Yarn GPG key expiry prevents running apt

[Apreche]

Create a very simple Dockerfile like this:

ARG VARIANT=3.8
FROM mcr.microsoft.com/devcontainers/python:0-${VARIANT}
RUN apt-get update

If you try to build this with docker build . you will get the error:

user@localhost $ docker build .
[+] Building 1.7s (5/5) FINISHED                                                                                                     
 => [internal] load build definition from Dockerfile                                                                            0.0s
 => => transferring dockerfile: 135B                                                                                            0.0s
 => [internal] load .dockerignore                                                                                               0.0s
 => => transferring context: 2B                                                                                                 0.0s
 => [internal] load metadata for mcr.microsoft.com/devcontainers/python:0-3.8                                                   0.3s
 => CACHED [1/2] FROM mcr.microsoft.com/devcontainers/python:0-3.8@sha256:619df220ed3f7c91e96785e8794c1b7ac7af8c27e50be16c8f08  0.0s
 => ERROR [2/2] RUN apt-get update                                                                                              1.4s
------                                                                                                                               
 > [2/2] RUN apt-get update:                                                                                                         
#5 0.190 Get:1 http://deb.debian.org/debian bullseye InRelease [116 kB]                                                              
#5 0.198 Get:2 https://dl.yarnpkg.com/debian stable InRelease [17.1 kB]                                                              
#5 0.227 Get:3 http://deb.debian.org/debian-security bullseye-security InRelease [48.4 kB]                                           
#5 0.242 Get:4 http://deb.debian.org/debian bullseye-updates InRelease [44.1 kB]                                                     
#5 0.246 Err:2 https://dl.yarnpkg.com/debian stable InRelease
#5 0.246   The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
#5 0.330 Get:5 http://deb.debian.org/debian bullseye/main arm64 Packages [8072 kB]
#5 0.536 Get:6 http://deb.debian.org/debian-security bullseye-security/main arm64 Packages [211 kB]
#5 0.558 Get:7 http://deb.debian.org/debian bullseye-updates/main arm64 Packages [12.0 kB]
#5 1.142 Reading package lists...
#5 1.375 W: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
#5 1.375 E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.
------
executor failed running [/bin/sh -c apt-get update]: exit code: 100

An issue for this error can be seen here:
yarnpkg/yarn#7866

Attempts to use any of the solutions such as:

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - 

sudo apt-key adv --refresh-keys --keyserver keyserver.ubuntu.com

or

wget -qO - https://raw.githubusercontent.com/yarnpkg/releases/gh-pages/debian/pubkey.gpg | sudo apt-key add -

prior to the apt-get update do not fix the problem.

You can see here:
https://github.com/yarnpkg/releases/blob/gh-pages/debian/pubkey.gpg
The pubkey was updated 13 hours ago as of the time of this posting. Even that brand new key does not seem to work.

I consider this issue to be quite urgent as it completely prevents me from building my VSCode Python dev environment. I can't get any work done unless I come up with a new environment using a different docker base image.

[rafaelfranca]

Same thing is happening in the Ruby image.

[sreid99]

Same thing is happening in the Ruby image.

Same - Ruby 3.1-bullseye

[jvdavim]

Just use curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -, which fixed it here.

Debian from bullseye has deprecated apt-key.

Ref.: https://manpages.debian.org/bullseye/apt/apt-key.8.en.html

[Apreche]

Just use curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -, which fixed it here.

As I explained in the original post, this did not fix the problem for me.

