Expired gpg signature

Getting Below error while installing the yarn un ubuntu 24.04,

Not able to install yarn

W: GPG error: https://nightly.yarnpkg.com/debian nightly InRelease: The following signatures were invalid: EXPKEYSIG 4F77679369475BAA Yarn Packaging <yarn@dan.cx>
E: The repository 'https://nightly.yarnpkg.com/debian nightly InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

[andreknieriem]

Same here! This breaks all of our deployments!

[Daniel15]

Someone notified me of this via email. It's 1AM here so I'm going to look into it in the morning. I'll likely keep the key the same and just increase the expiry date.

I'd recommend upgrading to the latest version of Yarn (4.12.0), as v1 is in maintenance mode and isn't receiving updates.

Same here! This breaks all of our deployments!

Why does your deployment install Yarn every time? Ideally it should be cached or otherwise installed in your build environment (eg in a Docker image)

[0xCCD]

The gpg key was only valid until today:

|: curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --show-keys
pub rsa4096 2016-10-05 [SC]
72ECF46A56B4AD39C907BBB71646B01B86E50310
uid Yarn Packaging yarn@dan.cx
sub rsa4096 2016-10-05 [E]
sub rsa4096 2016-10-05 [S] [verfallen: 2017-10-05]
sub rsa4096 2016-10-30 [S] [verfallen: 2019-01-01]
sub rsa4096 2017-09-10 [S] [verfallen: 2019-01-01]
sub rsa4096 2019-01-02 [S] [verfallen: 2026-01-23]
sub rsa4096 2019-01-11 [S] [verfallen: 2026-01-23]

so it would be great if someone can update the pubkey.

[florenzen]

Yes, same here. No DevContainer can be rebuild because all extensions rely on yarn.

[sersanchus]

Same here. 👋

[fosteryw]

Hi!
Same issue

[Daniel15]

Updated GPG key with expiry on 2030-01-22 has been pushed to the most common keyservers (pgp.mit.edu, keys.gnupg.net, keys.openpgp.org and keyserver.ubuntu.com):

https://keyserver.ubuntu.com/pks/lookup?search=1646B01B86E50310&fingerprint=on&op=index

Run this command to update your key:

gpg --keyserver keyserver.ubuntu.com --recv-keys 23E7166788B63E1E

or this command to import it for use with apt:

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor | sudo tee /etc/apt/keyrings/yarn-archive-keyring.gpg
# For old systems that set up Yarn a long time ago.
sudo apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com 23E7166788B63E1E

The key at http://dl.yarnpkg.com/debian/pubkey.gpg will be updated shortly.