search

tianon / gosu

Simple Go-based setuid+setgid+setgroups+exec
Apache License 2.0
4.71k stars 320 forks source link

The key is not certified with a trusted signature in Debian stretch #38

Closed eleidan closed 7 years ago

eleidan commented 7 years ago

How to reproduce Issue the following command on Debian 9 (stretch) official container as root user:

apt-get update && apt-get install -y --no-install-recommends \
      gnupg \
      dirmngr \
    && dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')" \
    && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.10/gosu-$dpkgArch" \
    && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.10/gosu-$dpkgArch.asc" \
    && export GNUPGHOME="$(mktemp -d)" \
    && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
    && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
    && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
    && chmod +x /usr/local/bin/gosu \
    && gosu nobody true

As a result, an output similar to the following is expected:

gpg: keybox '/tmp/tmp.J52ezIfr5l/pubring.kbx' created
gpg: /tmp/tmp.J52ezIfr5l/trustdb.gpg: trustdb created
gpg: key 036A9C25BF357DD4: public key "Tianon Gravi <tianon@tianon.xyz>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1
gpg: Signature made Wed Sep 28 22:22:56 2016 UTC
gpg:                using RSA key 036A9C25BF357DD4
gpg: Good signature from "Tianon Gravi <tianon@tianon.xyz>" [unknown]
gpg:                 aka "Tianon Gravi <tianon@debian.org>" [unknown]
gpg:                 aka "Tianon Gravi <tianon@dockerproject.org>" [unknown]
gpg:                 aka "Andrew Page (tianon) <andrew@infosiftr.com>" [unknown]
gpg:                 aka "Andrew Page (tianon) <andrew@vitalroute.com>" [unknown]
gpg:                 aka "Andrew Page (Tianon Gravi) <admwiggin@gmail.com>" [unknown]
gpg:                 aka "Tianon Gravi (Andrew Page) <tianon@infosiftr.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: B42F 6819 007F 00F8 8E36  4FD4 036A 9C25 BF35 7DD4
tianon commented 7 years ago

That's normal -- this warning simply means that when the key was imported, it wasn't marked as "trusted", but the output clearly notes that the file is properly signed with that key. :+1:

eleidan commented 7 years ago

Thank you for the response, but that breaks my automation builds on DockerHub because of that error. :confused:

tianon commented 7 years ago

I see a warning, but not an error -- can you please provide the full build output of the step?

tianon commented 7 years ago

For example, I cannot reproduce any errors with the following:

FROM debian:stretch-slim
ENV GOSU_VERSION 1.10
RUN set -ex; \
    \
    fetchDeps=' \
        ca-certificates \
        wget \
        gnupg2 dirmngr \
    '; \
    apt-get update; \
    apt-get install -y --no-install-recommends $fetchDeps; \
    rm -rf /var/lib/apt/lists/*; \
    \
    dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
    wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \
    wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \
    \
# verify the signature
    export GNUPGHOME="$(mktemp -d)"; \
    gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
    gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
    rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc; \
    \
    chmod +x /usr/local/bin/gosu; \
# verify that the binary works
    gosu nobody true; \
    \
    apt-get purge -y --auto-remove $fetchDeps

Edit: full build output:

$ docker build -

FROM debian:stretch-slim
ENV GOSU_VERSION 1.10
RUN set -ex; \
    \
    fetchDeps=' \
        ca-certificates \
        wget \
        gnupg2 dirmngr \
    '; \
    apt-get update; \
    apt-get install -y --no-install-recommends $fetchDeps; \
    rm -rf /var/lib/apt/lists/*; \
    \
    dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
    wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \
    wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \
    \
# verify the signature
    export GNUPGHOME="$(mktemp -d)"; \
    gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
    gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
    rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc; \
    \
    chmod +x /usr/local/bin/gosu; \
# verify that the binary works
    gosu nobody true; \
    \
    apt-get purge -y --auto-remove $fetchDeps

