[From nobody Tue Sep 15 22:37:07 2026 Received: (at submit) by bugs.debian.org; 13 Jun 2024 08:02:34 +0000 X-Spam-Checker-Version: SpamAssassin 3.4.6-bugs.debian.org_2005_01_02 (2021-04-09) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-11.7 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,HAS_PACKAGE,HTML_MESSAGE,MULTALT,RCVD_IN_MSPIKE_H2, SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE,VERSION autolearn=ham autolearn_force=no version=3.4.6-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 21; hammy, 150; neutral, 81; spammy, 0. spammytokens: hammytokens:0.000-+--bookworm, 0.000-+--UD:ftp-master.debian.org, 0.000-+--ftp-master.debian.org, 0.000-+--sk:ftpmas, 0.000-+--sk:ftp-mas Return-path: <eppii@gandi.net> Received: from mail12.gandi.net ([217.70.182.73]:46231 helo=gandi.net) by buxtehude.debian.org with esmtps (TLS1.2:ECDHE_X25519__RSA_SHA512__AES_256_GCM:256) (Exim 4.94.2) (envelope-from <eppii@gandi.net>) id 1sHfPl-00AbG2-EN for submit@bugs.debian.org; Thu, 13 Jun 2024 08:02:34 +0000 Received: from smtpclient.apple (unknown [217.70.181.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gandi.net (Postfix) with ESMTPSA id 45B2C160685 for <submit@bugs.debian.org>; Thu, 13 Jun 2024 07:54:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gandi.net; s=20190808; t=1718265297; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=8yjmKfkNygi1sIi+iThW6oQjLNNYY5EHOnge1iShE1Y=; b=EQMGtvpIcuW50A4VYcqwEl2fCztUm2lW3MO5we+UChFYcNl2Ap4O67zibdnw0sJspbdBNK PfhAV2m8mcwlGySNU+g6VtPDAYxMydagFY+NRoFYXVsA6uOP+kE/lTj4FkWe6L4SMIwwE7 GZFgLTQueAdAEk7w2u6hO3hUNoaoEMiJMDzksFpf9K5X0DVJv8J3Vyq4ylaGKcHJ5xYJbs 3g0ebOhXKcOW4C24w1Q0Kq/R+iyUanC6EhT1/syAmVofmF4km4hG1IiaL7AlSykWn5yBy6 pduqSu9E+qCKrBzzdy9PgV36olQ+Ui6O/VZiO66jNxZpMzNyHsmR2gFbOlEgMA== From: Eppii <eppii@gandi.net> Content-Type: multipart/alternative; boundary="Apple-Mail=_83671918-D5E5-4EB7-9665-93956B8ED0A4" Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.600.62\)) Subject: LXC debian template can't find gpg pub keys on Bookworm without network Message-Id: <AB5D2878-9E3F-441A-A9C2-918C98944C36@gandi.net> Date: Thu, 13 Jun 2024 09:54:47 +0200 To: submit@bugs.debian.org X-Mailer: Apple Mail (2.3774.600.62) X-Greylist: delayed 452 seconds by postgrey-1.36 at buxtehude; Thu, 13 Jun 2024 08:02:33 UTC Delivered-To: submit@bugs.debian.org --Apple-Mail=_83671918-D5E5-4EB7-9665-93956B8ED0A4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Package: lxc-templates Version: 3.0.4.48.g4765da8-1 ||/ Name Version Architecture Description = +++-=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D-=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D-=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D-=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ii lxc-templates 3.0.4.48.g4765da8-1 amd64 Linux Containers = userspace tools (templates) Hello ! Context: we want to create a lxc with the lxc-debian template on a = bookworm server without any access to internet. We identified three issues preventing to achieve our goal and had to = edit the /usr/share/lxc/templates/lxc-debian to succeed. Description: The download_debian() function states that it must verify signatures = using /etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg but = since bookworm, debian-archive-keyring install gpg files into the = /usr/share/keyrings folder only. See = https://packages.debian.org/bookworm/all/debian-archive-keyring/filelist = versus bullseye version. Path = lreleasekeyring=3D/etc/apt/trusted.gpg.d/debian-archive-$release-stable.gp= g does not exist hence it always tries to download from = http://ftp-master.debian.org <http://ftp-master.debian.org/>. Which = fails on a no internet access server. A workaround is to add the --keyring = /usr/share/keyrings/debian-archive-$release-stable.gpg args to the = command as followed: lxc-create -n test -t debian -- --mirror http://mymirror/debian = --security-mirror http://mymirror/debian-security --release bookworm = --keyring /usr/share/keyrings/debian-archive-buster-stable.gpg A solution would be to modify the line 436 from: - = lreleasekeyring=3D/etc/apt/trusted.gpg.d/debian-archive-$release-stable.gp= g + = lreleasekeyring=3D/usr/share/keyrings/debian-archive-$release-stable.gpg OR install the gpg keys back to etc/apt/trusted.gpg.d/ folder or = whatever you see as a better fit ;). Regards, Eppii= --Apple-Mail=_83671918-D5E5-4EB7-9665-93956B8ED0A4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii <html><head><meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dus-ascii"></head><body style=3D"overflow-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Package: = lxc-templates</div><div>Version: = 3.0.4.48.g4765da8-1</div><div><br></div><div><br></div><div>||/ Name =           Version         =     Architecture = Description</div><div>+++-=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D-=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D-=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D-=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</div= ><div>ii  lxc-templates  3.0.4.48.g4765da8-1 amd64   =      Linux Containers userspace tools = (templates)</div><div><br></div><div><br></div><div>Hello = !</div><div><br></div><div>Context: we want to create a lxc with the = lxc-debian template on a bookworm server <b>without any access to = internet</b>.</div><div><br></div><div>We identified three issues = preventing to achieve our goal and had to edit = the <b>/usr/share/lxc/templates/lxc-debian </b>to = succeed.</div><div><br></div><div>Description:</div><div><br></div><div>Th= e download_debian() function states that it must verify signatures = using /etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg but = since bookworm, debian-archive-keyring install gpg files into the = /usr/share/keyrings folder only. See <a = href=3D"https://packages.debian.org/bookworm/all/debian-archive-keyring/fi= lelist">https://packages.debian.org/bookworm/all/debian-archive-keyring/fi= lelist</a> versus bullseye = version.</div><div><br></div><div>Path<b> lreleasekeyring=3D/etc/apt/= trusted.gpg.d/debian-archive-$release-stable.gpg</b> does not exist = hence it always tries to download from <a = href=3D"http://ftp-master.debian.org/">http://ftp-master.debian.org</a>. = Which fails on a no internet access server.</div><div><br></div><div>A = workaround is to add the --keyring = /usr/share/keyrings/debian-archive-$release-stable.gpg args to the = command as followed:</div><div> lxc-create -n test -t debian -- = --mirror <a = href=3D"http://mymirror/debian">http://mymirror/debian</a> --security= -mirror <a = href=3D"http://mymirror/debian-security">http://mymirror/debian-security</= a>  --release bookworm --keyring = /usr/share/keyrings/debian-archive-buster-stable.gpg</div><div><br></div><= div>A solution would be to modify the line 436 = from:</div><div>-     = lreleasekeyring=3D/etc/apt/trusted.gpg.d/debian-archive-$release-stable.gp= g</div><div>+    = lreleasekeyring=3D/usr/share/keyrings/debian-archive-$release-stable.gpg</= div><div><br></div><div>OR install the gpg keys back to = etc/apt/trusted.gpg.d/ folder or whatever you see as a better fit = ;).</div><div><br></div><div>Regards,</div><div><br></div><div>Eppii</div>= </body></html>= --Apple-Mail=_83671918-D5E5-4EB7-9665-93956B8ED0A4-- ]