Public Key not found error with eclipse-temurin:11 image updated on 27th May 2022

[shivpatel1]

We are using eclipse-temurin:11 [using ubuntu 20.04] as a base image since a long time.
Yesterday, we pulled the same image from Dockerhub and started noticing below errors while building our internal images.
We have "apt-get update .... " command in our Dockerfile which results into these errors.

Get:1 http://security.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Err:1 http://security.ubuntu.com/ubuntu jammy-security InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
Get:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [109 kB]
Err:2 http://archive.ubuntu.com/ubuntu jammy InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C

Seems like this is happening after eclipse-temurin started using ubuntu 22.04 .

As per few responses to other questions on ubuntu forum, I added below lines in my Dockerfile just before "apt-get update.." command..

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 871920D1991BC93C

This was giving below error :

[91mE: gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of them is required for this operation
[0mThe command '/bin/sh -c apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 871920D1991BC93C' returned a non-zero code: 255

So, we thought gnupg needs to be installed but that again needs apt-get update / install commands which fails with same PUBLIC KEY not found error.

Is this a known behavior in latest eclipse-temurin:11 ? Is there any solution available ?

Below is the partial content of our Dockerfile.

FROM xxxxxx/eclipse-temurin:11

ENV TOMCAT_MAJOR 9
ENV TOMCAT_VERSION 9.0.62
...
...
RUN apt-get update -y &&
curl -jksSL -o xxxxx
...
...

[gdams]

I've tried to reproduce this myself but am currently unable to do so:

➜  ~ docker run -it eclipse-temurin:11 apt-get update
Get:1 http://ports.ubuntu.com/ubuntu-ports jammy InRelease [270 kB]
Get:2 http://ports.ubuntu.com/ubuntu-ports jammy-updates InRelease [109 kB]
Get:3 http://ports.ubuntu.com/ubuntu-ports jammy-backports InRelease [99.8 kB]
Get:4 http://ports.ubuntu.com/ubuntu-ports jammy-security InRelease [110 kB]
Get:5 http://ports.ubuntu.com/ubuntu-ports jammy/universe arm64 Packages [17.2 MB]
Get:6 http://ports.ubuntu.com/ubuntu-ports jammy/main arm64 Packages [1,758 kB]
Get:7 http://ports.ubuntu.com/ubuntu-ports jammy/restricted arm64 Packages [24.2 kB]
Get:8 http://ports.ubuntu.com/ubuntu-ports jammy/multiverse arm64 Packages [224 kB]
Get:9 http://ports.ubuntu.com/ubuntu-ports jammy-updates/restricted arm64 Packages [40.4 kB]
Get:10 http://ports.ubuntu.com/ubuntu-ports jammy-updates/universe arm64 Packages [124 kB]
Get:11 http://ports.ubuntu.com/ubuntu-ports jammy-updates/main arm64 Packages [295 kB]
Get:12 http://ports.ubuntu.com/ubuntu-ports jammy-backports/universe arm64 Packages [2,009 B]
Get:13 http://ports.ubuntu.com/ubuntu-ports jammy-security/universe arm64 Packages [70.2 kB]
Get:14 http://ports.ubuntu.com/ubuntu-ports jammy-security/restricted arm64 Packages [35.2 kB]
Get:15 http://ports.ubuntu.com/ubuntu-ports jammy-security/main arm64 Packages [156 kB]
Fetched 20.5 MB in 1s (21.0 MB/s)                          
Reading package lists... Done

[shivpatel1]

@gdams : Thank you for checking this.

docker run -it eclipse-temurin:11 apt-get update
This command runs in my environment as well.

We have our application specific Dockerfile which contains eclipse-temurin:11 as a base image. And our Dockerfile contains apt-get update command. While using this Dockerfile to create an image of our application, it fails with the PUBLIC KEY error while executing apt-get update command it has.

If I use old image of eclipse-temurin [8 months old - which I have locally] as a base image then it works. The issue comes if I use this new one [May 27 2022 update].

[gdams]

This one is obviously hard to diagnose without seeing your Dockerfile, If I understand correctly you're saying that the difference is that the apt-get update command is run as a step in your Dockerfile?

See this sample Dockerfile (which I think mirrors your setup):

FROM eclipse-temurin:11
RUN apt-get update -y

If I build that it works on my end:

docker build -f Dockerfile .
[+] Building 1.6s (6/6) FINISHED                                                                                                                     
 => [internal] load build definition from Dockerfile                                                                                            0.0s
 => => transferring dockerfile: 89B                                                                                                             0.0s
 => [internal] load .dockerignore                                                                                                               0.0s
 => => transferring context: 2B                                                                                                                 0.0s
 => [internal] load metadata for docker.io/library/eclipse-temurin:11                                                                           0.0s
 => CACHED [1/2] FROM docker.io/library/eclipse-temurin:11                                                                                      0.0s
 => [2/2] RUN apt-get update -y                                                                                                                 1.5s
 => exporting to image                                                                                                                          0.1s 
 => => exporting layers                                                                                                                         0.1s 
 => => writing image sha256:614adacd6e38d90a6f01089e7209adca02aa98019c8455f2863cfd162c8fedbc       
                                                                                                                                                     
Use 'docker scan' to run Snyk tests against images to find vulnerabilities and learn how to fix them   

[shivpatel1]

@gdams : Yes, I tried this today and it seems to be working. The same Dockerfile was not working for two days continuously and I opened this issue here. But today, somehow I am not getting that PUBLIC KEY related errors from ubuntu.

Thank you for your time. I will come back if I will start seeing the same issue again. Closing this case from my end.

[shivpatel1]

@gdams : We were facing this issue on environments where we had Docker 18.x.x. The environments where we had Docker 19.x.x or Docker 20.x.x were noticed to work well.

Added this information to help in case someone else also come across this issue.

[tholu]

Running into the same issue with Docker version 19.03.15, build 99e3ed8919 right now.

# docker run -it eclipse-temurin:11 apt-get update
Get:1 http://security.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [114 kB]
Get:4 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [99.8 kB]
Err:1 http://security.ubuntu.com/ubuntu jammy-security InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
Err:2 http://archive.ubuntu.com/ubuntu jammy InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
Err:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
Err:4 http://archive.ubuntu.com/ubuntu jammy-backports InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
Reading package lists... Done
W: http://security.ubuntu.com/ubuntu/dists/jammy-security/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg are ignored as the file is not readable by user '_apt' executing apt-key.
W: http://security.ubuntu.com/ubuntu/dists/jammy-security/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg are ignored as the file is not readable by user '_apt' executing apt-key.
W: GPG error: http://security.ubuntu.com/ubuntu jammy-security InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
E: The repository 'http://security.ubuntu.com/ubuntu jammy-security InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: http://archive.ubuntu.com/ubuntu/dists/jammy/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg are ignored as the file is not readable by user '_apt' executing apt-key.
W: http://archive.ubuntu.com/ubuntu/dists/jammy/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg are ignored as the file is not readable by user '_apt' executing apt-key.
W: GPG error: http://archive.ubuntu.com/ubuntu jammy InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
E: The repository 'http://archive.ubuntu.com/ubuntu jammy InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: http://archive.ubuntu.com/ubuntu/dists/jammy-updates/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg are ignored as the file is not readable by user '_apt' executing apt-key.
W: http://archive.ubuntu.com/ubuntu/dists/jammy-updates/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg are ignored as the file is not readable by user '_apt' executing apt-key.
W: GPG error: http://archive.ubuntu.com/ubuntu jammy-updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
E: The repository 'http://archive.ubuntu.com/ubuntu jammy-updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: http://archive.ubuntu.com/ubuntu/dists/jammy-backports/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg are ignored as the file is not readable by user '_apt' executing apt-key.
W: http://archive.ubuntu.com/ubuntu/dists/jammy-backports/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg are ignored as the file is not readable by user '_apt' executing apt-key.
W: GPG error: http://archive.ubuntu.com/ubuntu jammy-backports InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
E: The repository 'http://archive.ubuntu.com/ubuntu jammy-backports InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Problem executing scripts APT::Update::Post-Invoke 'rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true'
E: Sub-process returned an error code

[shivpatel1]

@tholu : I am not sure what is causing it at your end. Because the same is working for me. Below is the snippet just taken in one of my machine.

[tholu]

@shivpatel1 That is so weird, since I run the exact same version:

# docker -v
Docker version 19.03.15, build 99e3ed8919

Kernel: 4.9.0-19-amd64 #1 SMP Debian 4.9.320-2 (2022-06-30) x86_64 GNU/Linux
Debian 9.13

So much about reproducibility 😅