Intel graphics drivers 1.4.0: i915-4.3.3-4.2.0-dkms isn't available, NO_PUBKEY D14BDB0DB3438B6C

Question

I've tried to install the latest Intel Graphics but it fails to find i915-4.3.3-4.2.0-dkms. Is their GPG key expired or wrong or is that a problem on my side somehow?

Solution 1

There was a problem, but it has now been resolved.

The repository key has been corrected and the drivers can now be installed successfully.

---

Historic answer

Prior to approximately 2016-02-23 13:00 UTC there was a problem. Intel were aware of it, investigated it, and corrected it. The basics of the problem were that the key of the repository referred to by the installer did not match the sourced public key in the documentation. This was corrected by them updating the key on the repository.

Intel said that an internal testing key was mistakenly used in place of the production key. Although, the only person from Intel reporting on this indicated that they themselves were in the dark on the timeline for a resolution. The repository key was updated approximately 24-hours after they made that statement.

Prior to the key being corrected, it was possible to force an installation with the key mismatch, but this was not advised as it can create a security issue which is irreversible.*

To remove the warning, a user could either disable the repository using the GUI, or delete the files /etc/apt/sources.list.d/intellinuxgraphics.* (Until the repository key was corrected, if the Intel installer was rerun after deleting these files the problem would return.)

There is no safe way of obtaining the package remotely if the keys do not match.

---

Detailed explanation

The Intel Graphics 1.4.0 installer installs an apt repository file in /etc/apt/sources.list.d/intellinuxgraphics.list which contains:

deb https://download.01.org/gfx/ubuntu/15.10/main wily main #Intel Graphics drivers

When you run, apt-get update, each repository must be verified by a PGP key. Prior to 2016-02-23 13:00 UTC, the apt-key repository was signed with a key with ID D14BDB0DB3438B6C, hence the warning:

W: GPG error: https://download.01.org wily InRelease: The following signatures 
couldn't be verified because the public key is not available: 
NO_PUBKEY D14BDB0DB3438B6C

In the intel documentation, it's indicated that the key is supposed to be installed by getting it from https://download.01.org/gfx/RPM-GPG-KEY-ilg-3 :

In order to "trust" the Intel® Graphics Installer for Linux*, you will need to add keys to Ubuntu's software package manager ("apt"). Open a terminal, and execute these lines:

wget --no-check-certificate \ https://download.01.org/gfx/RPM-GPG-KEY-ilg-3 -O - | \ sudo apt-key add -

Here, the -O switch to wget pipes the file to stdout, and the - when calling apt-key indicates to read the file from stdin

If we replace the call to apt-key with a gpg --dry-run, then we can see the key ID that is being supplied from that URL, e.g.

$ wget --no-check-certificate https://download.01.org/gfx/RPM-GPG-KEY-ilg-3 -O - | gpg --dry-run --import -
--2016-02-19 11:10:23--  https://download.01.org/gfx/RPM-GPG-KEY-ilg-3
Resolving download.01.org (download.01.org)... 104.84.0.87, 2600:1415:10:387::ae6, 2600:1415:10:389::ae6
Connecting to download.01.org (download.01.org)|104.84.0.87|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2105 (2.1K)
Saving to: 'STDOUT’

-                                   100%[===================================================================>]   2.06K  --.-KB/s   in 0s     

2016-02-19 11:10:24 (18.3 MB/s) - written to stdout [2105/2105]

gpg: key 894A3A8D: public key "[User ID not found]" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
gpg: no ultimately trusted keys found

So, key 894A3A8D from the downloaded key did not match key D14BDB0DB3438B6C required to decrypt the https://download.01.org/gfx/ubuntu/15.10/main repository correctly. This has now been fixed, and the key of the repository is now 894A3A8D.

This was confirmed in Intel's own forums here, and subsequently corrected and notified there also.

Removing the repository (whether by disabling it or removing the file) would cause the warning to go away, however, that also means that the contents of the repository were inaccessible.

Running the installer again would simply reenable the repository but not fix the key problem, so the error kept returning until the repository key had been fixed. It now works correctly.

It is possible to force an installation when the keys don't match, but this is not advised as it can create a security issue which is irreversible.

