Apt-get 更新在容器内失败 yarn 仓库未签名

我有一个构建镜像的 github action,在尝试 apt-get update 时失败了。我还在查看是什么问题,但对于 2 小时前的一次安装,如果我在容器内运行 apt-get update,我会收到此错误:

root@monstera-web-only:/# apt-get update
Get:1 http://deb.debian.org/debian bullseye InRelease [116 kB]
Get:2 https://dl.yarnpkg.com/debian stable InRelease [17.1 kB]                                                                                           
Get:3 http://deb.debian.org/debian-security bullseye-security InRelease [48.4 kB]                  
Get:4 http://deb.debian.org/debian bullseye-updates InRelease [44.1 kB]         
Get:5 http://deb.debian.org/debian bullseye-backports InRelease [49.0 kB]  
Get:6 http://apt.postgresql.org/pub/repos/apt bullseye-pgdg InRelease [91.7 kB]
Get:7 http://deb.debian.org/debian bullseye/main amd64 Packages [8,183 kB]     
Err:2 https://dl.yarnpkg.com/debian stable InRelease                                   
  The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
Get:8 http://deb.debian.org/debian-security bullseye-security/main amd64 Packages [216 kB]             
Get:9 http://deb.debian.org/debian bullseye-updates/main amd64 Packages [14.6 kB]                           
Get:10 http://deb.debian.org/debian bullseye-backports/main amd64 Packages [384 kB]
Get:11 https://deb.nodesource.com/node_18.x bullseye InRelease [4,586 B]   
Get:12 http://apt.postgresql.org/pub/repos/apt bullseye-pgdg/main amd64 Packages [268 kB]
Get:13 https://deb.nodesource.com/node_18.x bullseye/main amd64 Packages [774 B]
Reading package lists... Done                            
W: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
1 个赞

我在我们的每日镜像构建 CI 中没有看到任何错误。你能分享容器内 cat /VERSION 的输出吗?

我发誓这是标准安装。。。

# cat /VERSION
2.0.20230116

我还在检查我的 CI,看看是不是我有什么愚蠢的操作(这完全有可能)。我不清楚到底是什么在执行 apt-get update

编辑:我的 CI 有一个安装 vim 的模板。它会执行 apt-get update。在我看来,正常安装中没有东西会执行 apt-get update,所以这解释了为什么你的 CI 没有失败。

下面列出的许多导入模板和 postgres 升级模板都会执行 apt-get update,所以这迟早会成为一个问题。

root@monstera:/var/discourse# grep -lr 'apt-get update'
templates/postgres.9.5.template.yml
templates/postgres.13.template.yml
templates/postgres.template.yml
templates/import/mbox.template.yml
templates/import/mysql-dep.template.yml
templates/import/vanilla.template.yml
templates/import/chrome-dep.template.yml
templates/import/phpbb3.template.yml
templates/postgres.10.template.yml
templates/postgres.12.template.yml
image/base/slim.Dockerfile
1 个赞

是的,这将是我的下一个问题,因为运行这样的更新不是默认的,并且会引入难以追踪的变异,因为大多数站点都使用静态操作系统并依赖新映像来更新操作系统级别的软件。

如果 yarn apt 仓库损坏,我假设我们的 CI 也会损坏。

我下周可以检查一下。也许我们需要为此发布一个新的基础映像。

1 个赞

好的。只是为了确认一下,我需要构建一个新的 phpbb3 导入容器,但无法构建。 这是修复方法。

这是:

但它建议使用 curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -,但 apt-key 已弃用。

如果我在容器中执行此操作:

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg -o /usr/share/keyrings/yarn-keyring.asc \
    && sed -i '1s;^deb;deb [signed-by=/usr/share/keyrings/yarn-keyring.asc];' /etc/apt/sources.list.d/yarn.list

然后我就可以执行此操作:

root@monstera-web-only:/# apt-get update
Hit:1 https://deb.nodesource.com/node_18.x bullseye InRelease
Hit:2 http://deb.debian.org/debian bullseye InRelease
Get:3 https://dl.yarnpkg.com/debian stable InRelease [17.1 kB]
Get:4 http://deb.debian.org/debian-security bullseye-security InRelease [48.4 kB]
Hit:5 http://deb.debian.org/debian bullseye-updates InRelease
Hit:6 http://deb.debian.org/debian bullseye-backports InRelease
Get:7 https://dl.yarnpkg.com/debian stable/main all Packages [10.9 kB]
Get:8 http://deb.debian.org/debian-security bullseye-security/main amd64 Packages [216 kB]
Hit:9 http://apt.postgresql.org/pub/repos/apt bullseye-pgdg InRelease
Get:10 https://dl.yarnpkg.com/debian stable/main amd64 Packages [10.9 kB]
Fetched 286 kB in 0s (849 kB/s)
Reading package lists... Done

同样,如果我在 templates/import/phpbb3.template.ymlapt-get update 之前添加

          - curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg -o /usr/share/keyrings/yarn-keyring.asc &amp;&amp; sed -i '1s;^deb;deb [signed-by=/usr/share/keyrings/yarn-keyring.asc];' /etc/apt/sources.list.d/yarn.list

我就能构建一个新的容器。

3 个赞

@Falco 抱歉发了重复的帖子!

