Closed madeddie closed 2 months ago
Same issue here
Getting a number of reports on this.
Unfortunately I am AFK this weekend and will be returning Tuesday. If anyone wants to investigate this for me and propose a solution, I would appreciate it!
My description should be enough, the file downloaded here https://github.com/serversideup/docker-php/blob/main/src/variations/fpm-nginx/Dockerfile#L35 should be downloaded again, since the file in the currently released image has an expired key. If someone can simply run the docker build and push again, that will solve it.
A possible quick fix for people is to download the gpg key and copying it into the Dockerfile on build for now.
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor > nginx-archive-keyring.gpg
in the same dir as your Dockerfile and add COPY nginx-archive-keyring.gpg /usr/share/keyrings/nginx-archive-keyring.gpg
in your Dockerfile before you run apt[-get] update
.
Running this from my phone, but it failed. Trying again https://github.com/serversideup/docker-php/actions/runs/9131599748
The run completed. Can someone help me validate it's actually fixed?
I want to make sure it works for the latest minor tags too (8.3-fpm-nginx, 8.2-fpm-nginx, etc)
Did a quick and dirty test and it seems to be working.
Got a list of images with nginx in the name, but not alpine of the last 8 or 9 hours (since that was when your last build pushed), then unique'd on sha hash.
$ hub-tool tag ls serversideup/php --all | grep nginx | grep -v "alpine" | awk '{print $1, $2, $4, $5}' | egrep "(8|9) hours" | sort -s -u -k2,2 | awk '{print $1}'
serversideup/php:8.3-fpm-nginx-bookworm
serversideup/php:8.1-fpm-nginx-v3.2.0
serversideup/php:fpm-nginx-bookworm-v3.2.0
serversideup/php:8-fpm-nginx
serversideup/php:8.1.29-fpm-nginx
serversideup/php:8.2-fpm-nginx-v3.2.0
serversideup/php:8.2.20-fpm-nginx
serversideup/php:7-fpm-nginx-v3.2.0
serversideup/php:8.0-fpm-nginx-v3.2.0
serversideup/php:8.2.20-fpm-nginx-v3.2.0
serversideup/php:fpm-nginx-v3.2.0
Used this command to actually test them and all containers finished without error.
$ hub-tool tag ls serversideup/php --all | grep nginx | grep -v "alpine" | awk '{print $1, $2, $4, $5}' | egrep "(8|9) hours" | sort -s -u -k2,2 | awk '{print $1}' | xargs -I% docker run --user root --entrypoint /usr/bin/apt-get % update
I consider this issue fixed. Thank you for quick response!
(for anyone wanting to replicate the test, be sure to check the output after the first awk to see if the latest images are really 8 or 9 hours old, they'll likely be older by the time you read this :)) (pps hub-tool can be found here https://github.com/docker/hub-tool)
I pulled serversideup/php:8.3-fpm-nginx-bookworm-v3.2.0
which is what we're using, everything seems like its working as expected.
Thanks for confirming all! I appreciate your flexibility and support as I was AFK this weekend!
@jaydrogers is there a fix available for older images? I'm running serversideup/php:beta-8.2.17-fpm-nginx
and started seeing the same error.
If possible, I would recommend upgrading to the latest 8.2 minor version of PHP (as of this post):
serversideup/php:8.2.20-fpm-nginx
Summarizing the comment above: https://github.com/serversideup/docker-php/issues/380#issuecomment-2168996813
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor > nginx-archive-keyring.gpg
COPY nginx-archive-keyring.gpg /usr/share/keyrings/nginx-archive-keyring.gpg
apt-get update
Thanks so much! Confirming that the manual fix worked.
Need to get working on updating our stuff 😅
Affected Docker Images
serversideup/php:8.3-fpm-nginx-bookworm-v3.2.0
Current Behavior
When doing an "apt-get update" I get this error:
Expected Behavior
Don't give this error
Steps To Reproduce
FROM serversideup/php:8.3-fpm-nginx-bookworm-v3.2.0
andRUN apt-get update -y
docker build .
Anything else?
The key has been updated in the keyservers with a new expiry: https://github.com/nginx/nginx.org/pull/41
A simple rebuild of the image (that downloads the latest key file) should suffice to fix this. I'd say even tag it with the same version is nothing else changes.