Sending build context to Docker daemon   2.56kB
Step 1/3 : FROM debian:stretch-slim
 ---> 3ad2120063ab
Step 2/3 : ENV GOSU_VERSION 1.10
 ---> Running in da70a90eb693
 ---> d8e86884c22a
Removing intermediate container da70a90eb693
Step 3/3 : RUN set -ex;         fetchDeps='         ca-certificates wget        gnupg2 dirmngr  ';  apt-get update;     apt-get install -y --no-install-recommends $fetchDeps;  rm -rf /var/lib/apt/lists/*;        dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')";  wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch";    wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc";        export GNUPGHOME="$(mktemp -d)";    gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4;    gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu;   rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc;         chmod +x /usr/local/bin/gosu;   gosu nobody true;   apt-get purge -y --auto-remove $fetchDeps
 ---> Running in cf03d43d6884
+ fetchDeps=        ca-certificates         wget        gnupg2 dirmngr  
+ apt-get update
Get:2 http://security.debian.org stretch/updates InRelease [62.9 kB]
Ign:1 http://cdn-fastly.deb.debian.org/debian stretch InRelease
Get:4 http://security.debian.org stretch/updates/main amd64 Packages [64.9 kB]
Get:3 http://cdn-fastly.deb.debian.org/debian stretch-updates InRelease [88.5 kB]
Get:5 http://cdn-fastly.deb.debian.org/debian stretch Release [113 kB]
Get:6 http://cdn-fastly.deb.debian.org/debian stretch Release.gpg [3108 B]
Get:7 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 Packages [9497 kB]
Fetched 9830 kB in 5s (1892 kB/s)
Reading package lists...
+ apt-get install -y --no-install-recommends ca-certificates wget gnupg2 dirmngr
Reading package lists...
Building dependency tree...
Reading state information...
The following additional packages will be installed:
  gnupg gnupg-agent libassuan0 libffi6 libgmp10 libgnutls30 libhogweed4
  libidn11 libidn2-0 libksba8 libldap-2.4-2 libldap-common libnettle6 libnpth0
  libp11-kit0 libpsl5 libreadline7 libsasl2-2 libsasl2-modules-db libsqlite3-0
  libssl1.1 libtasn1-6 libunistring0 openssl pinentry-curses readline-common
Suggested packages:
  dbus-user-session libpam-systemd pinentry-gnome3 tor parcimonie xloadimage
  scdaemon gnutls-bin pinentry-doc readline-doc
Recommended packages:
  gnupg-l10n publicsuffix libsasl2-modules
The following NEW packages will be installed:
  ca-certificates dirmngr gnupg gnupg-agent gnupg2 libassuan0 libffi6 libgmp10
  libgnutls30 libhogweed4 libidn11 libidn2-0 libksba8 libldap-2.4-2
  libldap-common libnettle6 libnpth0 libp11-kit0 libpsl5 libreadline7
  libsasl2-2 libsasl2-modules-db libsqlite3-0 libssl1.1 libtasn1-6
  libunistring0 openssl pinentry-curses readline-common wget
0 upgraded, 30 newly installed, 0 to remove and 1 not upgraded.
Need to get 9267 kB of archives.
After this operation, 22.3 MB of additional disk space will be used.
Get:2 http://security.debian.org stretch/updates/main amd64 libgnutls30 amd64 3.5.8-5+deb9u1 [895 kB]
Get:1 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libassuan0 amd64 2.4.3-2 [42.5 kB]
Get:3 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 pinentry-curses amd64 1.0.0-2 [50.5 kB]
Get:4 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libnpth0 amd64 1.3-1 [14.6 kB]
Get:5 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 readline-common all 7.0-3 [70.4 kB]
Get:6 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libreadline7 amd64 7.0-3 [151 kB]
Get:7 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 gnupg-agent amd64 2.1.18-6 [554 kB]
Get:8 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libksba8 amd64 1.3.5-2 [99.7 kB]
Get:9 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libsqlite3-0 amd64 3.16.2-5 [572 kB]
Get:10 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 gnupg amd64 2.1.18-6 [1126 kB]
Get:11 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libssl1.1 amd64 1.1.0f-3 [1342 kB]
