"GPG error:
http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
InRelease: The following signatures couldn't be verified because the
public key is not available: NO_PUBKEY 8771ADB0816950D8 The repository
'http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
InRelease' is not signed."

How to fix this? I've run into this problem with a number of other
PPAs as well and have never found a working solution (but a lot of the
usual "try this, try that" non-advice).
And why don't maintainers fix it?

Yrrah

Yrrah wrote:
> "GPG error:
> http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
> InRelease: The following signatures couldn't be verified because the
> public key is not available: NO_PUBKEY 8771ADB0816950D8 The repository
> 'http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
> InRelease' is not signed."
>
> How to fix this? I've run into this problem with a number of other
> PPAs as well and have never found a working solution (but a lot of the
> usual "try this, try that" non-advice).
> And why don't maintainers fix it?
>
> Yrrah

It might be a local issue on your setup.

https://askubuntu.com/questions/741742/how-can-i-get-rid-of-these-no-pubkey-errors

"apt can only handle 40 keys in /etc/apt/trusted.gpg.d .

41 keys and you will get the GPG error "no public key found"
even if you go through all the steps to add the missing key(s).

Check to see if there are any unused keys in this file from
ppa(s) you no longer use. If all are in use, consider removing
some ppa(s) along with the corresponding keyfiles in
/etc/apt/trusted.gpg.d
"

"So I went to /etc/apt/trusted.gpg.d and deleted 2 GPG keys (now
with 39 left in /etc/apt/trusted.gpg.d). sudo apt-get update
worked OK and now I can upgrade any package.
"

Paul

Yrrah wrote:
> "GPG error:
> http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
> InRelease: The following signatures couldn't be verified because the
> public key is not available: NO_PUBKEY 8771ADB0816950D8 The repository
> 'http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
> InRelease' is not signed."

I don't know the answer. John Stebbins has 3 pub keys of different ages
on the Ub keyserver for his handbrake email, but the iIDs are different
from that above. I have my default keyserver as the pool.sks, but it
doesn't have that key or the Stebbins email of the Ub keys either.

--
Mike Easter

Yrrah wrote:
> "GPG error:
> http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
> InRelease: The following signatures couldn't be verified because the
> public key is not available: NO_PUBKEY 8771ADB0816950D8 The repository
> 'http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
> InRelease' is not signed."
>
> How to fix this? I've run into this problem with a number of other
> PPAs as well and have never found a working solution (but a lot of the
> usual "try this, try that" non-advice).
> And why don't maintainers fix it?
>
> Yrrah
>
ppa:stebbins/handbrake-releases
https://launchpad.net/~stebbins/+archive/ubuntu/handbrake-releases

handbrake 1.3.3 (2020-06-15)

Technical details about this PPA
Signing key:
1024R/43D3A9F60C58A7169778E6FB8771ADB0816950D8 <link>

HandBrake Downloads
https://handbrake.fr/downloads.php
Linux
Flatpak

Old Releases
https://handbrake.fr/old.php
"Some older Ubuntu builds are available on: Ubuntu PPA"

Yrrah wrote:
> How to fix this?

Here's the key:

https://keyserver.ubuntu.com/pks/lookup?fingerprint=on&op=index&search=0x43D3A9F60C58A7169778E6FB8771ADB0816950D8

Accessed from this launchpad page:

https://launchpad.net/~stebbins/+archive/ubuntu/handbrake-releases

(open Technical details about this PPA)
>
> Signing key:
> 1024R/43D3A9F60C58A7169778E6FB8771ADB0816950D8 (What is this?)
> Fingerprint:
> 43D3A9F60C58A7169778E6FB8771ADB0816950D8

--
Mike Easter

> "GPG error:
> http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
> InRelease: The following signatures couldn't be verified because the
> public key is not available: NO_PUBKEY 8771ADB0816950D8 The repository
> 'http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
> InRelease' is not signed."
>
> How to fix this? I've run into this problem with a number of other
> PPAs as well and have never found a working solution (but a lot of the
> usual "try this, try that" non-advice).
> And why don't maintainers fix it?

Thanks for the replies.
I've given up. Nothing works.

Yrrah

Yrrah wrote:
> Thanks for the replies.
> I've given up. Nothing works.

For reasons too long to mention here, I normally do this stuff w/
Kleopatra in Win using gpg4win, but here I'm in Mint Cinn w/ an empty
Seahorse and keyring. So I used the command line; my gpg doesn't have a
keypair for me to certify w/.

