GPG-PUB-KEY-INTEL-SW-PRODUCTS-2023.PUB contains expired keys

[madebr]

https://github.com/libsdl-org/SDL/actions/runs/6363560367/job/17279255940

   The following signatures were invalid: EXPKEYSIG ACFA9FC57E6C5DBE Intel(R) Software Development Products
Reading package lists...
W: GPG error: https://apt.repos.intel.com/oneapi all InRelease: The following signatures were invalid: EXPKEYSIG ACFA9FC57E6C5DBE Intel(R) Software Development Products
E: The repository 'https://apt.repos.intel.com/oneapi all InRelease' is not signed.

Output of gpg --list-packets GPG-PUB-KEY-INTEL-SW-PRODUCTS-2023.PUB contains:

:user ID packet: "Intel(R) Software Development Products"
# off=975 ctb=89 tag=2 hlen=3 plen=318
:signature packet: algo 1, keyid ACFA9FC57E6C5DBE
        version 4, created 1569831767, md5len 0, sigclass 0x13
        digest algo 8, begin of digest cb e5
        hashed subpkt 2 len 4 (sig created 2019-09-30)
        hashed subpkt 27 len 1 (key flags: 03)
        hashed subpkt 9 len 4 (key expires after 4y1d0h0m)
        hashed subpkt 11 len 5 (pref-sym-algos: 9 8 7 3 2)
        hashed subpkt 21 len 5 (pref-hash-algos: 8 2 9 10 11)
        hashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)
        hashed subpkt 30 len 1 (features: 01)
        hashed subpkt 23 len 1 (keyserver preferences: 80)
        subpkt 16 len 8 (issuer key ID ACFA9FC57E6C5DBE)
        data: [2047 bits]

2019-09-30 + 4y1d == today 😉 (take or give a day)

[simonlui]

I can confirm the same issue is happening to someone who was using my Docker image which downloads from the oneAPI APT repositories. He got stuck on the same issue, here's the log that was shared with me which shows the same error as was said above.

C:\neural\Docker_IPEX_ComfyUI>docker build -t ipex-arc-comfy:latest -f Dockerfile .
[+] Building 42.6s (10/26)                                                                               docker:default
 => [internal] load .dockerignore                                                                                  0.0s
 => => transferring context: 2B                                                                                    0.0s
 => [internal] load build definition from Dockerfile                                                               0.2s
 => => transferring dockerfile: 6.55kB                                                                             0.0s
 => [internal] load metadata for docker.io/library/ubuntu:22.04                                                    1.7s
 => [auth] library/ubuntu:pull token for registry-1.docker.io                                                      0.0s
 => [internal] load build context                                                                                  0.0s
 => => transferring context: 1.61kB                                                                                0.0s
 => [stage-1  1/16] FROM docker.io/library/ubuntu:22.04@sha256:aabed3296a3d45cede1dc866a24476c4d7e093aa806263c27d  3.7s
 => => resolve docker.io/library/ubuntu:22.04@sha256:aabed3296a3d45cede1dc866a24476c4d7e093aa806263c27ddaadbdce3c  0.0s
 => => sha256:aabed3296a3d45cede1dc866a24476c4d7e093aa806263c27ddaadbdce3c1054 1.13kB / 1.13kB                     0.0s
 => => sha256:b492494d8e0113c4ad3fe4528a4b5ff89faa5331f7d52c5c138196f69ce176a6 424B / 424B                         0.0s
 => => sha256:c6b84b685f35f1a5d63661f5d4aa662ad9b7ee4f4b8c394c022f25023c907b65 2.30kB / 2.30kB                     0.0s
 => => sha256:445a6a12be2be54b4da18d7c77d4a41bc4746bc422f1f4325a60ff4fc7ea2e5d 29.54MB / 29.54MB                   2.8s
 => => extracting sha256:445a6a12be2be54b4da18d7c77d4a41bc4746bc422f1f4325a60ff4fc7ea2e5d                          0.8s
 => [oneapi-lib-installer 2/6] RUN apt-get update &&     apt-get install -y --no-install-recommends --fix-missin  34.2s
 => [stage-1  2/16] RUN mkdir /oneapi-lib                                                                          0.6s
 => [oneapi-lib-installer 3/6] RUN no_proxy=$no_proxy wget --progress=dot:giga -O- https://apt.repos.intel.com/in  1.1s
 => ERROR [oneapi-lib-installer 4/6] RUN apt-get update &&     apt-get install -y --no-install-recommends --fix-m  1.7s
------
 > [oneapi-lib-installer 4/6] RUN apt-get update &&     apt-get install -y --no-install-recommends --fix-missing     intel-oneapi-runtime-dpcpp-cpp=2023.2.1-16     intel-oneapi-runtime-mkl=2023.2.0-49495     intel-oneapi-compiler-shared-common-2023.2.1=2023.2.1-16:
0.544 Get:1 https://apt.repos.intel.com/oneapi all InRelease [4451 B]
0.570 Err:1 https://apt.repos.intel.com/oneapi all InRelease
0.570   The following signatures were invalid: EXPKEYSIG ACFA9FC57E6C5DBE Intel(R) Software Development Products
0.690 Hit:2 http://security.ubuntu.com/ubuntu jammy-security InRelease
0.690 Hit:3 http://archive.ubuntu.com/ubuntu jammy InRelease
0.936 Hit:4 http://archive.ubuntu.com/ubuntu jammy-updates InRelease
1.181 Hit:5 http://archive.ubuntu.com/ubuntu jammy-backports InRelease
1.233 Reading package lists...
1.709 W: GPG error: https://apt.repos.intel.com/oneapi all InRelease: The following signatures were invalid: EXPKEYSIG ACFA9FC57E6C5DBE Intel(R) Software Development Products
1.709 E: The repository 'https://apt.repos.intel.com/oneapi all InRelease' is not signed.
------
Dockerfile:26
--------------------
  25 |     ARG CMPLR_COMMON_VER=2023.2.1
  26 | >>> RUN apt-get update && \
  27 | >>>     apt-get install -y --no-install-recommends --fix-missing \
  28 | >>>     intel-oneapi-runtime-dpcpp-cpp=${DPCPP_VER} \
  29 | >>>     intel-oneapi-runtime-mkl=${MKL_VER} \
  30 | >>>     intel-oneapi-compiler-shared-common-${CMPLR_COMMON_VER}=${DPCPP_VER}
  31 |
--------------------
ERROR: failed to solve: process "/bin/sh -c apt-get update &&     apt-get install -y --no-install-recommends --fix-missing     intel-oneapi-runtime-dpcpp-cpp=${DPCPP_VER}     intel-oneapi-runtime-mkl=${MKL_VER}     intel-oneapi-compiler-shared-common-${CMPLR_COMMON_VER}=${DPCPP_VER}" did not complete successfully: exit code: 100
 
