# FIXED: Failed to fetch https://packages.sury.org, signatures were invalid

**URL:** <https://community.openenergymonitor.org/t/fixed-failed-to-fetch-https-packages-sury-org-signatures-were-invalid/26529>\
**Category:** emonSD\
**Created:** [9 August 2024 00:53 UTC](https://community.openenergymonitor.org/t/fixed-failed-to-fetch-https-packages-sury-org-signatures-were-invalid/26529 "2024-08-09T00:53:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![glyn.hudson](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/glyn.hudson/32/35003_2.png) [@glyn.hudson](https://community.openenergymonitor.org/u/glyn.hudson)\
**Post date:** [9 August 2024 00:53 UTC](https://community.openenergymonitor.org/t/fixed-failed-to-fetch-https-packages-sury-org-signatures-were-invalid/26529/1 "2024-08-09T00:53:34Z")

</div>

When running a Linux `sudo apt-get update` to fetch the latest package listings on an order emonSD, in this case [emonSD-10Nov22](https://docs.openenergymonitor.org/emonsd/download.html) you may run into the error:

```auto
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://packages.sury.org/php bullseye InRelease: The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 DEB.SURY.ORG Automatic Signing Key <deb@sury.org>
W: Failed to fetch https://packages.sury.org/php/dists/bullseye/InRelease The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 DEB.SURY.ORG Automatic Signing Key <deb@sury.org>

```

This error is caused by an outdated signing key on the PHP [sury.org](http://sury.org) repository, this can be fixed by:

First move the old `sury-php.list` file when the signing key is stored to the home folder in case something goes wrong and we need to restore it:

`sudo mv /etc/apt/sources.list.d/sury-php.list /home/pi/old.sury-php.list`

Then get the new signing key:

```auto
sudo apt-get update
sudo apt-get -y install lsb-release ca-certificates curl
sudo curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb
sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
sudo apt-get update

```

These steps were taken from [https://packages.sury.org/php/README.txt](https://packages.sury.org/php/README.txt)

* * *

@TrystanLea Maybe going forward we should use the official Debian PHP packages rather than sury, the notes from [https://deb.sury.org/](https://deb.sury.org/) says:

> I am a Debian Developer since year 2000, and I have been packaging PHP for Debian since PHP 5. That means the official packages in Debian and Ubuntu are either my work or they are based on my work. The PHP packages in my Ubuntu PPA and Debian DPA matches the official packages in Debian. Basically I am saying that you can’t get any closer than that.

Which means the official Debian packages should be the same as the sury packages without requiring adding and maintaining a new package list.

---

<div class="post-metadata">

**Author:** ![reedy](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/reedy/32/10467_2.png) [@reedy](https://community.openenergymonitor.org/u/reedy)\
**Post date:** [20 April 2026 21:43 UTC](https://community.openenergymonitor.org/t/fixed-failed-to-fetch-https-packages-sury-org-signatures-were-invalid/26529/2 "2026-04-20T21:43:38Z")

</div>

> [@glyn.hudson](#):
>
> in this case [emonSD-10Nov22](https://docs.openenergymonitor.org/emonsd/download.html)

Appearing on `emonSD-01Feb24` now, same instructions work for a fix though.

Guess it’s a reminder that I should rebuild my emonhp on the latest image at some point too…