search

linuxserver / docker-jellyfin

GNU General Public License v3.0
647 stars 97 forks source link

Update to Jellyfin Key #70

Closed Artiume closed 3 years ago

Artiume commented 3 years ago

Hey all, from the Jellyfin Team, we wanted to give you a heads up on a change on the Ubuntu key so your image doesn't break

https://github.com/jellyfin/jellyfin-blog/pull/86

joshuaboniface commented 3 years ago

The important bit for posterity:

Our GPG key for signing our Debian and Ubuntu repositories (https://repo.jellyfin.org/debian and https://repo.jellyfin.org/ubuntu) is set to expire next month.

Unfortunately this was an oversight when we first set up this repo, and we never provided any convenient way to update this. As a remedy, we've removed the expiry on the key and put a new version on the repo. This brings us into line with numerous other 3rd-party Debian repositories, such as the Microsoft .NET and Docker repositories which also use an expiry-less key, and should avoid any such issues again, barring a need to rotate it. This does however require manually refreshing the key on your system.

The updated APT key has the same fingerprint but no expiry.

aptalca commented 3 years ago

Thanks for the heads up. Our builders grab the key from https://repo.jellyfin.org/ubuntu/jellyfin_team.gpg.key during each build so I'm assuming they should be fine (the address we use is slightly different that what's posted on that linked page)?

EDIT: I compared the keys from both https://repo.jellyfin.org/ubuntu/jellyfin_team.gpg.key and https://repo.jellyfin.org/jellyfin_team.gpg.key and they appear to be the same, assuming they are both the updated key

joshuaboniface commented 3 years ago

Yep, both are identical, though using the second (without the /ubuntu or /debian subdir) is preferable. As long as it's pulling it each build and users aren't doing apt update inside the containers themselves it should be all good!