I accessed the pub key mentioned earlier; I had dl/ed it as Stebbins.asc

gpg --import Stebbins.asc

(I didn't actually type all that; I opened a terminal in the dir and
used tab-complete)

At
http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu/dists/focal/
I dl/ed Release & Release.gpg and opened that dir w/ a terminal.

$ gpg --verify Release.gpg Release
gpg: Signature made Mon Jun 15 09:35:54 2020 PDT
gpg: using RSA key 8771ADB0816950D8
gpg: Good signature from "Launchpad HandBrake Snapshots" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
owner.
Primary key fingerprint: 43D3 A9F6 0C58 A716 9778 E6FB 8771 ADB0 8169 50D8

If you wanted a proper verify, you would have made yourself a key pair
and certified the pub Stebbins key.

One of my gripes about the typical process for authenticating sigs and
such is that we don't actually use the prescribed pgp (and thus gpg)
strategies for web of trust in our certification

--
Mike Easter

Mike Easter wrote:
> I normally do this stuff w/ Kleopatra in Win using gpg4win,

In Kleo, everything is graphical. I dl the Stebbins pub key and certify
it w/ my private key, then the Release and Release.gpg files, then I
open the Release.gpg file in Kleo and it automagically compares it to
the Release file in the same dir because of the name. Then it reports
graphically that the sig is valid and the cert is trusted.

My biggest problem in this issue has been figuring out how to navigate
to the Release and Release.gpg files from the Handbrake at launchpad.

--
Mike Easter

Mike Easter wrote:
> My biggest problem in this issue has been figuring out how to navigate
> to the Release and Release.gpg files from the Handbrake at launchpad.

Here's how; same technical details route:

https://launchpad.net/~stebbins/+archive/ubuntu/handbrake-releases

<technical details>
deb http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu

Then navigate the dir structure to get to the focal release &
release.gpg files.

--
Mike Easter

Mike Easter wrote:
> I normally do this stuff w/ Kleopatra in Win using gpg4win,

One of the reasons I use Kleo in Win is because I couldn't figure out
how to add keyservers to seahorse and it also wasn't clear how to use it
to verify a sig. Since I was using the old Win7's hardware to dl linux
..iso/s, check the hash and write them to USB, I just added the
authentication function there rather than do it in linux. Most sites
provide command line instructions for doing that in linux, so I didn't
bother establishing a good graphical method for linux for that.

There is also a Kleo in the Mint repo/s; I don't know if it is exactly
the same as the Win one; I've run into differences between the Win XAMPP
and the Linux one.

--
Mike Easter

Mike Easter wrote:
> There is also a Kleo in the Mint repo/s

The problem w/ using Kleopatra is all of the KDE stuff/baggage it has to
bring along.

I was looking for an alternative that gave me some latitude about
keyservers and authentication like Kleo does w/o all that KDE/Qt stuff.

I recalled that I had liked the power of Enigmail in the past. The
problem w/ Enigmail is that the current v/s of Tb don't use the previous
enigmail in favor of their 'own' implementation of supporting OpenPgp in
Tb similar to Enigmail, but the original email doesn't work after Tb v. 68.

So, I booted Mint Cinnamon 20.1 instead of 20.2 which still has the
older v. and added Enigmail. Its configuration has an Advanced button
which enabled me to add the keyserver.ubuntu.com to the other 3 which
were there by default.

Then I went to the HandBrake .ppa site and added that repo. I'll switch
over to the Tb on that system to finish so I can C&P.

--
Mike Easter

Mike Easter wrote:
> I'll switch over to the Tb on that system to finish so I can C&P.

When I added the .ppa repo, this was part of the report:

Executing: /tmp/apt-key-gpghome.SI4bSKknCk/gpg.1.sh --keyserver
hkps://keyserver.ubuntu.com:443 --recv-keys
43D3A9F60C58A7169778E6FB8771ADB0816950D8
gpg: key 8771ADB0816950D8: public key "Launchpad HandBrake Snapshots"
imported
gpg: Total number processed: 1
gpg: imported: 1

So, the reason for the original problem post was because the keyserver
which holds the public key for the .ppa repo wasn't in the default
keyservers.

What the maintainer should do to remedy this is to make sure that his
public key is posted in the most common default keyservers which is
probably hkps://hkps.pool.sks-keyservers.net

What the user can do to mitigate the problem which the maintainer has
created for him is to use a system which can enable him to overcome the
problem, either by using the command line w/ gpg as indicated earlier,
or if not the command line, a 'robust' certificate manager which enables
him to add alternate keyservers, which Sthe default eahorse is deficient.