@pfaffman 非常感谢!我确认这个变通方法也适用于 mysql-dep.template.yml

2 个赞

我收到了看起来类似的更新错误。

Err:7 https://dl.yarnpkg.com/debian stable InRelease
  以下签名无效: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
Get:13 http://apt.postgresql.org/pub/repos/apt bullseye-pgdg/main amd64 Packages [268 kB]
Reading package lists...
FAILED

--------------------

Pups::ExecError: cd /var/www/discourse && apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libsqlite3-dev failed with return #<Process::Status: pid 532 exit 100>

Location of failure: /usr/local/lib/ruby/gems/3.1.0/gems/pups-1.1.1/lib/pups/exec_command.rb:117:in `spawn'

exec failed with the params {"cd"=>"$home", "cmd"=>["apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libsqlite3-dev", "echo \"gem 'sqlite3'\" >> Gemfile", "su discourse -`Preformatted text`c 'bundle config unset deployment'", "su discourse -c 'bundle install --no-deployment --path vendor/bundle --jobs 4 --without test development'"]}

从 discourse-doctor 我得到:

Checking your domain name . . .

Connection to xxx succeeded.

You should probably remove any non-standard plugins and rebuild.

Attempting to restart existing container. . .

x86_64 arch detected.

WARNING: containers/app.yml file is world-readable. You can secure this file by running: chmod o-rwx containers/app.yml

starting up existing container

+ /usr/bin/docker start app

Error response from daemon: driver failed programming external connectivity on endpoint app (c143632e34e1ae05e48759bdf163b4bbe5dc9aaf895f1fb7521f7e3784c26577): Error starting userland proxy: listen tcp 0.0.0.0:443: bind: address already in use

Error: failed to start containers: app

Failed to restart the container.

除了重新安装,我还有什么可以做的吗?

我已将此内容移至此主题 @fidelio,以便将报告分组在一起。 :+1:

2 个赞

作为一个“雄心勃勃的业余爱好者”,我有一个快速的问题:
我该如何“在容器内”执行 Curl 命令?

在上面的帖子中,我包含了 curl 命令可以包含在执行 apt-get 的模板中。Apt-get update fails inside container yarn repo not signed - #6 by rahim123

@fidelio 您好,您是否需要从您的 Discourse 实例连接到另一个数据库(如 SQLite),也就是说,您是否正在从另一个论坛进行数据导入?否则,您可以禁用该功能,普通的 Discourse 应用容器将可以正常重建。

我的猜测是他没有升级到 PG 13,而是使用了 pg12 模板?无论如何,这都应该是一个需要解决的问题。而且,操作系统很可能需要升级,迁移到新的虚拟机是应该采取的措施。

1 个赞

您好 @rahim123。不,在这个阶段我不需要做任何这些。我该如何禁用该功能?

@pfaffman 啊,他的错误日志抱怨说要安装 libsqlite3-dev 似乎有点奇怪,或者 Discourse 通常会用它来做什么吗?

@fidelio 你能把你的 /var/discourse/containers/app.yml 文件中的 templates: 部分粘贴在这里吗?请确保不要包含文件中更靠下的任何密码。你也可以运行 /var/discourse/discourse-doctor,它会帮助你生成一份公开分享的系统配置报告。

1 个赞

@rahim123 好的,这是 discourse-doctor 报告:

Found containers/app.yml
==================== YML SETTINGS ====================
DISCOURSE_HOSTNAME=community.bfs-filmeditor.de
SMTP_ADDRESS=in-v3.mailjet.com
DEVELOPER_EMAILS=xxx
SMTP_PASSWORD=xxx
SMTP_PORT=25
SMTP_USER_NAME=xxx
LETSENCRYPT_ACCOUNT_EMAIL=xxx

==================== DOCKER INFO ====================
DOCKER VERSION: Docker version 18.06.1-ce, build e68fc7a

DOCKER PROCESSES (docker ps -a)

CONTAINER ID        IMAGE                           COMMAND             CREATED             STATUS              PORTS                                      NAMES
ce58652241d9        local_discourse/app             “/sbin/boot”        2 weeks ago         Up 14 minutes       0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp   app
8e6b8ec432b4        local_discourse/mail-receiver   “/sbin/boot”        11 months ago       Up 11 months        0.0.0.0:25->25/tcp                         mail-receiver

ce58652241d9        local_discourse/app             “/sbin/boot”        2 weeks ago         Up 14 minutes       0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp   app

