git-lfs: signing-key retrieval fails with No data on Debian Trixie

Ouverte
  • Quelque chose ne va pas ?
#1,774 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 3 jours

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
35/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
debian, git, shell
Domaine
developer-experience, security

Piste de recherche

Start in src/git-lfs/install.sh, at receive_gpg_keys and the GIT_LFS_ARCHIVE_VERSION_CODENAMES check, which decides between the apt path and the GitHub release path on Trixie. The failure happens when xargs -n 1 gpg --recv-keys exits non-zero because one listed key cannot be fetched. Done means the git-lfs feature installs on a Trixie base image and signature verification is still enforced. Settle the design choice with maintainers before coding.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Problem

The Git LFS feature fails during signing-key retrieval on Debian Trixie, before release signature verification. All retries fail.

Configuration

Minimal configuration extracted from the failing project (not separately rebuilt in isolation):

{
  "image": "mcr.microsoft.com/devcontainers/javascript-node:5-22-trixie",
  "features": {
    "ghcr.io/devcontainers/features/git-lfs:1": {}
  }
}

The lock file resolves the feature to 1.2.5, digest sha256:71c2b371cf12ab7fcec47cf17369c6f59156100dad9abf9e4c593049d789de72.

Build output

gpg: keybox '/tmp/tmp-gnupg/pubring.kbx' created
gpg: key F1BA225C0223B187: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg:           w/o user IDs: 1
gpg: /tmp/tmp-gnupg/trustdb.gpg: trustdb created
gpg: key F54FE648088335A9: public key "Chris Darroch (CODE SIGNING KEY) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: keyserver receive failed: No data
(*) Failed getting key, retrying in 10s...

Subsequent attempts show the same skipped first key, unchanged second key, and No data failure, ending with:

(!) Failed to get gpg key.
ERROR: Feature "Git Large File Support (LFS)" (ghcr.io/devcontainers/features/git-lfs) failed to install!

Installer observations

In install.sh, Trixie is absent from GIT_LFS_ARCHIVE_VERSION_CODENAMES, so installation uses the GitHub release path. receive_gpg_keys runs every configured checksum key through xargs -n 1 gpg --recv-keys and requires the entire invocation to succeed. An unavailable listed key therefore aborts installation before checksum signature verification, even when another listed key imports successfully.

The log does not establish which keyserver supplied each result or why the final key lookup returned no data. It also does not establish whether the successfully imported key could verify the selected release.

Expected behavior

Git LFS should install on this base image while retaining authenticity verification. Please consider making trusted-key retrieval resilient to an unavailable keyserver entry, or using the distribution's signed package where appropriate. Signature verification should still be required.

The project has been changed to request Debian's git-lfs package through an apt feature, but that replacement has not yet been verified by a full container rebuild.

Related: #1072 also reports missing user IDs, but proceeds to signature verification; this failure stops earlier in key retrieval. #888 reports a different failure after all three keys import.

Langage dominant
Shell
Étoiles
1.6k
Forks
626
Merge moyen
4 j 10 h
PR mergées (30 j)
7

Préparer son environnement

Ouvrir dans Codespaces

Lance le conteneur de développement du projet dans votre navigateur, avec votre propre compte GitHub.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de devcontainers/features

Toutes les issues de devcontainers/features

Issues similaires

Plus d'issues Shell/Bash

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.