Add GPG keys to `/apt/keyrings` instead of `/apt/trusted.gpg.d`, Update task `Add Docker apt key` #436

kawadeomkar · 2023-11-17T04:01:22Z

I started this issue because I faced a similar problem as #434
when adding the docker apt repository
Signed-By regarding source https://download.docker.com/linux/ubuntu/ jammy: │ /etc/apt/trusted.gpg.d/docker.asc != ,
Which I then had to fix by:

sudo rm /etc/apt/sources.list.d/docker.list
sudo rm /etc/apt/sources.list.d/download_docker_com_linux_ubuntu.list

and then running the changes in this branch.

I did some research and noticed that GPG keys should not be placed in /etc/apt/trusted.gpg.d/ (please see #435)

After updating the tasks to mirror the installation method in https://docs.docker.com/engine/install/debian/#install-using-the-repository, I was still getting an error:

W: GPG error: https://download.docker.com/linux/ubuntu jammy InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7EA0A9C3F273FCD8
E: The repository 'https://download.docker.com/linux/ubuntu jammy InRelease' is not signed.

until I noticed that the task here

ansible-role-docker/tasks/setup-Debian.yml

Line 30 in 8ff4a24

- name: Add Docker apt key.

was saving the GPG key in binary whereas in the docker docs, the key is converted to an ASCII-encoded format.

I updated the ansible tasks to use the fallback curl/shell method and added a few more tasks to mirror the installation method of the docker docs.

With these changes, I'm not getting any errors and able to successfully run the role on version 7.0.2.

@geerlingguy (or any maintainer) Please let me know what you think of these changes:

whether the GPG keys should be saved to /etc/apt/keyrings (as per docker) or /usr/share/keyrings (as per debian)
If the tasks proposed in this PR are sufficient
If using the task ansible.builtin.get_url is preferred, I believe a task like this might be required as well directly afterwards:

- name: Dearmor Docker GPG key
  ansible.builtin.command: gpg --dearmor /etc/apt/keyrings/docker.gpg

bryion · 2023-11-17T04:56:31Z

This worked for me!

kawadeomkar · 2023-11-17T06:00:10Z

tasks/setup-Debian.yml

- curl -sSL {{ docker_apt_gpg_key }} | apt-key add -
- when: add_repository_key is failed and docker_add_repo | bool
+ curl -fsSL {{ docker_apt_gpg_key }} | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg --yes
+ changed_when: false


not sure of a way around this

Yes, there is: https://stackoverflow.com/questions/71585303/how-can-i-manage-keyring-files-in-trusted-gpg-d-with-ansible-playbook-since-apt

You can just skip the gpg --dearmor and save the file directly into /etc/apt/keyrings/ with a .asc extension. This means you can skip the shell module completely and only use get_url.

Really all that needs to be changed here is the dest: /etc/apt/trusted.gpg.d/docker.asc from the Add Docker apt key. task needs to be dest: /etc/apt/keyrings/docker.asc instead.

jantari · 2023-11-29T10:06:21Z

This also affects Ubuntu.

~~@geerlingguy sorry for the ping but this role is currently not only not working, every time it is used and rolled out it re-breaks the docker repositories and apt update on existing machines.~~

EDIT:

Actually, although the /etc/apt/trusted.gpg.d/ path used by this role is outdated, it still works because the path to the keyfile is hardcoded into the apt repository source file:

ansible-role-docker/defaults/main.yml

Line 41 in 8ff4a24

 docker_apt_repository: "deb [arch={{ docker_apt_arch }} signed-by=/etc/apt/trusted.gpg.d/docker.asc] {{ docker_repo_url }}/{{ docker_apt_ansible_distribution | lower }} {{ ansible_distribution_release }} {{ docker_apt_release_channel }}" 

so this doesn't even have to necessarily be changed yet. All I had to do was delete the /etc/apt/sources.list.d/download_docker_com_linux_ubuntu.list file that was on that machine and caused the conflict. But I have no idea where that file (duplicate reference to the docker repo) came from.

EDIT2:

Yea okay I see now this was discussed in #434. The filename was changed in c3a1271. This is a breaking change as we see by these issues and PRs, but to be fair it was changed when going from role version 6.2.0 to 7.0.0 so a new major version.

All is well if you pin your role versions and read through every commit and diff before updating...

geerlingguy · 2023-11-29T17:41:10Z

See: https://www.jeffgeerling.com/blog/2022/aptkey-deprecated-debianubuntu-how-fix-ansible as well...

kawadeomkar · 2023-11-30T23:40:29Z

Thank you @jantari and @geerlingguy for the information. I will update this PR and @ you again when it is ready.

kawadeomkar · 2023-12-18T21:04:32Z

Hello, apologies for the delay. I was out on vacation with limited internet connectivity. I've updated the PR to only contain edits to save to /apt/keyrings using the original get_url ansible command. @jantari Please take a look whenever you get the chance, thanks!

rizlas · 2024-01-05T15:20:01Z

This also fix raspbian compatibility.
For raspbian it is also need to change these variables:

docker_apt_arch: armhf
docker_apt_ansible_distribution: raspbian

https://docs.docker.com/engine/install/raspberry-pi-os/#install-using-the-repository

kawadeomkar · 2024-02-01T00:21:19Z

@geerlingguy sorry for the tag but could you take a look whenever you get a chance? Thanks

mihalt · 2024-03-29T18:26:03Z

@geerlingguy sorry for the tag but could you take a look whenever you get a chance? Thanks

it would be pritty wonderful. I've got the same problem. Very wait when it will be merged

jamesmyatt · 2024-05-26T12:15:40Z

LGTM. Docker install script also uses /etc/apt/keyrings.

Motivation ---------- We were running into geerlingguy/ansible-role-docker#436 It seems we just have to uninstall the pip packages and remove these files: ``` sudo rm /etc/apt/sources.list.d/docker.list sudo rm /etc/apt/sources.list.d/download_docker_com_linux_ubuntu.list ``` How to test ----------- 1. Remove the files 2. Run the ansible playbook 3. `docker-compose` should be uninstalled 4. `docker compose` should be on v2

…g /etc/apt/keyrings/docker.asc key Related to: - #3337 - geerlingguy/ansible-role-docker#436

…or old installations Related to: - spantaleev/matrix-docker-ansible-deploy#3337 - geerlingguy/ansible-role-docker#436 - spantaleev/matrix-docker-ansible-deploy@3a4e58c

…g /etc/apt/keyrings/docker.asc key Related to: - spantaleev#3337 - geerlingguy/ansible-role-docker#436

kawadeomkar added 2 commits November 16, 2023 18:59

434 Add GPG keys to keyrings instead of trusted.gpg.d

1dca071

435 Update apt key ansible task

12ad263

bryion added a commit to bryion/ansible-minerva that referenced this pull request Nov 17, 2023

update geerlingguy.docker,7.0.2 geerlingguy/ansible-role-docker#436

8855c36

kawadeomkar added 2 commits November 16, 2023 21:14

434 changed_when false for adding docker apt key shell cmd

ae29f9f

435 ansible-lint

6cb849c

kawadeomkar mentioned this pull request Nov 17, 2023

Failure when adding docker repository #434

Open

kawadeomkar commented Nov 17, 2023

View reviewed changes

kawadeomkar added 2 commits December 18, 2023 11:06

434 update apt key destination

08ae86e

434 remove permissions update, add reverse compatibility

d8f92e1

kawadeomkar requested a review from jantari December 18, 2023 21:02

jamesmyatt mentioned this pull request May 26, 2024

gnupg no longer prerequisite #456

Merged

Merge branch 'master' into kawade/fix-434

1f1f5cd

geerlingguy merged commit 13dfcf7 into geerlingguy:master May 27, 2024
1 of 3 checks passed

spantaleev added a commit to spantaleev/matrix-docker-ansible-deploy that referenced this pull request May 28, 2024

Add migration task for Debiant apt repositories for Docker referencin…

3a4e58c

…g /etc/apt/keyrings/docker.asc key Related to: - #3337 - geerlingguy/ansible-role-docker#436

This was referenced May 30, 2024

Recent role update does not remove previous versions of the apt key, and so duplicate apt keys are created on Debian #460

Closed

Remove trusted.gpg.d artifacts. #461

Merged

Remove trusted.gpg.d artifacts gluckgames/ansible-role-docker#1

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add GPG keys to `/apt/keyrings` instead of `/apt/trusted.gpg.d`, Update task `Add Docker apt key` #436

Add GPG keys to `/apt/keyrings` instead of `/apt/trusted.gpg.d`, Update task `Add Docker apt key` #436

kawadeomkar commented Nov 17, 2023 •

edited

Loading

bryion commented Nov 17, 2023

kawadeomkar Nov 17, 2023

jantari Nov 29, 2023

jantari Nov 29, 2023

jantari commented Nov 29, 2023 •

edited

Loading

geerlingguy commented Nov 29, 2023

kawadeomkar commented Nov 30, 2023

kawadeomkar commented Dec 18, 2023

rizlas commented Jan 5, 2024

kawadeomkar commented Feb 1, 2024

mihalt commented Mar 29, 2024 •

edited

Loading

jamesmyatt commented May 26, 2024 •

edited

Loading

Add GPG keys to /apt/keyrings instead of /apt/trusted.gpg.d, Update task Add Docker apt key #436

Add GPG keys to /apt/keyrings instead of /apt/trusted.gpg.d, Update task Add Docker apt key #436

Conversation

kawadeomkar commented Nov 17, 2023 • edited Loading

bryion commented Nov 17, 2023

kawadeomkar Nov 17, 2023

Choose a reason for hiding this comment

jantari Nov 29, 2023

Choose a reason for hiding this comment

jantari Nov 29, 2023

Choose a reason for hiding this comment

jantari commented Nov 29, 2023 • edited Loading

geerlingguy commented Nov 29, 2023

kawadeomkar commented Nov 30, 2023

kawadeomkar commented Dec 18, 2023

rizlas commented Jan 5, 2024

kawadeomkar commented Feb 1, 2024

mihalt commented Mar 29, 2024 • edited Loading

jamesmyatt commented May 26, 2024 • edited Loading

Add GPG keys to `/apt/keyrings` instead of `/apt/trusted.gpg.d`, Update task `Add Docker apt key` #436

Add GPG keys to `/apt/keyrings` instead of `/apt/trusted.gpg.d`, Update task `Add Docker apt key` #436

kawadeomkar commented Nov 17, 2023 •

edited

Loading

jantari commented Nov 29, 2023 •

edited

Loading

mihalt commented Mar 29, 2024 •

edited

Loading

jamesmyatt commented May 26, 2024 •

edited

Loading