Dietpi-update issues (plexmediaserver).

[Krouwndouwn]

Creating a bug report/issue

• I have searched the existing open and closed issues

Required Information

• DietPi version
  G_DIETPI_VERSION_CORE=10 G_DIETPI_VERSION_SUB=0 G_DIETPI_VERSION_RC=1 G_GITBRANCH='master' G_GITOWNER='MichaIng'
• Distro version
  trixie 0
• Kernel version
  Linux DietPi 6.12.62+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.12.62-1+rpt1 (2025-12-18) aarch64 GNU/Linux
• SBC model
  RPi 5 Model B (aarch64)
• Power supply used
  Raspberry Pi 27W USB-C Power Supply
• SD card used
  Pironman 5 NVMe M.2 SSD PCIe Mini PC Case + Samsung 980 Pro (with heatsink) 1TB

Additional Information (if applicable)

• Software title
  plexmediaserver
• Was the software title installed freshly or updated/migrated?
  Installed 1 year, 6 months, 16 days ago
• Can this issue be replicated on a fresh installation of DietPi?
  I don't know

• Bug report ID
  Didn't create one

Steps to reproduce

1. Use the dietpi-update command.

Expected behaviour

• Finish the update command with no errors.

Actual behaviour

 DietPi-Update
─────────────────────────────────────────────────────
 Phase: Checking for available DietPi update
[  OK  ] DietPi-Update | Checking IPv4 network connectivity
[  OK  ] DietPi-Update | Checking DNS resolver
[ INFO ] DietPi-Update | Getting latest version from: https://raw.githubusercontent.com/MichaIng/DietPi/master/.update/version
[  OK  ] DietPi-Update | Got valid latest version: 10.0.1
[  OK  ] DietPi-Update | No update required, your DietPi installation is already up to date:
[ INFO ] DietPi-Update | Current version : v10.0.1
[ INFO ] DietPi-Update | Latest version  : v10.0.1
[ INFO ] DietPi-Update | Checking for new available live patches
[ INFO ] DietPi-Update | APT update, please wait...
Hit:1 https://deb.debian.org/debian trixie InRelease
Get:2 https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version InRelease [14.8 kB]
Hit:3 https://deb.debian.org/debian trixie-updates InRelease
Hit:4 https://archive.raspberrypi.com/debian trixie InRelease
Hit:5 https://deb.debian.org/debian-security trixie-security InRelease
Hit:6 https://deb.debian.org/debian trixie-backports InRelease
Hit:7 https://downloads.plex.tv/repo/deb public InRelease
Err:7 https://downloads.plex.tv/repo/deb public InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key CD665CBA0E2F88B7373F7CB997203C7B3ADCA79D, which is needed to verify signature.
Hit:8 https://dietpi.com/apt trixie InRelease
Hit:9 https://dietpi.com/apt all InRelease
Fetched 14.8 kB in 0s (50.3 kB/s)
Reading package lists...
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: https://downloads.plex.tv/repo/deb public InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key CD665CBA0E2F88B7373F7CB997203C7B3ADCA79D, which is needed to verify signature.
E: Failed to fetch https://downloads.plex.tv/repo/deb/dists/public/InRelease  Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key CD665CBA0E2F88B7373F7CB997203C7B3ADCA79D, which is needed to verify signature.
E: Some index files failed to download. They have been ignored, or old ones used instead.
[FAILED] DietPi-Update | APT update
 - Command: apt-get -y -eany update
[FAILED] DietPi-Update | Unable to continue, DietPi-Update will now terminate.

Extra details

• This issue showed itself after a plexmediaserver update today.
• Still have the dietpi-plexmediaserver.gpg file in /etc/apt/trusted.gpg.d but I think somethings wrong with it.
• Previously got warnings about deprecation/changes that needed to be done for plexmediaserver in the logs (on screen) after a dietpi-update command.

[MichaIng]

Probably the key has just been rotated. Please try this:

curl -sSf 'https://downloads.plex.tv/plex-keys/PlexSign.key' | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/dietpi-plexmediaserver.gpg --yes

[Krouwndouwn]

I did try the command but same kind of issue happens after dietpi-update but the Missing Key ID seems to be different.

 DietPi-Update
─────────────────────────────────────────────────────
 Phase: Checking for available DietPi update
[  OK  ] DietPi-Update | Checking IPv4 network connectivity
[  OK  ] DietPi-Update | Checking DNS resolver
[ INFO ] DietPi-Update | Getting latest version from: https://raw.githubusercontent.com/MichaIng/DietPi/master/.update/version
[  OK  ] DietPi-Update | Got valid latest version: 10.0.1
[  OK  ] DietPi-Update | No update required, your DietPi installation is already up to date:
[ INFO ] DietPi-Update | Current version : v10.0.1
[ INFO ] DietPi-Update | Latest version  : v10.0.1
[ INFO ] DietPi-Update | Checking for new available live patches
[ INFO ] DietPi-Update | APT update, please wait...
Hit:1 https://deb.debian.org/debian trixie InRelease
Hit:2 https://deb.debian.org/debian trixie-updates InRelease
Hit:3 https://archive.raspberrypi.com/debian trixie InRelease
Hit:4 https://deb.debian.org/debian-security trixie-security InRelease
Hit:5 https://dietpi.com/apt trixie InRelease
Hit:6 https://deb.debian.org/debian trixie-backports InRelease
Get:7 https://downloads.plex.tv/repo/deb public InRelease [6685 B]
Err:7 https://downloads.plex.tv/repo/deb public InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key 97203C7B3ADCA79D, which is needed to verify signature.
Hit:8 https://dietpi.com/apt all InRelease
Get:9 https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version InRelease [14.8 kB]
Fetched 21.5 kB in 0s (47.6 kB/s)
Reading package lists...
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: https://downloads.plex.tv/repo/deb public InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key 97203C7B3ADCA79D, which is needed to verify signature.
E: Failed to fetch https://downloads.plex.tv/repo/deb/dists/public/InRelease  Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key 97203C7B3ADCA79D, which is needed to verify signature.
E: Some index files failed to download. They have been ignored, or old ones used instead.
[FAILED] DietPi-Update | APT update
 - Command: apt-get -y -eany update
[FAILED] DietPi-Update | Unable to continue, DietPi-Update will now terminate.

