adding a PPA key in pbuilder fails

[Rolf Leggewie]

I am trying to add the GPG key for my "stable" PPA (https://launchpad.net/~r0lf/+archive/stable/) to one of my pbuilders This works fine outside the chroot but fails inside the pbuilder. Both the host and the pbuilder chroot are lucid. Here's what I do.

$ sudo pbuilder --login --save-after-login
[...] #pbuilder starts up
 # apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 15331454B72FD7EC
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver keyserver.ubuntu.com --recv-keys 15331454B72FD7EC
gpg: requesting key B72FD7EC from hkp server keyserver.ubuntu.com
gpgkeys: key 15331454B72FD7EC not found on keyserver
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0
# gpg import --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg /tmp/gpg.txt
gpg: fatal: can't create directory `/home/rolf/.gnupg': No such file or directory
secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768
# aptitude search ~i\!~M
i apt - Advanced front-end for dpkg
i aptitude - terminal-based package manager
i build-essential - Informational list of build-essential packages
i debhelper - helper programs for debian/rules
i dpkg-dev - Debian package development tools
i less - pager program similar to more
i libcapi20-3 - ISDN utilities - CAPI support libraries
i libcapi20-dev - ISDN utilities - CAPI development libraries
i nano - small, friendly text editor inspired by Pico
i sudo - Provide limited super user privileges to specific users

The second command was a desperate attempt to install the gpg key directly. The last command shows which packages are explicitly installed. My gut feeling tells me there is a package missing in a normal pbuilder installation for gpg to work and make a connection here, but of course, the problem could be elsewhere.

JFTR: The key exists of course on the keyserver in question. The apt-key command outside the pbuilder chroot works just fine. Try it!

Command in question run directly on the host:
$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 15331454B72FD7EC
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver keyserver.ubuntu.com --recv-keys 15331454B72FD7EC
gpg: requesting key B72FD7EC from hkp server keyserver.ubuntu.com
gpg: key B72FD7EC: public key "Launchpad PPA for Rolf Leggewie" imported
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)

Link to the key which of course is available
http://keyserver.ubuntu.com:11371/pks/lookup?search=0x14C966D8AC5F7A9119DD574315331454B72FD7EC&op=index

[Michael Bienia (geser)]

I can't reproduce it.
As I didn't use my lucid pbuilder for some time, I updated it before I tried it (note: I use a precise host).

# apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 15331454B72FD7EC
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver keyserver.ubuntu.com --recv-keys 15331454B72FD7EC
gpg: keyring `/etc/apt/secring.gpg' created
gpg: requesting key B72FD7EC from hkp server keyserver.ubuntu.com
gpg: /etc/apt/trustdb.gpg: trustdb created
gpg: key B72FD7EC: public key "Launchpad PPA for Rolf Leggewie" imported
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
# apt-key list
/etc/apt/trusted.gpg
--------------------
pub 1024D/437D05B5 2004-09-12
uid Ubuntu Archive Automatic Signing Key <email address hidden>
sub 2048g/79164387 2004-09-12

pub 1024R/B72FD7EC 2009-01-19
uid Launchpad PPA for Rolf Leggewie

[Rolf Leggewie (r0lf)]

Unfortunately, the situation is still unchanged and not improved here. Thanks for trying it out.

[Rolf Leggewie (r0lf)]

Situation is still the same. HELP, please!

[Rolf Leggewie (r0lf)]

Found the culprit: apt-cacher-ng which I use as a local cache

From the log:
Sun Mar 2 09:39:23 2014|Returning to last state, 1
Sun Mar 2 09:40:26 2014|Detected incoming connection from the TCP socket
Sun Mar 2 09:40:26 2014|Client name: ::1
Sun Mar 2 09:40:26 2014|Raw request URI: http://keyserver.ubuntu.com:11371/pks/lookup?op=get&options=mr&search=0x15331454B72FD7EC
Sun Mar 2 09:40:26 2014|Prepared response header for user:
HTTP/1.1 403 Prohibited port or config error (double proxy)
Content-Length: 216
Content-Type: text/html
Date: Sun Mar 2 01:40:26 2014
Server: Debian Apt-Cacher NG/0.7.2
Connection: close

apt-cacher-ng is version 0.7.2-1ubuntu2.1 from precise-updates

[Rolf Leggewie (r0lf)]

Here's the remedy for the next guy who runs into this issue, just run

http_proxy="" apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 15331454B72FD7EC

inside the pbuilder chroot.

[Rolf Leggewie (r0lf)]

Eduard, should apt-cacher-ng allow downloading of gpg keys or should this one be dealt with differently?

[Rubberneck (rubberneck)]

apt-add-repository is also broken because it trys to add a key from keyserver.ubuntu.com.

command "apt-add-repository ppa:fo0bar/rpi2"
gpg: keyring `/tmp/tmpkwiw1gyj/secring.gpg' created
gpg: keyring `/tmp/tmpkwiw1gyj/pubring.gpg' created
gpg: requesting key A80602AF from hkp server keyserver.ubuntu.com
gpgkeys: key 727F27B6D2CFD561F5E93193AD99EC7BA80602AF can't be retrieved
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

The error log shows
1427482304|E|701|192.168.85.169|403 Forbidden file type or location: http://keyserver.ubuntu.com:80/pks/lookup?op=get&options=mr&search=0x727F27B6D2CFD561F5E93193AD99EC7BA80602AF

[Rolf Leggewie (r0lf)]

Rubberneck, to make sure you actually experiencing the same issue, are you indeed using apt-cacher-ng for your pbuilder chroots?

[Eduard Bloch (edi-gmx)]

It looks like a regular REST call so the probably easiest fix would be to extend the regex matching the volatile data URLs. If you have a recent version, add something like

VfilePatternEx: /pks/lookup.op.get

and for an older version, add a modified version of VfilePattern, maybe something like:

VfilePattern = (^|.*/)(Index|Packages(\\.gz|\\.bz2|\\.lzma|\\.xz)?|InRelease|Release|mirrors\\.txt|.*\\.gpg|NEWS\\.Debian|Sources(\\.gz|\\.bz2|\\.lzma|\\.xz)?|release|index\\.db-.*\\.gz|Contents-[^/]*(\\.gz|\\.bz2|\\.lzma|\\.xz)?|pkglist[^/]*\\.bz2|rclist[^/]*\\.bz2|meta-release[^/]*|Translation[^/]*(\\.gz|\\.bz2|\\.lzma|\\.xz)?|MD5SUMS|SHA256SUMS|SHA1SUMS|((setup|setup-legacy)(\\.ini|\\.bz2|\\.hint)(\\.sig)?)|mirrors\\.lst|repo(index|md)\\.xml(\\.asc|\\.key)?|directory\\.yast|products|content(\\.asc|\\.key)?|media|filelists\\.xml\\.gz|filelists\\.sqlite\\.bz2|repomd\\.xml|packages\\.[a-zA-Z][a-zA-Z]\\.gz|info\\.txt|license\\.tar\\.gz|license\\.zip|.*\\.(db|files|abs)(\\.tar(\\.gz|\\.bz2|\\.lzma|\\.xz))?|metalink\\?repo|.*prestodelta\\.xml\\.gz|repodata/.*\\.(xml|sqlite)(\\.gz|\\.bz2|\\.lzma|\\.xz)?|\\.treeinfo|vmlinuz|(initrd|product|squashfs|updates)\\.img)$|/dists/.*/installer-[^/]+/[^0-9][^/]+/images/.*|/pks/lookup.op.get