git-lfs: signing-key retrieval fails with No data on Debian Trixie
Maintainers usually reply within 3 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- debian, git, shell
- Domain
- developer-experience, security
Research direction
Start in src/git-lfs/install.sh, at receive_gpg_keys and the GIT_LFS_ARCHIVE_VERSION_CODENAMES check, which decides between the apt path and the GitHub release path on Trixie. The failure happens when xargs -n 1 gpg --recv-keys exits non-zero because one listed key cannot be fetched. Done means the git-lfs feature installs on a Trixie base image and signature verification is still enforced. Settle the design choice with maintainers before coding.
Written by the indexing model from the issue text.
Description
Problem
The Git LFS feature fails during signing-key retrieval on Debian Trixie, before release signature verification. All retries fail.
Configuration
Minimal configuration extracted from the failing project (not separately rebuilt in isolation):
{
"image": "mcr.microsoft.com/devcontainers/javascript-node:5-22-trixie",
"features": {
"ghcr.io/devcontainers/features/git-lfs:1": {}
}
}
The lock file resolves the feature to 1.2.5, digest sha256:71c2b371cf12ab7fcec47cf17369c6f59156100dad9abf9e4c593049d789de72.
Build output
gpg: keybox '/tmp/tmp-gnupg/pubring.kbx' created
gpg: key F1BA225C0223B187: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg: w/o user IDs: 1
gpg: /tmp/tmp-gnupg/trustdb.gpg: trustdb created
gpg: key F54FE648088335A9: public key "Chris Darroch (CODE SIGNING KEY) <[email protected]>" imported
gpg: Total number processed: 1
gpg: imported: 1
gpg: keyserver receive failed: No data
(*) Failed getting key, retrying in 10s...
Subsequent attempts show the same skipped first key, unchanged second key, and No data failure, ending with:
(!) Failed to get gpg key.
ERROR: Feature "Git Large File Support (LFS)" (ghcr.io/devcontainers/features/git-lfs) failed to install!
Installer observations
In install.sh, Trixie is absent from GIT_LFS_ARCHIVE_VERSION_CODENAMES, so installation uses the GitHub release path. receive_gpg_keys runs every configured checksum key through xargs -n 1 gpg --recv-keys and requires the entire invocation to succeed. An unavailable listed key therefore aborts installation before checksum signature verification, even when another listed key imports successfully.
The log does not establish which keyserver supplied each result or why the final key lookup returned no data. It also does not establish whether the successfully imported key could verify the selected release.
Expected behavior
Git LFS should install on this base image while retaining authenticity verification. Please consider making trusted-key retrieval resilient to an unavailable keyserver entry, or using the distribution's signed package where appropriate. Signature verification should still be required.
The project has been changed to request Debian's git-lfs package through an apt feature, but that replacement has not yet been verified by a full container rebuild.
Related: #1072 also reports missing user IDs, but proceeds to signature verification; this failure stops earlier in key retrieval. #888 reports a different failure after all three keys import.
- Dominant language
- Shell
- Stars
- 1.6k
- Forks
- 626
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 7
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from devcontainers/features
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
devcontainers/features#1776 · 1 comment ·
Maintainers usually reply within 3 days
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
devcontainers/features#1770 ·
Maintainers usually reply within 3 days
-
replica-skillOpen
Difficulty 4/5 3-5 days Newbie friendliness 5/100
devcontainers/features#1775 ·
Maintainers usually reply within 3 days
-
Difficulty 3/5 1-2 days Newbie friendliness 58/100
devcontainers/features#1772 ·
Maintainers usually reply within 3 days
-
go feature: "init:true" prevents any further use cases that require "init:false", such as running systemd as PID1Possibly taken @v-Kaniska244 claimed this 10 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 55/100
devcontainers/features#1765 · 1 assignee ·
Maintainers usually reply within 3 days
All issues in devcontainers/features
Similar issues
-
agents area: runtime automation chore cli consistency dependencies developer-experience difficulty: easy documentation enhancement good first issue help wanted hygiene json-output priority: P3 starters tests
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
area:claude-code-web bug has repro platform:linux platform:web
Difficulty 1/5 Under an hour Newbie friendliness 66/100
anthropics/claude-code#110168 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
btclib-org/portanode#968 · 1 comment ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
agents area: runtime automation chore cli consistency dependencies developer-experience difficulty: easy documentation enhancement good first issue help wanted hygiene json-output priority: P3 starters tests
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
flisk-sh/flisk-example#41 ·
Maintainers usually reply within 1 day