[MichaIng]

It is the same key, just the short form (it matches the last part of the long form). Don't ask me why APT shows the long form once, and the short form afterwards.

So the key does not seem to match the signature of the list 🤔. Instructions have not changed: https://support.plex.tv/articles/235974187-enable-repository-updating-for-supported-linux-server-distributions/

[MichaIng]

Ah, does your list actually use that key, i.e. did you install Plex via dietpi-software?

cat /etc/apt/sources.list.d/*plex*

[Krouwndouwn]

I did install Plex via dietpi-software (Installed it 1 year, 6 months, 16 days ago).

Results of the command:

deb [arch=arm64 signed-by=/usr/share/keyrings/plexmediaserver.v2.gpg] https://downloads.plex.tv/repo/deb public main

[MichaIng]

Hmm, looks like the Plex package ships its own key and list file then. Or it pulls in another package which does. But in turn it broke itself, as the new key requires the new package which can only be installed with the new key 🙄. I'll test. Until then, this will work:

echo 'deb https://downloads.plex.tv/repo/deb public main' | sudo tee /etc/apt/sources.list.d/plexmediaserver.list

[Krouwndouwn]

The command fixed the error issues. Thanks!!

If there is something I need to test or change later on, let me know.

Also got the warning back (I mentioned in Extra details).

W: https://downloads.plex.tv/repo/deb/dists/public/InRelease: Policy will reject signature within a year, see --audit for details

I guess this is something Plex need to fix in the future. Or something they are working on? Maybe thats why things did change to a non working state?

[MichaIng]

The package postinst script downloads the key and overwrites the sources list 🤔. This is very unusual, but I mean Plex also caused unusual errors in the past by completely rewriting the systemd unit with an extremely complex (error-prone) logic in the past (or maybe still does) 😄.

  # Switch repo definition to using the GPG key if not already done.
  HostArch="$(dpkg --print-architecture)"
  wget -q -O - https://downloads.plex.tv/plex-keys/PlexSign.key | gpg --yes --dearmor -o /usr/share/keyrings/plexmediaserver.gpg
  Result=$?

  if [ $Result -eq 0 ]; then
    sed -i -e "s+deb https://downloads.plex.tv+deb [arch=$HostArch signed-by=/usr/share/keyrings/plexmediaserver.gpg] https://downloads.plex.tv+" \
          /etc/apt/sources.list.d/plexmediaserver.list
  else
    Output "WARNING: Unable to install Plex GPG signing key in /usr/share/keyrings/plexmediaserver.gpg"
    Warnings=$((Warnings + 1))
  fi

It guess the idea here is that a manually installed .deb package will result in auto-updates from the APT repo. But of course, if the APT repo was installed already, this is at best redundant, or will break the admin's setup. And as long as the key is not provided with a package (the more common way), it cannot rotate itself.

We cannot prevent the postinst package from doing stuff, but we can use the same key location to prevent the duplicate. Nasty is that this also breaks the DEB822 migration I intended to do for all our software options 🤔.

[Krouwndouwn]

I understand the issue. I hope you can find some kind of good solution for the migration you are planning to do 💪

[Krouwndouwn]

@MichaIng

Today (after dietpi-update command) I got the following plexmediaserver error:

Err:7 https://downloads.plex.tv/repo/deb public InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CD665CBA0E2F88B7373F7CB997203C7B3ADCA79D is not bound:            No binding signature at time 2025-09-22T18:33:03Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Hit:8 https://dietpi.com/apt trixie InRelease
Hit:9 https://dietpi.com/apt all InRelease
Fetched 21.5 kB in 0s (81.3 kB/s)
Reading package lists...
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: https://downloads.plex.tv/repo/deb public InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CD665CBA0E2F88B7373F7CB997203C7B3ADCA79D is not bound:            No binding signature at time 2025-09-22T18:33:03Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
E: Failed to fetch https://downloads.plex.tv/repo/deb/dists/public/InRelease  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CD665CBA0E2F88B7373F7CB997203C7B3ADCA79D is not bound:            No binding signature at time 2025-09-22T18:33:03Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

[MichaIng]

Makes sense, same reason as before, same solution.

For reference: https://forums.plex.tv/t/935847/68

They seem to think about a different solution about how to handle it in their package (see ChuckPa's comment above). Before adjusting our code, I will wait for that, see what they come up with. Else I am just changing things two times.