Cloudsmith Debian repository: signing key expired

General
1

Hello,

Just ran apt update on an ubuntu 24.04 server and got:

Err:6 ``https://dl.cloudsmith.io/public/caddy/stable/deb/debian`` any-version InRelease
The following signatures were invalid: EXPKEYSIG 531A6B20FA058A70 Caddy Web Server <contact@caddyserver.com>

After inspecting the key, I deleted it before downloading as per Install — Caddy Documentation . Cleared apt’s cache for dl.cloudsmith.io before trying apt update again. No luck.

$ gpg --show-keys /usr/share/keyrings/caddy-stable-archive-keyring.gpg
pub rsa4096 2016-04-01 [SC]
65760C51EDEA2017CEA2CA15155B6D79CA56EA34
uid Caddy Web Server contact@caddyserver.com
sub rsa2048 2016-04-01 [E] [expired: 2024-03-30]
sub rsa2048 2016-04-01 [SA] [expired: 2024-03-30]
sub rsa4096 2020-12-29 [S]

gpg: WARNING: No valid encryption subkey left over.

Can someone handling the debian repository take a look at this?

2

I can confirm the same issue on Debian 13 (Trixie).

APT/sqv rejects the same signing subkey :

531A6B20FA058A70

I also inspected the current InRelease directly :

https://dl.cloudsmith.io/public/caddy/stable/deb/debian/dists/any-version/InRelease

It reports :

Date : Thu, 01 Oct 2026 04:17:47 UTC

The OpenPGP signature identifies:

keyid 531A6B20FA058A70

issuer fingerprint :
D59FC5219C50B989D95FCE4E531A6B20FA058A70

signature created :
2026-10-01

That signing subkey expired on 2024-03-30.

So the current InRelease appears to have been freshly generated today
while still being signed with the expired subkey.

I have also opened a ticket with Cloudsmith support and provided them
with the diagnostic information.

3

Can confirm it is fixed today. 2.11.6 installed correctly. I guess it was signed with one of the expired keys yesterday.

Thank you to whoever go it fixed.

4

See Github issue for the discussion