<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Package: lxc-templates</div><div>Version: 3.0.4.48.g4765da8-1</div><div><br></div><div><br></div><div>||/ Name Version Architecture Description</div><div>+++-==============-===================-============-============================================</div><div>ii lxc-templates 3.0.4.48.g4765da8-1 amd64 Linux Containers userspace tools (templates)</div><div><br></div><div><br></div><div>Hello !</div><div><br></div><div>Context: we want to create a lxc with the lxc-debian template on a bookworm server <b>without any access to internet</b>.</div><div><br></div><div>We identified three issues preventing to achieve our goal and had to edit the <b>/usr/share/lxc/templates/lxc-debian </b>to succeed.</div><div><br></div><div>Description:</div><div><br></div><div>The download_debian() function states that it must verify signatures using /etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg but since bookworm, debian-archive-keyring install gpg files into the /usr/share/keyrings folder only. See <a href="https://packages.debian.org/bookworm/all/debian-archive-keyring/filelist">https://packages.debian.org/bookworm/all/debian-archive-keyring/filelist</a> versus bullseye version.</div><div><br></div><div>Path<b> lreleasekeyring=/etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg</b> does not exist hence it always tries to download from <a href="http://ftp-master.debian.org/">http://ftp-master.debian.org</a>. Which fails on a no internet access server.</div><div><br></div><div>A workaround is to add the --keyring /usr/share/keyrings/debian-archive-$release-stable.gpg args to the command as followed:</div><div> lxc-create -n test -t debian -- --mirror <a href="http://mymirror/debian">http://mymirror/debian</a> --security-mirror <a href="http://mymirror/debian-security">http://mymirror/debian-security</a> --release bookworm --keyring /usr/share/keyrings/debian-archive-buster-stable.gpg</div><div><br></div><div>A solution would be to modify the line 436 from:</div><div>- lreleasekeyring=/etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg</div><div>+ lreleasekeyring=/usr/share/keyrings/debian-archive-$release-stable.gpg</div><div><br></div><div>OR install the gpg keys back to etc/apt/trusted.gpg.d/ folder or whatever you see as a better fit ;).</div><div><br></div><div>Regards,</div><div><br></div><div>Eppii</div></body></html>