--
Mike Easter

Andrei Z. wrote:
> Yrrah wrote:
>> "GPG error:
>> http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
>> InRelease: The following signatures couldn't be verified because the
>> public key is not available: NO_PUBKEY 8771ADB0816950D8 The repository
>> 'http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
>> InRelease' is not signed."
>>
>> How to fix this? I've run into this problem with a number of other
>> PPAs as well and have never found a working solution (but a lot of the
>> usual "try this, try that" non-advice).
>> And why don't maintainers fix it?
>>
>> Yrrah
>>
> ppa:stebbins/handbrake-releases
> https://launchpad.net/~stebbins/+archive/ubuntu/handbrake-releases
>
> handbrake 1.3.3 (2020-06-15)
>
> Technical details about this PPA
> Signing key:
> 1024R/43D3A9F60C58A7169778E6FB8771ADB0816950D8 <link>
>
> HandBrake Downloads
> https://handbrake.fr/downloads.php
> Linux
> Flatpak
>
> Old Releases
> https://handbrake.fr/old.php
> "Some older Ubuntu builds are available on: Ubuntu PPA"

handbrake 1.3.1 is in Ubuntu Repository.
PPA in its current state is not needed.

Ubuntu – Details of package handbrake in focal
https://packages.ubuntu.com/en/focal/handbrake

Ubuntu – Details of package handbrake-cli in focal
https://packages.ubuntu.com/en/focal/handbrake-cli

$ apt show handbrake

Mike Easter wrote:
> So, the reason for the original problem post was because the keyserver
> which holds the public key for the .ppa repo wasn't in the default
> keyservers.
>
> What the maintainer should do to remedy this is to make sure that his
> public key is posted in the most common default keyservers which is
> probably hkps://hkps.pool.sks-keyservers.net

Optimally, the keyservers are supposed to auto-synchronize w/ each
other. There have been keyserver problems in the past, and the webserver
function of the sks name is deprecated. There is a complex article
discussing the ubuntu and sks pool.

https://ubuntu.com/blog/migrating-the-launchpad-keyservers-from-sks-to-hockeypuck
Migrating the Launchpad Keyservers from SKS to Hockeypuck

https://sks-keyservers.net/ This service is deprecated. This means it
is no longer maintained,

https://keyserver.ubuntu.com/ Hockeypuck OpenPGP keyserver

--
Mike Easter

Mike Easter wrote:
> the reason for the original problem post was because the keyserver
> which holds the public key for the .ppa repo wasn't in the default
> keyservers.

I've been trying to figure out how to remedy this 'generically'. The
graphical solutions have shortcomings; kleopatra is a qt/kde built app,
seahorse is b0rken in terms of keyserver configuration functionality,
the good 'old' enigmail is deprecated in the current Tb in favor of a
much weaker/inadequate openpgp functionality of Tb. In the past, I've
worked out my problems manually using such tools as pgpdump and gpg
commands when I wasn't using the Win graphical kleopatra/ gpg4win.

I haven't fully explored what I can do w/ configuring gnupg w/ a text
..conf file. The default doesn't have a .conf file. The docs which are
found in usr/share which includes an examples dir indicates that you can
provide keyserver lines in a .conf file which you construct from
scratch. It doesn't actually provide a good example gpg.conf which
seems silly.

Once again, the arch wiki has some useful gnupg info, even more so than
the gnupg.org pages.

--
Mike Easter

Mike Easter wrote:
> It doesn't actually provide a good example gpg.conf which seems silly.

Here's an example gpg.conf and a link to helpful info which aided in its
config.

https://gist.github.com/graffen/37eaa2332ee7e584bfda my gpg.conf

https://help.riseup.net/en/security/message-security/openpgp/best-practices
OpenPGP Best Practices

--
Mike Easter

Mike Easter <MikeE@ster.invalid>:
> Mike Easter wrote:
> > It doesn't actually provide a good example gpg.conf which seems silly.
>
> Here's an example gpg.conf and a link to helpful info which aided in its
> config.
>
> https://gist.github.com/graffen/37eaa2332ee7e584bfda my gpg.conf
>
> https://help.riseup.net/en/security/message-security/openpgp/best-practices
> OpenPGP Best Practices

Mike, I appreciate your efforts, but this stuff is too technical for
me. I am only a simple LM user, who had hoped to install a more recent
Handbrake version than the one in the official repos. Currently the
PPA has 1.3.3, the official repo 1.3.1. Handbrake was updated to v.
1.4.0 three days ago. I'll have to settle for what I had installed
already (v. 1.3.1).