C:\neural\Docker_IPEX_ComfyUI>

This seems to not be isolated to just GPG-PUB-KEY-INTEL-SW-PRODUCTS-2023.PUB, I am using
GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB and it hits the same issue for the same reason I presume.

[human-01]

It seems the keys are expired as of 30th Sep, so new keys should be issued by the project I guess?

sudo apt-key --keyring ./oneapi-archive-keyring.gpg list
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
./oneapi-archive-keyring.gpg

pub rsa2048 2016-09-28 [SC] [expired: 2019-09-27]
BF43 85F9 1CA5 FC00 5AB3 9E1C 1A84 97B1 1911 E097
uid [ expired] "CN = Intel(R) Software Development Products", O=Intel Corporation

pub rsa2048 2019-09-30 [SC] [expired: 2023-09-30]
52AB D6E8 7E42 1793 9718 73FF ACFA 9FC5 7E6C 5DBE
uid [ expired] Intel(R) Software Development Products

pub rsa2048 2019-07-26 [SC] [expired: 2023-07-26]
E1BA 4ECE FB06 56C6 1BF9 7949 36B9 569B 3F1A 1BC7
uid [ expired] KEY-PIDT-PGP-20190726

pub rsa2048 2020-05-18 [SC] [expires: 2024-05-18]
6113 D313 62A0 D280 FC02 5AAB 6407 3642 7872 A220
uid [ unknown] CN=Intel(R) Software Development Products (PREPROD USE ONLY)

[madebr]

Using the steps documented at Intel's website, we were able to add the Intel compiler to our ci matrix again.

# Download the key to system keyring
wget -O- https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB \
  | gpg --dearmor | sudo tee /usr/share/keyrings/oneapi-archive-keyring.gpg > /dev/null

# Add signed entry to apt sources and configure the APT client to use Intel repository:
echo "deb [signed-by=/usr/share/keyrings/oneapi-archive-keyring.gpg] https://apt.repos.intel.com/oneapi all main" | sudo tee /etc/apt/sources.list.d/oneAPI.list

# Update package list
sudo apt-get update -y

# Install oneAPI
sudo apt-get install -y intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic