git-lfs: signing-key retrieval fails with No data on Debian Trixie

オープン
  • 何か問題がありますか？
#1,774 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 3 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
35/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
debian, git, shell
領域
developer-experience, security

調査の方向性

Start in src/git-lfs/install.sh, at receive_gpg_keys and the GIT_LFS_ARCHIVE_VERSION_CODENAMES check, which decides between the apt path and the GitHub release path on Trixie. The failure happens when xargs -n 1 gpg --recv-keys exits non-zero because one listed key cannot be fetched. Done means the git-lfs feature installs on a Trixie base image and signature verification is still enforced. Settle the design choice with maintainers before coding.

索引モデルが issue の本文から書いたものです。

説明

Problem

The Git LFS feature fails during signing-key retrieval on Debian Trixie, before release signature verification. All retries fail.

Configuration

Minimal configuration extracted from the failing project (not separately rebuilt in isolation):

{
  "image": "mcr.microsoft.com/devcontainers/javascript-node:5-22-trixie",
  "features": {
    "ghcr.io/devcontainers/features/git-lfs:1": {}
  }
}

The lock file resolves the feature to 1.2.5, digest sha256:71c2b371cf12ab7fcec47cf17369c6f59156100dad9abf9e4c593049d789de72.

Build output

gpg: keybox '/tmp/tmp-gnupg/pubring.kbx' created
gpg: key F1BA225C0223B187: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg:           w/o user IDs: 1
gpg: /tmp/tmp-gnupg/trustdb.gpg: trustdb created
gpg: key F54FE648088335A9: public key "Chris Darroch (CODE SIGNING KEY) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: keyserver receive failed: No data
(*) Failed getting key, retrying in 10s...

Subsequent attempts show the same skipped first key, unchanged second key, and No data failure, ending with:

(!) Failed to get gpg key.
ERROR: Feature "Git Large File Support (LFS)" (ghcr.io/devcontainers/features/git-lfs) failed to install!

Installer observations

In install.sh, Trixie is absent from GIT_LFS_ARCHIVE_VERSION_CODENAMES, so installation uses the GitHub release path. receive_gpg_keys runs every configured checksum key through xargs -n 1 gpg --recv-keys and requires the entire invocation to succeed. An unavailable listed key therefore aborts installation before checksum signature verification, even when another listed key imports successfully.

The log does not establish which keyserver supplied each result or why the final key lookup returned no data. It also does not establish whether the successfully imported key could verify the selected release.

Expected behavior

Git LFS should install on this base image while retaining authenticity verification. Please consider making trusted-key retrieval resilient to an unavailable keyserver entry, or using the distribution's signed package where appropriate. Signature verification should still be required.

The project has been changed to request Debian's git-lfs package through an apt feature, but that replacement has not yet been verified by a full container rebuild.

Related: #1072 also reports missing user IDs, but proceeds to signature verification; this failure stops earlier in key retrieval. #888 reports a different failure after all three keys import.

主要言語
Shell
スター
1.6k
フォーク
626
平均マージ
4日 10時間
マージ済み PR（30日）
7

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

devcontainers/features のほかの issue

devcontainers/features の issue をすべて見る

似ている issue

Shell/Bash の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。