#3644 Issue closed: OBS signing key has expired again

Labels: support / question, ReaR Project

dhoffend opened issue at 2026-10-01 09:35:

ReaR version

Relax-and-Recover 2.9 / 2025-01-31

Describe the ReaR bug in detail

This is a followup/recurring issue on the same topic. The signing keys have expired (which is okay), but not replaced in time/advance.

$ curl -s http://download.opensuse.org/repositories/Archiving:/Backup:/Rear/Debian_12/Release.key | gpg | grep ^pub
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2020-01-17 [SC] [expired: 2026-09-30]

Please rotate your signing keys

History:

  • #1255
  • #2309
  • #3289
  • #3235

Platform

No response

OS version

PRETTY_NAME="Debian GNU/Linux 13 (trixie)"

Backup

No response

Storage layout

No response

What steps will reproduce the bug?

No response

Workaround, if any

No response

Additional information

No response

dhoffend commented at 2026-10-06 14:59:

@jsmeix Would you be so kind and take a look at this? You help us the last time,

jsmeix commented at 2026-10-08 08:55:

As time permits...

Since a longer time there are way too many issues
elsewhere (not in ReaR) where each one must be fixed
regardless if it is a CVE or a bug or plain nonsense
which suppress anything else ad infinitum and ad nauseam...
(you may search for "ad infinitum and ad nauseam" in
https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings )

gdha commented at 2026-10-13 13:42:

@jsmeix @dhoffend Renewed it:

# Inspect the current key
osc signkey Archiving:Backup:Rear

# Extend its expiration date (same key and fingerprint, new expiry)
osc signkey --extend Archiving:Backup:Rear

$ osc api /source/Archiving:Backup:Rear/_pubkey | gpg --show-keys
pub   rsa4096 2026-10-13 [SC] [expires: 2028-12-21]
      AFAB679489120B741A1DE72DA35FC8E0CA080173
uid                      Archiving:Backup:Rear OBS Project <Archiving:Backup:Rear@build.opensuse.org>

# To force a publish, trigger any event that causes one:
$ osc rebuild Archiving:Backup:Rear -r Debian_12
ok

jsmeix commented at 2026-10-14 11:59:

FWIW - perhaps it could be related:
You may have a look at the
"expired tumbleweed signing key, error for branding-openSUSE package"
mail thread on the openSUSE Factory mailing list at
https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/XRXHAS2MTHJYOEXZ6ZGZQY6H43EAZMB6/
therein in particular this message
https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/message/TOVTKZLFJRRUL4ULNYG7BDGQPBFSKTMI/
which is about issues when a key is extended on the server
but on the local system that may not be automatically handled appropriately.

dhoffend commented at 2026-10-19 12:36:

@gdha Thank you very much. Would you be so kind and trigger the rebuild also for some other distributions? Like CentOS_8? I guess that other distributions/build targets are affected as well.

gdha commented at 2026-10-19 12:42:

@dhoffend I re-triggered all builds.

Thank you very much. Would you be so kind and trigger the rebuild also for some other distributions? Like CentOS_8? I guess that other distributions/build targets are affected as well.

[Export of Github issue for rear/rear.]