BTW, I had the same problem with the Libre Office PPA a while ago
(but haven't looked at it recently). I don't understand why PPA
maintainers don't fix it.

Yrrah

Yrrah wrote:
> I don't understand why PPA
> maintainers don't fix it.

Similarly, many dev/s of linux .iso/s don't make it 'straightforward' to
authenticate. They most typically make the .iso available incl by
torrent and don't make the hash 'difficult' to find, but most often the
..sig for the .iso or a txt file of the hash isn't as apparent ie
findable and the business of where the appropriate public key might be
is left to the imagination of the dl/er. The most common mitigation is
found in a set of command lines provided by some distro/s, but not all.

Part of the problem apparently has been keyserver issues, either w/
difficulties of their load management or nefarious poison keys as
described in the hockeypuck vs sks article..

I don't have an explanation for why the/your popular Seahorse is b0rken
in terms of adding keyservers. In a perfect world, there would just be
a/one 'standard' keyserver which was baked into the default certificate
manager.

Like many other security related issues, there is underlying complexity.
Whenever there is complexity around, sometimes that impacts the
simplicity of the user interface.

--
Mike Easter

On Wed, 21 Jul 2021 14:09:56 +0200, Yrrah wrote:

> Mike Easter <MikeE@ster.invalid>:
>
>> Mike Easter wrote:
>> > It doesn't actually provide a good example gpg.conf which seems
>> > silly.
>>
>> Here's an example gpg.conf and a link to helpful info which aided in
>> its config.
>>
>> https://gist.github.com/graffen/37eaa2332ee7e584bfda my gpg.conf
>>
>> https://help.riseup.net/en/security/message-security/openpgp/best-
practices
>> OpenPGP Best Practices
>
> Mike, I appreciate your efforts, but this stuff is too technical for me.
> I am only a simple LM user, who had hoped to install a more recent
> Handbrake version than the one in the official repos. Currently the PPA
> has 1.3.3, the official repo 1.3.1. Handbrake was updated to v. 1.4.0
> three days ago. I'll have to settle for what I had installed already (v.
> 1.3.1).
>
> BTW, I had the same problem with the Libre Office PPA a while ago (but
> haven't looked at it recently). I don't understand why PPA maintainers
> don't fix it.
>
> Yrrah

Gonna stick my toe in the water here.....Why don't you install Handbrake
using Flatpak?....The current flatpak version is at 1.4.0. I know alot of
people are against using Snaps or Flatpak....I agree on not using
Snaps....but I have several apps installed using Flatpak on my system and
I do this for two reasons....1 I'll always have the latest version of the
app....2 I keep my system pristine by not downloading alot of app
installed dependencies.....I have a 500 GB Samsung EVO 850 SSD so I have
some room to store flatpak apps...I'm running LMDE4 andf when I reboot my
system flatpak is set to check and update it's installed apps
automatically. It is also easy to do from the commandline....flatpak
update...is all that is required.

--
Pull my Finger

killa-de-bug wrote:
> Gonna stick my toe in the water here.....Why don't you install Handbrake
> using Flatpak?....The current flatpak version is at 1.4.0. I know alot of
> people are against using Snaps or Flatpak....I agree on not using
> Snaps....but I have several apps installed using Flatpak on my system and
> I do this for two reasons....1 I'll always have the latest version of the
> app....2 I keep my system pristine by not downloading alot of app
> installed dependencies.....I have a 500 GB Samsung EVO 850 SSD so I have
> some room to store flatpak apps...I'm running LMDE4 andf when I reboot my
> system flatpak is set to check and update it's installed apps
> automatically. It is also easy to do from the commandline....flatpak
> update...is all that is required.

Those are good arguments, even tho' I'm anti- such packaging (completely
taking over) because I see it as a 'threat' to conventional packaging.
The current Mint 20.2 repo has 1.3.1; the .ppa which 'only' fails
auto-authentication which is what started this thread is 1.3.3. Your
flat is 1.4.0 updated Jul 18, 2021.

