webmin.sh: signature verification failed

[github-tomster]

for the records:

vm/apps/webmin.sh

Line 52 in 24f1720

if curl -fsSL http://www.webmin.com/jcameron-key.asc | sudo apt-key add -

apt-key depreciated
https://www.digitalocean.com/community/tutorials/how-to-handle-apt-key-and-add-apt-repository-deprecation-using-gpg-to-add-external-repositories-on-ubuntu-22-04

EDiT:
i am not sure what happened and how it happened 🤔

at least i was clumsy enough to ignore one inactive terminal window:

# bash /var/scripts/vm-repo-backup/apps/webmin.sh
dpkg-query: no packages found matching webmin
Installing Webmin...
[⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻]
1 of 10 retries.
Trying again in 30 seconds...
Adding trusted key in /etc/apt/keyrings/jcameron-key.asc...
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.7 (GNU/Linux)

mQGiBDx9wR0RBACR3xGPTkG5Staj7EVeiVJDrYXIPF28MGCrOEGw04tQmQTALz0E
YEcyfvui7KScrpHmZpy70PwgwxUDPUMik7vvRiUa9RRbJsDYyom06NGk+Z4dURhn
DeNRhcBrNBfyMvUY7HSJ2JP9jhQDWb8Lo1i231tvlnY0tNudVsP484ax6wCgrBwW
myad6TLYaETj0+AxGJxYgikD/iERqNF60x+WyfEH/SIOuKGlV/QoxmqOePn2gj9V
DWiOOAZ9DDWD6DpRNK/UVZRD1MK37HU1ePv7i92DTL9yIbyJwFcZNkEyMU3t+GBj
zf4YvaQnvtA09EdQNsC1GXxNXqYkVmTE1dHH83UK+chaXRoDQ6O9KD9SFE2vsj1d
z9VPBACPgmuVcUKXag6ZBY+SBColQzwyZfXtTOCnBh0HP4HOjU4G6CRTcAgLQrdM
1Uu29Al7TaE2p8HZb37dVoTRntM+Nf5O+2dX5iHA6ncdozKGftuXQMC7z9758nUi
2E4Svo9hmroM+NKonpZByt6TilhDXrPIcNYHlNsxpTAxq+lnw7QjSmFtaWUgQ2Ft
ZXJvbiA8amNhbWVyb25Ad2VibWluLmNvbT6IVwQTEQIAFwUCPH3BHQULBwoDBAMV
AwIDFgIBAheAAAoJENl6OukR9jxRQZEAoIHxngo/LxLBeFF9cpEViVGgChRIAJ90
zwqcBfw02su5AavnXjv6HxXF8bkBDQQ8fcEqEAQAx88aO9zI912/tbsNjLhDXpq0
WMw5F6fUUlwYpkaspPwWZ3UgDJaR1+oL3xnJKlD1Eu5x9B3r+rxYyoFpXubWz4R6
sL1u4kMRb347+fv140dE/RGFNEmqefZDeysz1TQG1Sskyyf7sV2KRUmI8wJTwg3n
IOtbyOoE3XlxI5FUrW8AAwUD/iEBdIH5DYB/FnOb/EkP3G3kCXGgTdZk7UA9HPKB
dV7JckgSicpi/mX898LxQrr0jyb6nyi2900OgQUQArrviTnp37j4ciQj214gTHzf
ssA40O5QR4t915z6wS4Ml+fAc5ZOeL6EQxiP+x+rz6h9+Mc8rawowY+7sBnvVw5O
YoVXiEYEGBECAAYFAjx9wSoACgkQ2Xo66RH2PFH+ZgCggAyuOLaoE9t9tyJbifEz
/YzvqYwAnj85Ehe8EmnKuor/k/TPtKl4MzDm
=oxvD
-----END PGP PUBLIC KEY BLOCK-----
[⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻W: OpenPGP signature verification failed: https://download.webmin.com/download/repository sarge Release: The following signatures were invalid: 1719003ACE3E5A41E2DE70DFD97A3AE911F63C51 (untrusted public key algorithm: dsa1024)
E: The repository 'https://download.webmin.com/download/repository sarge Release' is not signed.
]
dpkg-query: no packages found matching webmin
[⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻⣾⣽⣻W: OpenPGP signature verification failed: https://download.webmin.com/download/repository sarge Release: The following signatures were invalid: 1719003ACE3E5A41E2DE70DFD97A3AE911F63C51 (untrusted public key algorithm: dsa1024)
E: The repository 'https://download.webmin.com/download/repository sarge Release' is not signed.
]
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package webmin
dpkg-query: no packages found matching webmin
--2026-08-11 15:09:46--  http://prdownloads.sourceforge.net/webadmin/webmin_2.010_all.deb
Resolving prdownloads.sourceforge.net (prdownloads.sourceforge.net)... 104.18.13.149, 104.18.12.149, 2606:4700::6812:d95, ...
Connecting to prdownloads.sourceforge.net (prdownloads.sourceforge.net)|104.18.13.149|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://downloads.sourceforge.net/project/webadmin/webmin/2.010/webmin_2.010_all.deb [following]
--2026-08-11 15:09:46--  http://downloads.sourceforge.net/project/webadmin/webmin/2.010/webmin_2.010_all.deb
Resolving downloads.sourceforge.net (downloads.sourceforge.net)... 104.18.12.149, 104.18.13.149, 2606:4700::6812:c95, ...
Reusing existing connection to prdownloads.sourceforge.net:80.
HTTP request sent, awaiting response... 302 Found
Location: http://ixpeering.dl.sourceforge.net/project/webadmin/webmin/2.010/webmin_2.010_all.deb?viasf=1&fid=dac998b8e751a47d&e=1786540187&st=__70pX-rK5OxOKRtyXliHQ [following]
--2026-08-11 15:09:47--  http://ixpeering.dl.sourceforge.net/project/webadmin/webmin/2.010/webmin_2.010_all.deb?viasf=1&fid=dac998b8e751a47d&e=1786540187&st=__70pX-rK5OxOKRtyXliHQ
Resolving ixpeering.dl.sourceforge.net (ixpeering.dl.sourceforge.net)... 103.2.117.3
Connecting to ixpeering.dl.sourceforge.net (ixpeering.dl.sourceforge.net)|103.2.117.3|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 34186404 (33M) [application/octet-stream]
Saving to: ‘webmin_2.010_all.deb.1’

