[Bug 1916485] [NEW] apt-key add fails in docker - Fails to run gnupg

[Florian Lohoff]

Public bug reported:


root at 84b750e443f8:/# lsb_release -rd
Description:	Ubuntu Hirsute Hippo (development branch)
Release:	21.04
root at 84b750e443f8:/# dpkg -l gnupg apt 
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version         Architecture Description
+++-==============-===============-============-==========================================
ii  apt            2.1.20          amd64        commandline package manager
ii  gnupg          2.2.20-1ubuntu2 all          GNU privacy guard - a free PGP replacement


Hi,
for 3 days our CI pipelines to recreate Docker images fails for the Hirsute images. From comparison this seems to be caused by apt 2.1.20.

The build fails with:

0E: gnupg, gnupg2 and unupg1 do not seem to be installed, but one of
them is required for this operation

The simple Dockerfile to reproduce the error - "docker build -t foo ."


FROM amd64/ubuntu:hirsute
MAINTAINER Florian Lohoff <f at zz.de>

USER root

RUN apt-get update \
	&& DEBIAN_FRONTEND=noninteractive apt-get -y install curl gnupg apt \
 	&& curl https://syncthing.net/release-key.txt | apt-key add -


Breaking it down it this seems to be an issue that there is new
functionality in apt/apt-key e.g. security hardening that docker
prohibits in its containers. Running this manually works only in an
--privileged container.

So adding keys in unpriviledged container or possibly kubernetes will
not work anymore.

Flo

** Affects: apt (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1916485

Title:
  apt-key add fails in docker - Fails to run gnupg

Status in apt package in Ubuntu:
  New

Bug description:
  
  root at 84b750e443f8:/# lsb_release -rd
  Description:	Ubuntu Hirsute Hippo (development branch)
  Release:	21.04
  root at 84b750e443f8:/# dpkg -l gnupg apt 
  Desired=Unknown/Install/Remove/Purge/Hold
  | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
  |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
  ||/ Name           Version         Architecture Description
  +++-==============-===============-============-==========================================
  ii  apt            2.1.20          amd64        commandline package manager
  ii  gnupg          2.2.20-1ubuntu2 all          GNU privacy guard - a free PGP replacement


  
  Hi,
  for 3 days our CI pipelines to recreate Docker images fails for the Hirsute images. From comparison this seems to be caused by apt 2.1.20.

  The build fails with:

  0E: gnupg, gnupg2 and unupg1 do not seem to be installed, but one of
  them is required for this operation

  The simple Dockerfile to reproduce the error - "docker build -t foo ."


  FROM amd64/ubuntu:hirsute
  MAINTAINER Florian Lohoff <f at zz.de>

  USER root

  RUN apt-get update \
  	&& DEBIAN_FRONTEND=noninteractive apt-get -y install curl gnupg apt \
   	&& curl https://syncthing.net/release-key.txt | apt-key add -


  Breaking it down it this seems to be an issue that there is new
  functionality in apt/apt-key e.g. security hardening that docker
  prohibits in its containers. Running this manually works only in an
  --privileged container.

  So adding keys in unpriviledged container or possibly kubernetes will
  not work anymore.

  Flo

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1916485/+subscriptions