[Bug 1916485] Re: apt-key add fails in docker - Fails to run gnupg

Julian Andres Klode 1916485 at bugs.launchpad.net
Mon Feb 22 14:03:04 UTC 2021


This is a regression in glibc: [ -x /usr/bin/gpg] fails inside the
script.

Downgrading libc6  (and rdeps) to 2.32-0ubuntu6 makes it work again.
Upgrading libc6 to 2.33-0ubuntu2 breaks it.


** Package changed: apt (Ubuntu) => glibc (Ubuntu)

** Changed in: glibc (Ubuntu)
   Importance: Undecided => Critical

** Changed in: glibc (Ubuntu)
       Status: New => Triaged

** Tags added: rls-hh-incoming

** Summary changed:

- apt-key add fails in docker - Fails to run gnupg
+ test -x fails inside shell scripts

** Description changed:

+ glibc regression causes test -x to fail inside scripts inside
+ docker/podman:
  
+ root at 0df2ce5d7a46:/# echo 'test -x /usr/bin/gpg || echo Fail' > a                                                                                                                                                    
+ root at 0df2ce5d7a46:/# sh a                                                                                                                                                                                            
+ Fail                                                                                                                                                                                                                 
+ root at 0df2ce5d7a46:/# test -x /usr/bin/gpg || echo Fail                                                     
+ root at 0df2ce5d7a46:/# 
+ 
+ 
+ [Original bug report]
  root at 84b750e443f8:/# lsb_release -rd
  Description:	Ubuntu Hirsute Hippo (development branch)
  Release:	21.04
- root at 84b750e443f8:/# dpkg -l gnupg apt 
+ root at 84b750e443f8:/# dpkg -l gnupg apt
  Desired=Unknown/Install/Remove/Purge/Hold
  | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
  |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
  ||/ Name           Version         Architecture Description
  +++-==============-===============-============-==========================================
  ii  apt            2.1.20          amd64        commandline package manager
  ii  gnupg          2.2.20-1ubuntu2 all          GNU privacy guard - a free PGP replacement
- 
- 
  
  Hi,
  for 3 days our CI pipelines to recreate Docker images fails for the Hirsute images. From comparison this seems to be caused by apt 2.1.20.
  
  The build fails with:
  
  0E: gnupg, gnupg2 and unupg1 do not seem to be installed, but one of
  them is required for this operation
  
  The simple Dockerfile to reproduce the error - "docker build -t foo ."
  
- 
  FROM amd64/ubuntu:hirsute
  MAINTAINER Florian Lohoff <f at zz.de>
  
  USER root
  
  RUN apt-get update \
- 	&& DEBIAN_FRONTEND=noninteractive apt-get -y install curl gnupg apt \
-  	&& curl https://syncthing.net/release-key.txt | apt-key add -
- 
+  && DEBIAN_FRONTEND=noninteractive apt-get -y install curl gnupg apt \
+   && curl https://syncthing.net/release-key.txt | apt-key add -
  
  Breaking it down it this seems to be an issue that there is new
  functionality in apt/apt-key e.g. security hardening that docker
  prohibits in its containers. Running this manually works only in an
  --privileged container.
  
  So adding keys in unpriviledged container or possibly kubernetes will
  not work anymore.
  
  Flo

** Summary changed:

- test -x fails inside shell scripts
+ test -x fails inside shell scripts in containers

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to glibc in Ubuntu.
https://bugs.launchpad.net/bugs/1916485

Title:
  test -x fails inside shell scripts in containers

Status in glibc package in Ubuntu:
  Triaged

Bug description:
  glibc regression causes test -x to fail inside scripts inside
  docker/podman:

  root at 0df2ce5d7a46:/# echo 'test -x /usr/bin/gpg || echo Fail' > a                                                                                                                                                    
  root at 0df2ce5d7a46:/# sh a                                                                                                                                                                                            
  Fail                                                                                                                                                                                                                 
  root at 0df2ce5d7a46:/# test -x /usr/bin/gpg || echo Fail                                                     
  root at 0df2ce5d7a46:/# 

  
  [Original bug report]
  root at 84b750e443f8:/# lsb_release -rd
  Description:	Ubuntu Hirsute Hippo (development branch)
  Release:	21.04
  root at 84b750e443f8:/# dpkg -l gnupg apt
  Desired=Unknown/Install/Remove/Purge/Hold
  | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
  |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
  ||/ Name           Version         Architecture Description
  +++-==============-===============-============-==========================================
  ii  apt            2.1.20          amd64        commandline package manager
  ii  gnupg          2.2.20-1ubuntu2 all          GNU privacy guard - a free PGP replacement

  Hi,
  for 3 days our CI pipelines to recreate Docker images fails for the Hirsute images. From comparison this seems to be caused by apt 2.1.20.

  The build fails with:

  0E: gnupg, gnupg2 and unupg1 do not seem to be installed, but one of
  them is required for this operation

  The simple Dockerfile to reproduce the error - "docker build -t foo ."

  FROM amd64/ubuntu:hirsute
  MAINTAINER Florian Lohoff <f at zz.de>

  USER root

  RUN apt-get update \
   && DEBIAN_FRONTEND=noninteractive apt-get -y install curl gnupg apt \
    && curl https://syncthing.net/release-key.txt | apt-key add -

  Breaking it down it this seems to be an issue that there is new
  functionality in apt/apt-key e.g. security hardening that docker
  prohibits in its containers. Running this manually works only in an
  --privileged container.

  So adding keys in unpriviledged container or possibly kubernetes will
  not work anymore.

  Flo

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1916485/+subscriptions



More information about the foundations-bugs mailing list