Until the correct key was published, there was no safe way of obtaining the package remotely. However, the repository key has now been updated and so the error has been resolved and the drivers can be installed safely and correctly.

Solution 2

I manage to install Intel Drivers 1.4.0 on 15.10 64-bit

First remove previous ppa from software sources, uninstall intel-graphic-installer, then type in terminal:

wget --no-check-certificate https://download.01.org/gfx/RPM-GPG-KEY-ilg-3 -O - | sudo apt-key add -

After that download and install 1.4.0 from Intel® Graphics for Linux

Solution 3

An Intel engineer had just announced on intel's forum that a new build will come shortly. We just have to be patient :-)

" Update: new packages should land shortly (nothing wrong with the current packages but the final release build was done with an internal for-testing key instead of the official release key). "

Solution 4

Here is how I got it working: If you remove the 01 repository before running the 1.4.0 installer, you should be good to go.

View more solutions

Comments

[int_ua]

Thank you for trying to help, the other answer was published earlier and contains just the step needed: removing the previous repository.

[tudor -Reinstate Monica-]

The problem with this answer is that the installed reenables the download.01.org repository so the GPG problem reappears. I wonder if it's actually installing the driver at all.

[tudor -Reinstate Monica-]

This didn't work for me. ilg-3 key does not appear to match key D14BDB0DB3438B6C.

[Marc Johansen]

After the install/reboot, all intel packages showed as up to date on both my laptops. Regarding GPG error, you should run the command provided by @Dragoslav Nikolic below.

[int_ua]

@tudor is right, actually. Disabling repository doesn't work. GPG key is also not helping as I already stated in the question. But removing /etc/apt/sources.list.d/intellinuxgraphics* helped.

[tudor -Reinstate Monica-]

@int_ua I beg to differ. If you delete that file, then run the installer, it just puts the files back and the problem reappears. The real problem is that the 01.org repository isn't signed with the key that appears in the docs.

[tudor -Reinstate Monica-]

If you run wget --no-check-certificate https://download.01.org/gfx/RPM-GPG-KEY-ilg-3 -O - | gpg --dry-run --import you'll see that the key ID from the download is actually 894A3A8D so there's no way this fixes the GPG key problem of missing key D14BDB0DB3438B6C unless they change the content of the download.

[tudor -Reinstate Monica-]

My proof that this does not fix the problem has also been confirmed by other users here: 01.org/linuxgraphics/forum/graphics-installer-discussions/…

[tudor -Reinstate Monica-]

Incidentally, the use of --no-check-certificate also creates a potential security issue. If you omit that switch, the command still works and is guaranteed to communicate with the correct https server.

[int_ua]

@tudor I'm not sure how, but the installer worked for me after deleting old repository

[int_ua]

I think adding (or moving it from the end of the answer) a short summary to the start will help those who just want to check if there is a workaround for the problem without reading all the details.

[tudor -Reinstate Monica-]

Update: Intel have realised their error and are investigating.

[int_ua]

The other user published the updated information and I'd like to encourage quickest possible information updates, so I accepted that answer at least for now. I hope you will not be discouraged by this, your answer is still thorough and good.

[tudor -Reinstate Monica-]

@int_ua Since we're not all awake at the same time, it's generally suggested to allow 24 hours for people to update their answer.

[tudor -Reinstate Monica-]

I have posted an update in the comments, but at this point my answer is still correct. No new key has been released, and the repository key has not been updated either.

[tudor -Reinstate Monica-]

I have updated my answer to include the update I put up 10 hours ahead of the other answer, but originally I didn't think it was newsworthy because it doesn't actually fix the problem. It's not an answer IMHO but wishful thinking. I have been checking this every 2 hours during the day and I checked it last thing before I went to sleep and first thing when I arrived at work. :-(

[tudor -Reinstate Monica-]

Update: The repository key has been updated and now the whole process works. I have updated my answer to reflect this.

[Bhikkhu Subhuti]

I was able to get the drivers installed easily, but not any more. If I remember correctly, I installed the wrong version (1.2) and then did the update.. then I realized I installed the wrong version.. updated through synaptic (because it showed up then).. and then I was able to udate that way. I have not tried that path yet. but maybe the key from the 1.2 works and it is a typo.