Regression: snapcraft started failing with craft_archives.repo.errors.AptGPGKeyInstallError #4224

basak · 2023-06-20T12:20:27Z

Bug Description

On Friday git-ubuntu CI regressed. It uses the stable snapcraft snap.

It seems that something was switched that caused it to start failing with an error from inside craft-archives. See canonical/craft-archives#83 for details.

To Reproduce

In a Focal lxd container, running as the ubuntu user (eg. lxc launch ubuntu:focal test-container && lxc shell test-container and then login -f ubuntu):

git clone https://git.launchpad.net/git-ubuntu
git checkout 8f0d8e5
sh snap.sh

Environment

Snapcraft is in destructive mode inside a lxd container.

snapcraft.yaml

See https://git.launchpad.net/git-ubuntu/tree/snap/snapcraft.yaml although note that snap.sh modifies it slightly to work around LP: #1918968. See that script for details.

Relevant log output

File "/snap/snapcraft/9362/lib/python3.8/site-packages/snapcraft_legacy/internal/project_loader/_config.py", line 304, in get_build_packages
    self.install_package_repositories()
  File "/snap/snapcraft/9362/lib/python3.8/site-packages/snapcraft_legacy/internal/project_loader/_config.py", line 288, in install_package_repositories
    refresh_required |= key_manager.install_package_repository_key(
  File "/snap/snapcraft/9362/lib/python3.8/site-packages/craft_archives/repo/apt_key_manager.py", line 257, in install_package_repository_key
    self.install_key(key=key_path.read_text())
  File "/snap/snapcraft/9362/lib/python3.8/site-packages/craft_archives/repo/apt_key_manager.py", line 170, in install_key
    raise errors.AptGPGKeyInstallError(
craft_archives.repo.errors.AptGPGKeyInstallError: Failed to install GPG key: Key must be a single key, not multiple.

Additional context

No response

The text was updated successfully, but these errors were encountered:

basak · 2023-06-20T13:37:25Z

Dropping the subkey (thereby diverging from gpg's default) works around the issue. This is how I'm now generating the key:

gpg --batch --gen-key <<EOF
%no-protection
Key-Type:1
Key-Length:2048
Name-Real: git-ubuntu build script apt repo
Name-Email: [email protected]
Expire-Date:0
EOF

git-ubuntu MP: https://code.launchpad.net/~racb/git-ubuntu/+git/usd-importer/+merge/445060

cparich · 2023-06-22T22:07:49Z

I was able to work around this issue by reverting to snapcraft 9201 and deleting the base lxc container (base-instance-snapcraft-buildd-base-v00--a12c0d0071c13c372948 for me)

Ecophagy · 2023-06-23T14:51:12Z

We are also getting this as we add puppet bolt via the package-repositories directive and a .asc key file. Snapcraft immediately fails with Failed to install GPG key: Key must be a single key, not multiple. and then the prompted "please report this" fails with Encountered an issue while trying to submit the report: unhashable type: 'AptGPGKeyInstallError'.

snapcraft version is 7.4.3, Rev 9362

tigarmo · 2023-06-23T14:54:29Z

@cparich and @Ecophagy can you tell me which package repositories and keys you're using?

Ecophagy · 2023-06-23T15:03:23Z

from snapcraft.yaml:

package-repositories:
        - type: apt # puppet bolt
          components: [puppet-tools]
          suites: [focal]
          url: http://apt.puppet.com
          key-id: D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26

.asc file contents:

tigarmo · 2023-06-23T15:14:01Z

Thanks. Does it work if you remove the local keyfile from the snap/keys/ directory?

Ecophagy · 2023-06-23T15:40:58Z

Thanks. Does it work if you remove the local keyfile from the snap/keys/ directory?

That does seem to work, yes. Certainly suggests the issue is around parsing the keyfile.

I am slightly surprised it built because I did need to have the keyfile locally originally (~8 months ago), but maybe something has changed on the repository side...

basak · 2023-06-23T15:53:13Z

The root cause is understood - I explained it in canonical/craft-archives#83

cparich · 2023-06-23T15:53:43Z

My snaps currently deploy packages from an internal company server

from snapcraft.yaml

package-repositories:
  - type: apt
    components: [main]
    suites: [jammy]
    key-id: 610D1E5B8B34C94B170550397B9C0A650264B26D
    url: ***

from snap/keys/0264B26D.asc

tigarmo · 2023-06-23T16:10:52Z

Thanks. Does it work if you remove the local keyfile from the snap/keys/ directory?

That does seem to work, yes. Certainly suggests the issue is around parsing the keyfile.

I am slightly surprised it built because I did need to have the keyfile locally originally (~8 months ago), but maybe something has changed on the repository side...

Maybe the key only got uploaded to keyserver.ubuntu.com recently?

Regardless, as @basak says the cause of the error is known and I was just trying to see if we can get workarounds for individual cases. We'll do a 7.4.4 hotfix to address this.

