Confused by Google Chrome installation and GPG keys

English Install/Boot/Login
#1

I added http://dl.google.com/linux/rpm/stable/x86_64 as a repository in YaST and I got this message:

https://snag.gy/9zRg1t.jpg

I clicked Yes and then found google-chrome-stable in Software management and tried to install it. As soon as the package was downloaded I got a popup (I have replaced the codes with **** as I don’t know if they are of any security importance):


Error: INVALID:google-chrome-stable-51.0.2704.106-1.x86_64 (Google Chrome): Signature verification failed [4-Signatures public key is not available]
    Header V4 DSA/SHA1 Signature, key ID ****: NOKEY
    Header SHA1 digest: OK (****)
    MD5 digest: OK (****)
    V4 DSA/SHA1 Signature, key ID ****: NOKEY

and I clicked Abort.

Then I went to

https://www.google.com/linuxrepositories/

and did this:

wget https://dl.google.com/linux/linux_signing_key.pub
sudo rpm --import linux_signing_key.pub
rpm -qi gpg-pubkey-7fac5991-*

And then 2 new Keys appeared in GPG keys in the repository manager in YaST. After that the installation was successful.

I removed the key starting with A040830… and was able to install google-chrome-stable again. (Tried the same with the other key before but that didn’t work - again error)

Why are there 2 keys for Google Inc? It seems one of them is useless/invalid and can be removed but why such a simple thing suddenly got so complicated? I never had this problem before when installing Google Chrome. (I am on a new fresh Leap system right now)

I hope someone with more experience can shed some light on this.

#2

Google just seem to manage their keys. :frowning:

#3

Yeah,
That error has been around for a long time.

The first time, you agreed to the GPG key to authenticate the Repo.

The other error you’re seeing is different, it’s package code that Google properly requires authentication for a dependency (one of their own files) but doesn’t provide a key hash to compare to the dependency’s cert. So, the error you’re seeing is that although the dependency is supposed to prove it’s valid, someone didn’t provide the needed info to compare and validate.

If you understand that (or not) it should be clear that there is nothing you can do about it, it’s just a bug in the Google Chrome code, but unless you think someone is in a position to substitute a malware-infested version if the dependency, you can ignore the warning and authorize Chrome stable to be installed.

TSU

#4

It doesn’t look like an error in the code but a problem with the downloading of the package. As I explained I could install it successfully. It is just this whole thing with the double keys which is confusing me. I don’t know how exactly this package signing works.

#5

It is error in RPM code. or more pointedly in the credential used by the RPM code. AFAIK there is no problem with the app program code. Nut in any case the problem is on Google not openSUSE

#6

I understand. Thanks.

So I guess I did the right thing removing one of the keys which didn’t work?

#7

From what I’ve seen, it’s clearly a dependency validation and not the package itself or the repo… When you install the package, it will start and hang only in the middle of the install (not in the beginning).

Since the install allows you to continue without the hash check and the chances someone would be able to exploit the failed check is very minimal (requires very special circumstances), IMO it’s fairly safe to continue installing.

TSU