Please update your FreePBX v17 apt repo key

FreePBX Security
,
1

Heads up y’all that before your next apt update on the CLI you’ll want to refresh the FreePBX apt repo GPG key, by either updating Framework module to v17.0.28 from the CLI or by running this new CLI command following a browser-based ACP GUI Module Admin update of Framework to v17.0.28:

$ sudo fwconsole util updategpgkey

More Details

You can check that it worked by running this command before and after the update:

gpg /etc/apt/trusted.gpg.d/freepbx.gpg

Old key:

pub   rsa4096 2024-02-26 [SC] [expires: 2026-02-25]                                            
      991C357C8A359D0382BC6E87C4DFE68FCE6DE186                                                 
uid           Aptly <[email protected]>                                                        
sub   rsa4096 2024-02-26 [E] [expires: 2026-02-25]

New key:

pub   rsa4096 2024-02-26 [SC] [expires: 2028-02-11]
      991C357C8A359D0382BC6E87C4DFE68FCE6DE186
uid           Aptly <[email protected]>
sub   rsa4096 2024-02-26 [E] [expires: 2028-02-11]

The issue that prompted the work:

Apt repo gpg key expires 2026-02-25 · Issue #958 · FreePBX/issue-tracker · GitHub

And the relevant commit logs showing the work:

Commits · FreePBX/framework · GitHub

Note the forward-thinking set of calculations from @jphilip to help give earlier (30-day) warnings on the Dashboard in the future[1]:

Add fwconsole command to update the GPG key · FreePBX/framework@692ba88 · GitHub

  1. Note to self to revisit this issue at the start of the 2028 New Year! ↩︎

2 Likes
3

running sudo fwconsole util updategpgkey returned “Invalid argument” for some reason

sudo fwconsole ma upgrade framework

solved it for me

4

fwconsole util updategpgkey

… indeed returns “Invalid argument“

Any other way instead of upgrading the framework module?

5

That command is only available after updating framework module.

  • If you update framework via the GUI, then it is required to run that command.

  • If you update framework via the CLI, then it is not required to run that command.

6

Is there an email list that we could subscribe to that would send notifications about critical updates like this? Or if there are known security updates that are required?

I’m not always reading through the forums, so would be good to see if there is a way to get notified about this.

Chris

7

There is not currently a dedicated mailing list for this purpose.

You might consider instead subscribing to all notifications in this current FreePBX → Security topic – and maybe Blog → Security as well – by navigating to your account’s Preferences → Tracking tab, then further down to either Watched, Tracked, Watching First Post, etc. Confirm that your email settings are up-to-date in Preferences → Emails and Preferences → Account.

Also the GitHub repo for FreePBX security issue reporting gets alerts for those when they are published and can be watched there as well separately.

8

Thanks!

Note that I compiled Asterisk from scratch and ran the FreePBX installer with the noasterisk command and I still did need to do the

/sbin/fwconsole ma upgrade framework

I noticed this after doing:

root@phony:/home/tedm# apt-get update
Get:1 
 bookworm-security InRelease [48.0 kB]
Hit:2 
 bookworm InRelease
Get:3 
 bookworm-updates InRelease [55.4 kB]
Hit:4 
 bookworm InRelease
Get:5 http://deb.freepbx.org/freepbx17-prod bookworm InRelease [7,478 B]
Get:6 
 bookworm-security/main Sources [207 kB]
Get:7 
 bookworm-security/main amd64 Packages [297 kB]
Get:8 
 bookworm-security/main Translation-en [182 kB]
Err:5 http://deb.freepbx.org/freepbx17-prod bookworm InRelease
The following signatures were invalid: EXPKEYSIG C4DFE68FCE6DE186 Aptly [email protected]
Fetched 798 kB in 3s (272 kB/s)
Reading package lists… Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.freepbx.org/freepbx17-prod bookworm InRelease: The following signatures were invalid: EXPKEYSIG C4DFE68FCE6DE186 Aptly [email protected]
W: Failed to fetch http://deb.freepbx.org/freepbx17-prod/dists/bookworm/InRelease  The following signatures were invalid: EXPKEYSIG C4DFE68FCE6DE186 Aptly [email protected]
W: Some index files failed to download. They have been ignored, or old ones used instead.

Looks like there was only a narrow window where the old key was still valid that you could either autoupdate FreePBX or manually update it from the GUI.

Note that even after doing an apt upgrade and the fwconsole command above I still had to run the module updater from the FreePBX GUI and update the framework there.

10

A post was split to a new topic: Upgrading framework module does not work