webmin_2.010_all.deb.1        100%[==============================================>]  32.60M  4.16MB/s    in 8.6s

2026-08-11 15:09:57 (3.79 MB/s) - ‘webmin_2.010_all.deb.1’ saved [34186404/34186404]

Selecting previously unselected package webmin.
(Reading database ... 138064 files and directories currently installed.)
Preparing to unpack webmin_2.010_all.deb ...
Unpacking webmin (2.010) ...
Setting up webmin (2.010) ...
Configuring Webmin...
Starting webmin...

so i was investigating the OpenPGP signature verification failed error
and github guided me to: https://github.com/nextcloud/vm/blob/24f1720e5eda9b7ce922ea5d1a9521bcbec10baa/apps/webmin.sh#L52

did the following:

• verified that the webmin.pgp was missing
• called webmin.sh again
• uninstalled webmin
• rebooted
• called webmin.sh again
• same repo error
• called webmin.sh again
• uninstalled webmin
• rebooted
• used https://github.com/webmin/webmin/blob/master/webmin-setup-repo.sh
• apt update install webmin

done!

btw:
is there a reason why hardcoding webmin_2.010_all.deb into webmin.sh

EDiT#2:
also there was a warning/notice on webmins dashboard - installed via webmin.sh - that an old repository is used.
i do not remember the exact message 🤷🏻‍♂️ that message is not there with webmin-setup-repo.sh 💡