Docker images have expired key for github cli packages

[andreineculau]

brew doctor output

n/a

Verification

• My "brew doctor output" above says Your system is ready to brew. and am still able to reproduce my issue.
• I ran brew update twice and am still able to reproduce my issue.
• This issue's title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.

brew config output

n/a

What were you trying to do (and why)?

use the latest homebrew docker image and get the latest aptitude packages

In

brew/Dockerfile

Line 47 in 94eb0c7

&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \

we get the github cli keyring, but it expired.

so running

docker run --rm -it ghcr.io/homebrew/ubuntu22.04:latest

Followed by an apt-get update, like

sudo apt-get -y --fix-missing --allow-releaseinfo-change update

will now error.

Any other fix than build a new image or rebuild the current image (same version)?
For the time being, I guess it can be fixed downstream by updating the keyring.

PS: Maybe someone can explain why do we need github cli on the homebrew docker image. Can it be removed?

What happened (include all command output)?

W: GPG error: https://cli.github.com/packages stable InRelease: The following signatures were invalid: EXPKEYSIG 23F3D4EA75716059 GitHub CLI <[email protected]>
E: The repository 'https://cli.github.com/packages stable InRelease' is not signed.

What did you expect to happen?

no error

Step-by-step reproduction instructions (by running brew commands)

docker run --rm -it ghcr.io/homebrew/ubuntu22.04:latest

# inside docker, run:
sudo apt-get -y --fix-missing --allow-releaseinfo-change update

[carlocab]

Is there another keyring we can get that isn't expired?

PS: Maybe someone can explain why do we need github cli on the homebrew docker image.

Homebrew CI makes heavy use of gh.

Can it be removed?

Not without breaking pretty much all of our CI.

[carlocab]

See also cli/cli#9569.

Seems like the image just needs to be rebuilt. If this is blocking you, consider using ghcr.io/homebrew/ubuntu22.04:master instead.

A rebuilt :latest image should be available on the next brew tag (likely early next week).

In a pinch, you could probably also run this inside the :latest container:

curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | 
  sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg

[williammartin]

Hi folks, many apologies for the troubles from the GitHub CLI.

I just added some docker related details to our tracking issue: cli/cli#9569 (comment)

I can confirm the new keyring is available at https://cli.github.com/packages/githubcli-archive-keyring.gpg. If you own the layer that grabs this key, I would expect rebuilding the image solves the problem. If you don't own the layer, running:

RUN wget -qO- https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null \
    && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg

Before the apt update, should workaround until the base layer is updated.

Sorry 🙏

[carlocab]

@williammartin thanks for chiming in!

I think /etc/apt/keyrings there should be /usr/share/keyrings, because our Dockerfile still uses the old instructions:

brew/Dockerfile

Lines 47 to 51 in 94eb0c7

	&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
	&& chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
	&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
	&& apt-get update \
	&& apt-get install -y --no-install-recommends gh \

I'll open a PR to update our Dockerfile.

[williammartin]

Ahha! Thanks. I'm going to update our issue to provide both sets of instructions.

[andreineculau]

Thank you @carlocab ! We're good on our side. We have a hotfix to remove everything gh (via apt; we also make use of gh, but we install it via homebrew 😅 #inception)

And thank you @williammartin ! Do take it easy and enjoy the weekend! ❤️

[williammartin]

Updated the instructions to account for the old location here: cli/cli#9569 (comment)

Cheers!

[carlocab]

Thanks @williammartin! Dockerfile now updated in #18272.

[carlocab]

This should be fixed as of https://github.com/Homebrew/brew/releases/tag/4.3.20.