Installation via apt issue: public key not available

[teknari]

Description

I am trying to install CouchDB via APT on a new hosted Debian 10 installation.

When I run sudo apt update, I get the following error:

$ sudo apt update
Hit:1 http://mirrors.linode.com/debian buster InRelease
Hit:2 http://mirrors.linode.com/debian-security buster/updates InRelease
Hit:3 http://mirrors.linode.com/debian buster-updates InRelease
Get:4 https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease [5,151 B]
Err:4 https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0EE62FB37A00258D
Reading package lists... Done
W: GPG error: https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0EE62FB37A00258D
E: The repository 'https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Steps to Reproduce

I run the following commands as shown on the CouchDB Installation page .

sudo apt update && sudo apt install -y curl apt-transport-https gnupg

curl https://couchdb.apache.org/repo/keys.asc | gpg --dearmor | sudo tee /usr/share/keyrings/couchdb-archive-keyring.gpg >/dev/null 2>&1

source /etc/os-release

echo "deb [signed-by=/usr/share/keyrings/couchdb-archive-keyring.gpg] https://apache.jfrog.io/artifactory/couchdb-deb/ ${VERSION_CODENAME} main" \ | sudo tee /etc/apt/sources.list.d/couchdb.list >/dev/null

Expected Behaviour

I expect sudo apt update to work.

Your Environment

I am running Debian 10 on a fresh install

[wohali]

Please try re-running curl https://couchdb.apache.org/repo/keys.asc | gpg --dearmor | sudo tee /usr/share/keyrings/couchdb-archive-keyring.gpg (without the >/dev/null 2>&1) and look for any error.

After that, try again a apt update.

[teknari]

I ran it without the >/dev/null 2>&1

It ran apparently without errors. I got this first:

curl https://couchdb.apache.org/repo/keys.asc | gpg --dearmor | sudo tee /usr/share/keyrings/couchdb-archive-keyring.gpg
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:100 3882 100 3882 0 0 73245 0 --:--:-- --:--:-- --:--:-- 73245

Then a bunch of binary gibberish with this in the middle of it:

The Apache Software Foundation (Package repository signing key) root@apache.org

No apparent error, but when I run sudo apt update I get the same:

sudo apt update
Hit:1 http://mirrors.linode.com/debian buster InRelease
Hit:2 http://mirrors.linode.com/debian-security buster/updates InRelease
Hit:3 http://mirrors.linode.com/debian buster-updates InRelease
Get:4 https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease [5,151 B]
Err:4 https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0EE62FB37A00258D
Reading package lists... Done
W: GPG error: https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0EE62FB37A00258D
E: The repository 'https://apache.jfrog.io/artifactory/couchdb-deb buster InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

If I go and take a look in the keyring folder, it looks like it is in there:

teknari@tekdallas:~$ cd /usr/share/keyrings/
teknari@tekdallas:/usr/share/keyrings$ ls
couchdb-archive-keyring.gpg
debian-archive-bullseye-automatic.gpg
debian-archive-bullseye-security-automatic.gpg
debian-archive-bullseye-stable.gpg
debian-archive-buster-automatic.gpg
debian-archive-buster-security-automatic.gpg
debian-archive-buster-stable.gpg
debian-archive-keyring.gpg
debian-archive-removed-keys.gpg
debian-archive-stretch-automatic.gpg
debian-archive-stretch-security-automatic.gpg
debian-archive-stretch-stable.gpg

And when I take a look in the sources.list.d

teknari@tekdallas:/etc/apt/sources.list.d$ ls
couchdb.list
teknari@tekdallas:/etc/apt/sources.list.d$ sudo cat couchdb.list
deb [signed-by=/usr/share/keyrings/couchdb-archive-keyring.gpg] https://apache.jfrog.io/artifactory/couchdb-deb/ buster main
teknari@tekdallas:/etc/apt/sources.list.d$

[wohali]

I just took a brand new Debian Buster install and can confirm the instructions work, from scratch. There must be something wrong with your install.

Converting to a peer-support topic as the installation system does seem to work correctly.

[teknari]

I got it working. Deleted /etc/apt/sources.list.d and /usr/share/keyrings/couchdb-archive-keyring.gpg, then ran again.

Thanks for your help @wohali !

[erelson]

I ran into this issue on a Ubuntu Server 22.04 install just now (upgraded from a base 20.04 install, I believe). Ended up using wget instead of curl, and piping to the same gpg command, but followed by sudo apt-key add, and it worked. Got deprecation warnings about apt-key when doing this, so that's not a ringing endorsement...

[wohali]

The current install instructions no longer use wget and do not use apt-key add.

https://docs.couchdb.org/en/3.2.2-docs/install/unix.html#installation-using-the-apache-couchdb-convenience-binary-packages