Get:12 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libgmp10 amd64 2:6.1.2+dfsg-1 [253 kB]
Get:13 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libnettle6 amd64 3.3-1+b1 [191 kB]
Get:14 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libhogweed4 amd64 3.3-1+b1 [136 kB]
Get:15 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libidn11 amd64 1.33-1 [115 kB]
Get:16 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libffi6 amd64 3.2.1-6 [20.4 kB]
Get:17 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libp11-kit0 amd64 0.23.3-2 [111 kB]
Get:18 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libtasn1-6 amd64 4.10-1.1 [50.4 kB]
Get:19 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libunistring0 amd64 0.9.6+really0.9.3-0.1 [279 kB]
Get:20 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libidn2-0 amd64 0.16-1 [60.6 kB]
Get:21 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libpsl5 amd64 0.17.0-3 [41.8 kB]
Get:22 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 wget amd64 1.18-5 [800 kB]
Get:23 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libsasl2-modules-db amd64 2.1.27~101-g0780600+dfsg-3 [68.2 kB]
Get:24 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libsasl2-2 amd64 2.1.27~101-g0780600+dfsg-3 [105 kB]
Get:25 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libldap-common all 2.4.44+dfsg-5 [85.0 kB]
Get:26 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 libldap-2.4-2 amd64 2.4.44+dfsg-5 [218 kB]
Get:27 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 openssl amd64 1.1.0f-3 [725 kB]
Get:28 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 ca-certificates all 20161130+nmu1 [196 kB]
Get:29 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 dirmngr amd64 2.1.18-6 [595 kB]
Get:30 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 gnupg2 all 2.1.18-6 [299 kB]
debconf: delaying package configuration, since apt-utils is not installed
Fetched 9267 kB in 4s (2028 kB/s)
Selecting previously unselected package libassuan0:amd64.
(Reading database ... 6319 files and directories currently installed.)
Preparing to unpack .../00-libassuan0_2.4.3-2_amd64.deb ...
Unpacking libassuan0:amd64 (2.4.3-2) ...
Selecting previously unselected package pinentry-curses.
Preparing to unpack .../01-pinentry-curses_1.0.0-2_amd64.deb ...
Unpacking pinentry-curses (1.0.0-2) ...
Selecting previously unselected package libnpth0:amd64.
Preparing to unpack .../02-libnpth0_1.3-1_amd64.deb ...
Unpacking libnpth0:amd64 (1.3-1) ...
Selecting previously unselected package readline-common.
Preparing to unpack .../03-readline-common_7.0-3_all.deb ...
Unpacking readline-common (7.0-3) ...
Selecting previously unselected package libreadline7:amd64.
Preparing to unpack .../04-libreadline7_7.0-3_amd64.deb ...
Unpacking libreadline7:amd64 (7.0-3) ...
Selecting previously unselected package gnupg-agent.
Preparing to unpack .../05-gnupg-agent_2.1.18-6_amd64.deb ...
Unpacking gnupg-agent (2.1.18-6) ...
Selecting previously unselected package libksba8:amd64.
Preparing to unpack .../06-libksba8_1.3.5-2_amd64.deb ...
Unpacking libksba8:amd64 (1.3.5-2) ...
Selecting previously unselected package libsqlite3-0:amd64.
Preparing to unpack .../07-libsqlite3-0_3.16.2-5_amd64.deb ...
Unpacking libsqlite3-0:amd64 (3.16.2-5) ...
Selecting previously unselected package gnupg.
Preparing to unpack .../08-gnupg_2.1.18-6_amd64.deb ...
Unpacking gnupg (2.1.18-6) ...
Selecting previously unselected package libssl1.1:amd64.
Preparing to unpack .../09-libssl1.1_1.1.0f-3_amd64.deb ...
Unpacking libssl1.1:amd64 (1.1.0f-3) ...
Selecting previously unselected package libgmp10:amd64.
Preparing to unpack .../10-libgmp10_2%3a6.1.2+dfsg-1_amd64.deb ...
Unpacking libgmp10:amd64 (2:6.1.2+dfsg-1) ...
Selecting previously unselected package libnettle6:amd64.
Preparing to unpack .../11-libnettle6_3.3-1+b1_amd64.deb ...
Unpacking libnettle6:amd64 (3.3-1+b1) ...
Selecting previously unselected package libhogweed4:amd64.
Preparing to unpack .../12-libhogweed4_3.3-1+b1_amd64.deb ...