The new version supports asset files that contain more than one key (for whatever reason). This is more in line with the behavior done by the previous implementation (via apt-key). Closes canonical#4224

The new version supports asset files that contain more than one key (for whatever reason). This is more in line with the behavior done by the previous implementation (via apt-key). Closes #4224

tigarmo · 2023-06-29T15:05:25Z

Hi everyone. I put up a fix that should address this specific issue (Key must be a single key, not multiple.). @basak , @Ecophagy , @cparich if you have a chance could you give it a try? It's:

snap install --classic --channel=edge/pr-4241 snapcraft

@basak this only addresses the multiple-keys issue, and not the "needs sudo" issue.

basak · 2023-06-30T09:37:32Z

I get a new error now:

Sorry, an error occurred in Snapcraft:
1 validation error for PackageRepositoryApt 
url
  URL host invalid (type=value_error.url.host)

Full trace: https://paste.ubuntu.com/p/KWzBHvvNSn/

Full steps to reproduce:

lxc launch ubuntu:focal rbasak-gpg-apt
lxc exec rbasak-gpg-apt bash
login -f ubuntu
git clone https://git.launchpad.net/git-ubuntu
# DIsable the workaround for this regression
git revert 12095594fb4508089bb2c52cf6a2500d6c693f3e
vi snap.sh
# Add --channel=edge/pr-4241 when installing snapcraft
sh snap.sh

I also verified that I got the previous failure as expected if I just use the default stable channel.

cparich · 2023-06-30T13:58:35Z

It appears to work for me:

$ snapcraft clean
Cleaned build provider 
$ snapcraft --verbosity verbose
Starting Snapcraft 7.4.3.post8+gitbe557406                                                          
Logging execution to '*'  
Running on amd64 for amd64                                                                          
Launching instance...                                                                               
Checking for instance '*' in project 'snapcraft' in remote 'local'                                                                                           
Instance '*' does not exist.                            
Checking for base instance 'base-instance-snapcraft-buildd-base-v10--2d55678e0339df02cd48' in project 'snapcraft' in remote 'local'                                                                      
Creating instance from base instance 'base-instance-snapcraft-buildd-base-v10--2d55678e0339df02cd4… 
Starting instance.                                                                                  
Starting Snapcraft 7.4.3.post8+gitbe557406                                                          
Logging execution to '/tmp/snapcraft.log'                                                           
Running on amd64 for amd64                                                                          
Initializing parts lifecycle                                                                        
Installing package repositories...                                                                  
Refreshing package repositories...                                                                  
Installed package repositories   
Executing parts lifecycle...                                                                        
...

2023-06-30 08:51:26.483 Revisions found: host='9425', target='9425'
2023-06-30 08:57:25.100 :: 2023-06-30 13:51:30.784 Starting Snapcraft 7.4.3.post8+gitbe557406

The new version supports asset files that contain more than one key (for whatever reason). This is more in line with the behavior done by the previous implementation (via apt-key). Closes #4224

sergio-costas · 2023-07-19T17:04:12Z

It's failing for me when I try to build this snap: https://raw.githubusercontent.com/snapcore/snapd/cca5d8f1db88131d6de8e469fc0b6a10d1f9b3a1/tests/lib/snaps/store/test-snapd-layout-change-with-daemon/snapcraft_old.yaml

It is a cut version of the steam snap, which also fails with the same error:

Installing package repositories...                                                                                                                                                                                
Failed to install GPG key: Key must be a single key, not multiple.                                                                                                                                                
Failed to execute pack in instance.

I tried also with edge version (7.4.3.post49+gitdbe76f21) but still fails.

sergio-costas · 2023-07-19T17:40:21Z

Tried to compile directly from "master", but also fails.

kenvandine · 2023-07-25T15:13:13Z

Any news on when this fix will make it into a released snapcraft?

basak added the bug Actual bad behavior that don't fall into maintenance or documentation label Jun 20, 2023

basak mentioned this issue Jun 20, 2023

Regression: snapcraft "apt" package-repositories feature fails in destructive mode #4225

Closed

tigarmo mentioned this issue Jun 27, 2023

requirements: bump craft-archives to fix regression #4235

Closed

tigarmo mentioned this issue Jun 30, 2023

"url" field no longer accepts local paths canonical/craft-archives#92

Closed

sergiusens closed this as completed in 586a9fe Aug 4, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Regression: snapcraft started failing with craft_archives.repo.errors.AptGPGKeyInstallError #4224

Regression: snapcraft started failing with craft_archives.repo.errors.AptGPGKeyInstallError #4224

basak commented Jun 20, 2023 •

edited

Loading

basak commented Jun 20, 2023

cparich commented Jun 22, 2023

Ecophagy commented Jun 23, 2023

tigarmo commented Jun 23, 2023

Ecophagy commented Jun 23, 2023

tigarmo commented Jun 23, 2023

Ecophagy commented Jun 23, 2023 •

edited

Loading

basak commented Jun 23, 2023

cparich commented Jun 23, 2023

tigarmo commented Jun 23, 2023

tigarmo commented Jun 29, 2023

basak commented Jun 30, 2023

cparich commented Jun 30, 2023 •

edited

Loading

sergio-costas commented Jul 19, 2023

sergio-costas commented Jul 19, 2023

kenvandine commented Jul 25, 2023

Regression: snapcraft started failing with craft_archives.repo.errors.AptGPGKeyInstallError #4224

Regression: snapcraft started failing with craft_archives.repo.errors.AptGPGKeyInstallError #4224

Comments

basak commented Jun 20, 2023 • edited Loading

Bug Description

To Reproduce

Environment

snapcraft.yaml

Relevant log output

Additional context

basak commented Jun 20, 2023

cparich commented Jun 22, 2023

Ecophagy commented Jun 23, 2023

tigarmo commented Jun 23, 2023

Ecophagy commented Jun 23, 2023

tigarmo commented Jun 23, 2023

Ecophagy commented Jun 23, 2023 • edited Loading

basak commented Jun 23, 2023

cparich commented Jun 23, 2023

tigarmo commented Jun 23, 2023

tigarmo commented Jun 29, 2023

basak commented Jun 30, 2023

cparich commented Jun 30, 2023 • edited Loading

sergio-costas commented Jul 19, 2023

sergio-costas commented Jul 19, 2023

kenvandine commented Jul 25, 2023

basak commented Jun 20, 2023 •

edited

Loading

Ecophagy commented Jun 23, 2023 •

edited

Loading

cparich commented Jun 30, 2023 •

edited

Loading