Discourse container app is running


==================== PLUGINS ====================
          - git clone https://github.com/discourse/docker_manager.git
          - git clone  https://github.com/davidtaylorhq/discourse-whos-online.git
          - git clone https://github.com/gdpelican/babble.git
          - git clone https://github.com/angusmcleod/discourse-quick-messages.git
          - git clone https://github.com/angusmcleod/discourse-events.git
          - git clone https://github.com/discourse/discourse-calendar.git
          - git clone https://github.com/discourse/discourse-data-explorer.git
          - git clone https://github.com/davidtaylorhq/discourse-telegram-notifications.git

WARNING:
You have what appear to be non-official plugins.
If you are having trouble, you should disable them and try rebuilding again.

See https://github.com/discourse/discourse/blob/main/lib/plugin/metadata.rb for the official list.

========================================
Discourse version at community.bfs-filmeditor.de: TYPO3 CMS
Discourse version at localhost: TYPO3 CMS


==================== MEMORY INFORMATION ====================
RAM (MB): 4039

              total        used        free      shared  buff/cache   available
Mem:           3944        1272        1236        1067        1436        1364
Swap:             0           0           0

==================== DISK SPACE CHECK ====================
---------- OS Disk Space ----------
Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        78G   60G   18G  78% /

---------- Container Disk Space ----------
Filesystem      Size  Used Avail Use% Mounted on
overlay          78G   60G   18G  78% /
/dev/vda1        78G   60G   18G  78% /shared
/dev/vda1        78G   60G   18G  78% /var/log

==================== DISK INFORMATION ====================
Disk /dev/vda: 80 GiB, 85899345920 bytes, 167772160 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: C1F9A1FE-534C-4DAC-9299-5CC180C29DCE

Device      Start       End   Sectors  Size Type
/dev/vda1  227328 167772126 167544799 79.9G Linux filesystem
/dev/vda14   2048     10239      8192    4M BIOS boot
/dev/vda15  10240    227327    217088  106M Microsoft basic data

Partition table entries are not in disk order.

==================== END DISK INFORMATION ====================

我已经禁用了快速消息,但尚未将其删除。

FWIW,我认为 babble 已经坏了一段时间了:

3 个赞

我以为 discourse-doctor 会显示启用了哪些模板,看来不是。您能否也发布这个?

1 个赞

它不会。虽然这似乎是个好主意,但这是我第一次记得它很重要。

1 个赞

这里是:

 GNU nano 2.9.3                                                                         containers/app.yml                                                                                   


## 这是独立的、一体化的 Discourse Docker 容器模板
##
## 修改此文件后,您必须重建
## /var/discourse/launcher rebuild app
##
## 编辑时请务必*非常小心*!
## YAML 文件对空格或对齐的错误非常非常敏感!
## 如有需要,请访问 http://www.yamllint.com/ 来验证此文件

templates:
  - "templates/postgres.template.yml"
  - "templates/redis.template.yml"
  - "templates/web.template.yml"
  - "templates/web.ratelimited.template.yml"
## 如果您希望添加 Let's Encrypt (https),请取消注释这两行
  - "templates/web.ssl.template.yml"
  - "templates/web.letsencrypt.ssl.template.yml"
  - "templates/import/mbox.template.yml"
## 此容器应公开哪些 TCP/IP 端口?
## 如果您希望 Discourse 与 Apache 或 nginx 等其他 Web 服务器共享端口,
## 请参阅 https://meta.discourse.org/t/17247 获取详细信息
expose:
  - "80:80"   # http
  - "443:443" # https

params:
  db_default_text_search_config: "pg_catalog.english"

  ## 将 db_shared_buffers 设置为总内存的最多 25%。
  ## 将由 bootstrap 根据检测到的 RAM 自动设置,或者您可以覆盖它
  db_shared_buffers: "1024MB"

  ## 可以提高排序性能,但会增加每个连接的内存使用量
  #db_work_mem: "40MB"

  ## 此容器应使用哪个 Git 版本? (默认值:tests-passed)
  #version: tests-passed

env:
  LANG: en_US.UTF-8
  # DISCOURSE_DEFAULT_LOCALE: en

  ## 支持多少并发 Web 请求?取决于内存和 CPU 核心。
  ## 将由 bootstrap 根据检测到的 CPU 自动设置,或者您可以覆盖它
  UNICORN_WORKERS: 4

我认为这是问题所在,尝试在其前面加上“#”并运行 ./launcher rebuild app

2 个赞