user@localhost $ cat Dockerfile 
ARG VARIANT=3.11
FROM mcr.microsoft.com/devcontainers/python:0-${VARIANT}
RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -
RUN apt-get update
user@localhost $ docker build --no-cache .
[+] Building 2.2s (6/6) FINISHED                                                                                                     
 => [internal] load build definition from Dockerfile                                                                            0.0s
 => => transferring dockerfile: 37B                                                                                             0.0s
 => [internal] load .dockerignore                                                                                               0.0s
 => => transferring context: 2B                                                                                                 0.0s
 => [internal] load metadata for mcr.microsoft.com/devcontainers/python:0-3.11                                                  0.1s
 => CACHED [1/3] FROM mcr.microsoft.com/devcontainers/python:0-3.11@sha256:1aaa54bf036f6d49ec3afe4688eae0c2b75f7f0e4e7526af037  0.0s
 => [2/3] RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -                                            0.5s
 => ERROR [3/3] RUN apt-get update                                                                                              1.5s 
------                                                                                                                               
 > [3/3] RUN apt-get update:                                                                                                         
#6 0.343 Get:1 https://dl.yarnpkg.com/debian stable InRelease [17.1 kB]                                                              
#6 0.354 Get:2 http://deb.debian.org/debian bullseye InRelease [116 kB]                                                              
#6 0.388 Get:3 http://deb.debian.org/debian-security bullseye-security InRelease [48.4 kB]                                           
#6 0.397 Err:1 https://dl.yarnpkg.com/debian stable InRelease                                                                        
#6 0.397   The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
#6 0.401 Get:4 http://deb.debian.org/debian bullseye-updates InRelease [44.1 kB]
#6 0.488 Get:5 http://deb.debian.org/debian bullseye/main arm64 Packages [8072 kB]
#6 0.660 Get:6 http://deb.debian.org/debian-security bullseye-security/main arm64 Packages [212 kB]
#6 0.717 Get:7 http://deb.debian.org/debian bullseye-updates/main arm64 Packages [12.0 kB]
#6 1.264 Reading package lists...
#6 1.493 W: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
#6 1.493 E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.
------
executor failed running [/bin/sh -c apt-get update]: exit code: 100

[Chuxel]

Yarn's key must have just expired, so the images need to be rev'd to get the latest key. Tactically, you can update the key or remove the yarn source to work around this. e.g., in a Dockerfile

To update the key (now that apt-key is deprecated):

RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor > /usr/share/keyrings/yarn-archive-keyring.gpg

Or to remove the source

RUN rm -f /etc/apt/sources.list.d/yarn.list

[samruddhikhandale]

Created #371 to prep for an images release. It will rebuild and release the new images with an updated Yarn key.

[mathieujobin]

I tried putting the key in /usr/share as suggested above.
curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor > /usr/share/keyrings/yarn-archive-keyring.gpg
and also cp /usr/share/keyrings/yarn-archive-keyring.gpg /etc/apt/trusted.gpg.d/

but apt update still complains, on Ubuntu 22.04 LTS

[Chuxel]

I tried putting the key in /usr/share as suggested above. curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor > /usr/share/keyrings/yarn-archive-keyring.gpg and also cp /usr/share/keyrings/yarn-archive-keyring.gpg /etc/apt/trusted.gpg.d/

but apt update still complains, on Ubuntu 22.04 LTS

@mathieujobin What Dev Container image are you using? The location of this file can vary - this is just where the ones in devcontainers/images or when using the "Node" Dev Container Feature place it. e.g., from the command line for Ruby:

❯ docker run -it --rm mcr.microsoft.com/devcontainers/ruby bash
root ➜ / $ curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor > /usr/share/keyrings/yarn-archive-keyring.gpg
root ➜ / $ apt-get update
Get:1 http://deb.debian.org/debian bullseye InRelease [116 kB]
Get:2 http://deb.debian.org/debian-security bullseye-security InRelease [48.4 kB]
Get:3 http://deb.debian.org/debian bullseye-updates InRelease [44.1 kB]
Get:4 http://deb.debian.org/debian bullseye/main amd64 Packages [8183 kB]
Get:5 https://dl.yarnpkg.com/debian stable InRelease [17.1 kB]
Get:6 https://dl.yarnpkg.com/debian stable/main amd64 Packages [10.9 kB]
Get:7 https://dl.yarnpkg.com/debian stable/main all Packages [10.9 kB]
Get:8 http://deb.debian.org/debian-security bullseye-security/main amd64 Packages [216 kB]
Get:9 http://deb.debian.org/debian bullseye-updates/main amd64 Packages [14.6 kB]
Fetched 8661 kB in 2s (3517 kB/s)
Reading package lists... Done
root ➜ / $

Older instructions will use apt-key as described in the upstream yarn issue and referenced above. So your custom image may be doing that instead.

Good news is it looks like the new key is valid until 2026.

[samruddhikhandale]

The images release is still in progress, however, new images for "Python" & "Ruby" are published. The issue should be fixed for these two images.

@Apreche / @sreid99 Can you rebuild and try again?