Another solution to the authentication problem I just discovered while
typing this is that the default Synaptic repositories section has a
function to download or import keys, which defaults to the
keyserver.ubuntu.com which is where the .ppa's key is located. That is,
one could use synaptic to resolve the authentication problem described
earlier by pasting in the keyID (adding the 0x prefix).

I don't want to see the handbrake and other dev/s of the world and the
Ub and other distro repo maintainers of the world cease to provide
conventional packaging and *instead* only make fat flat/snap/appimage
type packaging for newer v./s of software.

--
Mike Easter

Mike Easter wrote:
> That is, one could use synaptic to resolve the authentication problem
> described earlier by pasting in the keyID (adding the 0x prefix).

That is actually better done using the graphical software sources
function rather than synaptic to do both adding the .ppa repo and then
during the update the user is informed that there is no key for the repo
and gives the key ID. The keyID w/ 0x prefix can be used in software
sources to add the key and software sources default keyserver is the
correct keyserver.ubuntu.com (which Seahorse is not) and Seahorse also
can NOT add the Ub keyserver.

The 'native' default gpg key server is (instead) keys.openpgp.org which
one can see w/ such command as

gpg --search-keys Stebbins

.... which doesn't find Stebbins and only looks on the openpgp server.

However, one can dictate that gpg use the Ub keyserver w/ the
--keyserver option.

gpg --keyserver keyserver.ubuntu.com --search-keys Stebbins

(which actually gives too much unhelpful info for this issue as the key
is not findable or retrievable by the Stebbins string)

I think it is worthwhile to see some ways to do this graphically or w/
the command line, and it is also necessary to understand the limitations
and default native configurations of the graphical tools. As well as
the command line's native defaults.

--
Mike Easter

Mike Easter wrote:
> The problem w/ Enigmail is that the current v/s of Tb don't use the
> previous enigmail in favor of their 'own' implementation of supporting
> OpenPgp in Tb similar to Enigmail, but the original email doesn't work
> after Tb v. 68.

s/email/enigmail/

I have a Mint 20.2 live w/ persistence I'm using to mess w/ XAMPP.
Unfortunately its Tb is (now) 78 (it was 68 in Mint 20.1). I
uninstalled its Tb 78 and then started looking for a 68 .deb to install,
since that was the 'original' Tb v. for Ub 20.04. I was surprised at
how difficult it is to find the old .deb for that v. of Ub.

It seems that 'everybody', Ub and Tb/Moz want to hide such 'old' v/s. A
challenge: Try to find it either place.

--
Mike Easter

On 19/07/21 13:13, Yrrah wrote:
> "GPG error:
> http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
> InRelease: The following signatures couldn't be verified because the
> public key is not available: NO_PUBKEY 8771ADB0816950D8 The repository
> 'http://ppa.launchpad.net/stebbins/handbrake-releases/ubuntu focal
> InRelease' is not signed."
>
> How to fix this? I've run into this problem with a number of other
> PPAs as well and have never found a working solution (but a lot of the
> usual "try this, try that" non-advice).
> And why don't maintainers fix it?
>
> Yrrah

Y PPA Manager has helped me in the past with some PPA issues.

https://itsfoss.com/y-ppa-manager/

Gerald H wrote:
> Y PPA Manager has helped me in the past with some PPA issues.
>
> https://itsfoss.com/y-ppa-manager/

Did you test y-ppa to see if it would handle the handbrake release .sig
automagically?

The 'conventional' synaptic has .ppa management features and key
handling features but it needed user help to get the handbrake key even
tho' the key was located on its default ubuntu keyserver. That is, when
I tested synaptic w/ handbrake .ppa, I got the key error which provided
me the keyID. Then I gave synaptic the keyID from the error and it
fetched the key which allowed proper authentication.

--
Mike Easter

Mike Easter wrote:
> The 'conventional' synaptic has .ppa management features and key
> handling features but it needed user help to get the handbrake key even
> tho' the key was located on its default ubuntu keyserver.  That is, when
> I tested synaptic w/ handbrake .ppa, I got the key error which provided
> me the keyID.  Then I gave synaptic the keyID from the error and it
> fetched the key which allowed proper authentication.

I forgot to mention; I could have avoided the error step if I had
manually added the key by using the keyID provided in the technical
details about this .ppa.

I think the 'concept' is, the 'business' of adding a key, which should
also include what the user is going to do about certifying that key,
should be an 'assertive' act. It can't be completely automated. The
process of checking the release and the release.gpg against that key can
be automated, but NOT the adding of the key.

--
Mike Easter