The way a sync with GPG key verification works here, is as follows:
Your “Upstream URL” and your “Releases/Distributions” are combined to the following URL:
http://archive.ubuntu.com/ubuntu/dists/focal/
The files InRelease, Release, and Release.gpg are downloaded from the URL from step 1.
pulp_deb tries to verify the signatures using the GPG key you provided. Any downloaded files that cannot be verified are simply discarded.
If not at least one of InRelease, or Release is left, you get the error you got.
So yes, most likely pulp_deb decided that the key you provided does not work for verifying the signatures. Perhaps you provided the wrong public key, or maybe pulp_deb did not like the format you provided it in. There are some docs on how to retrieve the right keys here: Importing Content - orcharhino documentation
Independently of what exactly you did, I think we need to improve the error message you got. From this error message it is impossible to tell, if the sync failed because you entered for example an incorrect “Upstream URL”, or if it failed because the downloaded files failed GPG key verification. If you dig through the logs you might be able to spot the difference, but this is not a good user experience! Turns out we already have an issue for this, but never worked on it: https://github.com/pulp/pulp_deb/issues/399 (I will try to revive this issue).
Thank you, good to know, and great that the documentation will get some love.
As for the link to the gpg key export command, it’s not working as the detailed key servers have been decommissioned. Having found this issue I encountered another, and I don’t seem to be the only one, but found this Getting GPG key for ubuntu repository? - #3 by saltyollpheist
I’ve just retested this in a Rocky Linux 8 container to ensure I actually download the keys. It works for me:
[root@d5a9327a5c64 /]# gpg --verify Release.gpg Release
gpg: Signature made Thu Apr 23 17:34:16 2020 UTC
gpg: using RSA key 3B4FE6ACC0B21F32
gpg: Good signature from "Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 790B C727 7767 219C 42C8 6F93 3B4F E6AC C0B2 1F32
gpg: Signature made Thu Apr 23 17:34:16 2020 UTC
gpg: using RSA key 871920D1991BC93C
gpg: Good signature from "Ubuntu Archive Automatic Signing Key (2018) <ftpmaster@ubuntu.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: F6EC B376 2474 EDA9 D21B 7022 8719 20D1 991B C93C
[root@d5a9327a5c64 /]# history
1 dnf install -y wget
2 wget http://archive.ubuntu.com/ubuntu/dists/focal/Release
3 wget http://archive.ubuntu.com/ubuntu/dists/focal/Release.gpg
4 gpg --verify Release.gpg Release
5 gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
6 gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 871920D1991BC93C
7 gpg --verify Release.gpg Release
8 history
It works even without protocol (in a fresh container):
[root@f913e2a7683e /]# gpg --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 3B4FE6ACC0B21F32: public key "Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>" imported
gpg: Total number processed: 1
gpg: imported: 1
[root@f913e2a7683e /]# gpg --keyserver keyserver.ubuntu.com --recv-keys 871920D1991BC93C
gpg: key 871920D1991BC93C: public key "Ubuntu Archive Automatic Signing Key (2018) <ftpmaster@ubuntu.com>" imported
gpg: Total number processed: 1
gpg: imported: 1
Could you try running this on another machine, like your local host? Foreman only needs the gpg export.
I’m stumped. As I can pull a key on an external machine, but not one in the corporate environment here. But when I do a tcpdump I see no outbound connections attempted at all.
Further searching is pointing to DNS, but I don’t see any DNS requests made so how on earth does the verification happen?
Apologies, this is clearly an issue with the environment my servers are in.
Unless you need an automated way, it’s very easy to just provide the ascii-armored GPG pub keys and upload them to your Foreman instance. Good luck digging through your corp. environment.
Yeah, I’m just using my external node to grab the keys now, they don’t change very often. But heck I’ve got no idea why it’s failing… Just grateful I noticed this in the syslog on the Ubuntu host:
Aug 17 16:01:42 server dirmngr[165778]: no alive host found in pool 'keyserver.ubuntu.com'
Aug 17 16:01:42 server dirmngr[165778]: command 'KS_GET' failed: No keyserver available
I just got tripped by this. Upstream had changed the GPG key, and I was getting the same error. Updating the key resolved it, but it only once @quba42 pointed it out.
I plan to provide a clearer error message in cases where sync failed due to signatures failing to verify. This is on our board, and slated for the next release.
