Incorrect GPG signature file during autoinstall when using custom GPG key
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
subiquity (Ubuntu) |
Triaged
|
Medium
|
Unassigned |
Bug Description
When using an APT mirror that creates its own GPG keys to sign the files (such as APTLY), and then attempting to use that in an autoinstall file for subiquity, although we provide the GPG key in the autoinstall yaml, it still uses the incorrect GPG key in sources.list.
In my APTLY environment example, I provide this snippet in my autoinstall user-data:
...
apt:
primary:
- arches: [amd64, i386, default]
uri: http://
security:
- arches: [amd64, i386, default]
uri: http://
geoip: false
disable_
disable_
conf: | # APT config
sources:
# source: "http://
key: | # full key as block
< . . . Content of the GPG key . . . :
...
However, subiquity still fails complaining about:
2024-08-13 16:24:51,746 DEBUG subiquity.
And checking my installation environment, I see that subiquity adds my key at /tmp/tmpw3ph2pb
Signed-By: /usr/share/
This is the incorrect GPG key.
If I run this:
cat ./trusted.
And then change the Signed-By line to point to this file (/tmp/tmpw3ph2p
We would need a way to use the correct GPG key to the apt source when provided in the autoinstall user-data
Steps to reproduce this would involve setting up an aptly mirror using the following steps:
Add to sources.list:
deb http://
sudo apt-key adv --keyserver keyserver.
sudo apt update
sudo apt install aptly
gpg --no-default-
aptly mirror create -architectures=
aptly mirror create -architectures=
aptly mirror create -architectures=
aptly mirror create -architectures=
aptly mirror update noble && aptly mirror update noble-security && aptly mirror update noble-updates && aptly mirror update noble-backports
aptly snapshot create noble from mirror noble && aptly snapshot create noble-updates from mirror noble-updates && aptly snapshot create noble-security from mirror noble-security && aptly snapshot create noble-backports from mirror noble-backports
gpg --default-
aptly publish snapshot noble && aptly publish snapshot noble-updates && aptly publish snapshot noble-security && aptly publish snapshot noble-backports
sudo apt install apache2
sudo ln -s /home/ubuntu/
chmod 755 /home/ubuntu/
Export the gpg key and use it in the autoinstall yaml:
gpg --list-keys --keyring pubring.gpg
gpg --export --armor 066B7A7C > 066B7A7C.key
---
Workaround: provide sources content in deb822 format and include the text of the key in signed-by
sources:
source: |
Types: deb
URIs: http://
Suites: noble noble-updates noble-backports noble-security
.
<key>
affects: | subiquity → subiquity (Ubuntu) |
Changed in subiquity (Ubuntu): | |
status: | New → Triaged |
importance: | Undecided → High |
description: | updated |
Dropping the severity to Medium now that we know there is an acceptable workaround for now.