Can somebody with a fully operational N900 which updates completely and correctly *please* list the contents of their files in /etc/apt/sources.list and /etc/apt/sources.list.d/*? I have a fresh install and am getting complaints about expired keys from the old Nokia Maemo repos. I've read the forums and the "right" thing to do is still quite unclear.

So I figure there's a post-Nokia "right" set of repos which the average user should point at? And I'm hoping at least one person here has the answer and will be willing to share.

TIA,
Andy

Update 11/2:

FWIW, I have two files in /etc/apt/sources.list.d:

hildon-application-manager.list:

deb https://downloads.maemo.nokia.com/fremantle/ssu/apps/ ./
deb https://downloads.maemo.nokia.com/fremantle/ssu/mr0 ./
deb https://downloads.maemo.nokia.com/fremantle1.2/ovi/ ./
deb http://repository.maemo.org/extras/ fremantle-1.3 free non-free
deb https://downloads.maemo.nokia.com/fremantle/ovi/ ./

maemo.list:


deb http://repository.maemo.org/extras/ fremantle-1.3 free non-free
deb http://repository.maemo.org/extras-testing/ fremantle-1.3 free non-free
deb http://repository.maemo.org/extras-devel/ fremantle-1.3 free non-free

Nothing to change.
Expired keys have just not been renewed by Nokia (and probably/for sure mevel will).
Nothing to worry, it is just a warning (ofc someone may redirect repo address and feed your N900 with spyware, but WHO should that be ).

Well now that we have the repositories (at least extras, extras-testing and extras-devel), we (techstaff) might consider creating a new key and (re)signing all packages with the new key and distributing (or making available) the key.

Either techstaff and/or CSSU could/would be up for the task. I guess.

@reinob
but the expired key is only related to downloads.maemo.nokia.com.
So nothing that can be done, as Nokia/M$ is not interested to invest even the smallest amount of money/work into that anymore. We might be thankful that the repo is still online

And afaik there is yet no key for Maemo repo, or (might check later)? But it could be a nice enhancement.

Has anyone mirrored that repo so that when it is taken offline we can have a Plan B to keep everything rolling? I understand that this would be illegal on paper, but I seriously doubt even Microsoft would give a crap about that. If that happens, then we can sign every package and avoid the warnings.

Seriously, Microsoft(*) wouldn't give a crap, would they? I think Microsoft only cares about money, and I fail to see how they would lose any by having someone providing an alternate mirror. I mean, it's not like they fscked up our favorite mobile systems company by sending a rotten trojan horse to pose as CEO and destroy the mobile handsets division, is it?

(*) Reportedly, Microsoft wanted to patent the logo "What's in your wallet?" at some point, but it was already taken by another company with similar goals.