Nutanix AHV Updates Failing - EXPKEYSIG

[HYF_JE]

Case 07222032

Not super thrilled with the support response to this one. My gut/intuition is telling me this is a software engineering/development issue.

As background, I routinely (monthly) visit all our AHV proxies and run updates via the built-in WebUI tool. Rarely have issues.

This time around I had a couple issues - some repos were inaccessible but that was a firewall issue on our end. I mention that mostly for transparency.

The other issue I'm having (interestingly only on 5/6 of our proxies) is the below error:

Code: Select all

April 17, 2024 at 09:03 AM GMT-5 Cannot find any updates for Veeam minor updates
Apt error: Failed to check for updates. "/etc/apt/sources.list.d/veeam.list": exit code: 0, timeout exceeded: false, output: Hit:1 https://repository.veeam.com/vbahv/5/public stable InRelease Err:1 https://repository.veeam.com/vbahv/5/public stable InRelease The following signatures were invalid: EXPKEYSIG 3268CF038EEC045B Veeam Software Repository key support@veeam.com Reading package lists... , errors: W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://repository.veeam.com/vbahv/5/public stable InRelease: The following signatures were invalid: EXPKEYSIG 3268CF038EEC045B Veeam Software Repository key support@veeam.com W: Failed to fetch https://repository.veeam.com/vbahv/5/public/dists/stable/InRelease The following signatures were invalid: EXPKEYSIG 3268CF038EEC045B Veeam Software Repository key support@veeam.com W: Some index files failed to download. They have been ignored, or old ones used instead. .

Veeam sent me two different KBs. First, KB2654 which while probably close to what I need, showed only being for the Veeam Agent for Linux, so not necessarily what was required in this case. They just recently provided me with KB4150 which is at least for Veeam for AHV, but only for version 2.0 and the "Cause" section of the KB indicates that the issue documented in this KB shouldn't apply to newer versions.

Going back to my hunch - I sense something has expired on Veeam's end and whatever automation *should* have covered this situation is not working as it should. I want to further add that the update checks for PSQL, Microsoft, Ubuntu, and Nginx repos all seem to be working. The one that's failing is Veeam's.

If you're a Veeam AHV user and could try to reproduce the issue and report back regardless of success/failure, that would be great. If you're a Veeam engineer, I'd appreciate a more fullsome response to what's going on here.

[ronnmartin61]

@HYF_JE I've heard from our developer team on this one and it does appear that this is something we need to address in a future release. In the meantime restarting the updater service on the appliance should force a key update -

Code: Select all

$ sudo service veeam-updater restart

Please confirm if this corrects the problem.

[HYF_JE]

Ronn - thank you for the response. That worked a treat on all 5 problem proxies for me. For the benefit of any future forum readers, this was the effect:

Code: Select all

/var/log/veeam/veeam-updater/updater.log

Code: Select all

18.04.2024 08:55:13 [info    ] 1977316 [1977316] ConfigurationManager.CheckRepositoriesKeys: Create directory /tmp/veeam-updater/repos_keys
18.04.2024 08:55:13 [info    ] 1977316 [1977316] ConfigurationManager.CheckRepoKey: Downloading key https://repository.veeam.com/keys/veeam.gpg to /tmp/veeam-updater/repos_keys/veeam.gpg
18.04.2024 08:55:13 [info    ] 1977316 [1977316] WebClient.DownloadFileImpl: Starting download file https://repository.veeam.com/keys/veeam.gpg
18.04.2024 08:55:13 [info    ] 1977316 [1977316] WebClient.DownloadFileImpl: Download finished
18.04.2024 08:55:13 [info    ] 1977316 [1977316] FileDownload.Download: /tmp/veeam-updater/repos_keys/veeam.gpg downloaded size: 5496
18.04.2024 08:55:13 [info    ] 1977316 [1977316] ConfigurationManager.CheckSumsNotEquals: Checksums of /etc/apt/trusted.gpg.d/veeam.gpg and /tmp/veeam-updater/repos_keys/veeam.gpg are different
18.04.2024 08:55:13 [info    ] 1977316 [1977316] ConfigurationManager.CheckRepoKey: Update key /etc/apt/trusted.gpg.d/veeam.gpg with /tmp/veeam-updater/repos_keys/veeam.gpg

After the service restart/GPG key update above, the update checks worked fine.

[ronnmartin61]

Outstanding! Thank you for confirming