chrome repo with normal updates.

I have never had an issue with google chrome, but I have the google-chrome repo enabled which is available thru the ‘hamburger menu’ in the gnome software app. Chrome is automatically updated and properly signed when I update in that manner.

You can check if the google-chrome repo is enabled with dnf repolist

bobii · September 26, 2023, 4:24am

I’m downloading and installing Chrome via the .rpm package on Google Chrome’s website everytime a new version becomes available, as the one initially available on the Software app is out of date I believe.

I do have the google-chrome repo enabled as well via the hamburger menu. “dnf repolist” shows it as well.

computersavvy · September 26, 2023, 2:30pm

Not true.
The currently installed chrome on my system is

$ dnf list installed google-chrome-stable
Installed Packages
google-chrome-stable.x86_64                                      117.0.5938.92-1                                      @google-chrome

Trying to install something newer has the potential of installing an unstable version.

That was initially installed using sudo dnf install google-chrome-stable and then is automatically kept up to date with each system upgrade. Installing with rpm-ostree should do the same.

marko23 · September 27, 2023, 6:55am

Fedora Silverblue is a specific immutable containerized environment. Google Chrome on Linux is also a containerized environment for security reasons giving access to Google Workspace Entreprise Premium similar to Microsoft Edge access to Azure Graph, Office 365 online and full load of Azure services. Red Hat/IBM has IBM Cloud that is a nice platform for RHEL who prefers Firefox. Containers in containers from different platforms forcibly bring authentification issues, Red Hat can have an offer comparable to Microsoft Windows Enterprise, Google Chrome Enterprise Upgrade along with JBoss …

bobii · September 28, 2023, 2:36am

Ah yes you’re right. It does have the latest version on the Software app.

I see what happened. The reason I turned to installing Chrome from outside the Software app via downloading a .rpm package was because I get the “Unable to install “Google Chrome” as not supported” error message whenever I do try to install it through the Software app.

I have the Google Chrome repositories enabled in the hamburger menu.

What would be the reason for this error message ?