Unpacking libhogweed4:amd64 (3.3-1+b1) ...
Selecting previously unselected package libidn11:amd64.
Preparing to unpack .../13-libidn11_1.33-1_amd64.deb ...
Unpacking libidn11:amd64 (1.33-1) ...
Selecting previously unselected package libffi6:amd64.
Preparing to unpack .../14-libffi6_3.2.1-6_amd64.deb ...
Unpacking libffi6:amd64 (3.2.1-6) ...
Selecting previously unselected package libp11-kit0:amd64.
Preparing to unpack .../15-libp11-kit0_0.23.3-2_amd64.deb ...
Unpacking libp11-kit0:amd64 (0.23.3-2) ...
Selecting previously unselected package libtasn1-6:amd64.
Preparing to unpack .../16-libtasn1-6_4.10-1.1_amd64.deb ...
Unpacking libtasn1-6:amd64 (4.10-1.1) ...
Selecting previously unselected package libgnutls30:amd64.
Preparing to unpack .../17-libgnutls30_3.5.8-5+deb9u1_amd64.deb ...
Unpacking libgnutls30:amd64 (3.5.8-5+deb9u1) ...
Selecting previously unselected package libunistring0:amd64.
Preparing to unpack .../18-libunistring0_0.9.6+really0.9.3-0.1_amd64.deb ...
Unpacking libunistring0:amd64 (0.9.6+really0.9.3-0.1) ...
Selecting previously unselected package libidn2-0:amd64.
Preparing to unpack .../19-libidn2-0_0.16-1_amd64.deb ...
Unpacking libidn2-0:amd64 (0.16-1) ...
Selecting previously unselected package libpsl5:amd64.
Preparing to unpack .../20-libpsl5_0.17.0-3_amd64.deb ...
Unpacking libpsl5:amd64 (0.17.0-3) ...
Selecting previously unselected package wget.
Preparing to unpack .../21-wget_1.18-5_amd64.deb ...
Unpacking wget (1.18-5) ...
Selecting previously unselected package libsasl2-modules-db:amd64.
Preparing to unpack .../22-libsasl2-modules-db_2.1.27~101-g0780600+dfsg-3_amd64.deb ...
Unpacking libsasl2-modules-db:amd64 (2.1.27~101-g0780600+dfsg-3) ...
Selecting previously unselected package libsasl2-2:amd64.
Preparing to unpack .../23-libsasl2-2_2.1.27~101-g0780600+dfsg-3_amd64.deb ...
Unpacking libsasl2-2:amd64 (2.1.27~101-g0780600+dfsg-3) ...
Selecting previously unselected package libldap-common.
Preparing to unpack .../24-libldap-common_2.4.44+dfsg-5_all.deb ...
Unpacking libldap-common (2.4.44+dfsg-5) ...
Selecting previously unselected package libldap-2.4-2:amd64.
Preparing to unpack .../25-libldap-2.4-2_2.4.44+dfsg-5_amd64.deb ...
Unpacking libldap-2.4-2:amd64 (2.4.44+dfsg-5) ...
Selecting previously unselected package openssl.
Preparing to unpack .../26-openssl_1.1.0f-3_amd64.deb ...
Unpacking openssl (1.1.0f-3) ...
Selecting previously unselected package ca-certificates.
Preparing to unpack .../27-ca-certificates_20161130+nmu1_all.deb ...
Unpacking ca-certificates (20161130+nmu1) ...
Selecting previously unselected package dirmngr.
Preparing to unpack .../28-dirmngr_2.1.18-6_amd64.deb ...
Unpacking dirmngr (2.1.18-6) ...
Selecting previously unselected package gnupg2.
Preparing to unpack .../29-gnupg2_2.1.18-6_all.deb ...
Unpacking gnupg2 (2.1.18-6) ...
Setting up libnpth0:amd64 (1.3-1) ...
Setting up readline-common (7.0-3) ...
Setting up libnettle6:amd64 (3.3-1+b1) ...
Setting up libldap-common (2.4.44+dfsg-5) ...
Setting up libreadline7:amd64 (7.0-3) ...
Setting up libsasl2-modules-db:amd64 (2.1.27~101-g0780600+dfsg-3) ...
Setting up libsasl2-2:amd64 (2.1.27~101-g0780600+dfsg-3) ...
Setting up libksba8:amd64 (1.3.5-2) ...
Setting up libtasn1-6:amd64 (4.10-1.1) ...
Setting up libgmp10:amd64 (2:6.1.2+dfsg-1) ...
Processing triggers for libc-bin (2.24-11+deb9u1) ...
Setting up libunistring0:amd64 (0.9.6+really0.9.3-0.1) ...
Setting up libssl1.1:amd64 (1.1.0f-3) ...
debconf: unable to initialize frontend: Dialog
debconf: (TERM is not set, so the dialog frontend is not usable.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (Can't locate Term/ReadLine.pm in @INC (you may need to install the Term::ReadLine module) (@INC contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.24.1 /usr/local/share/perl/5.24.1 /usr/lib/x86_64-linux-gnu/perl5/5.24 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.24 /usr/share/perl/5.24 /usr/local/lib/site_perl /usr/lib/x86_64-linux-gnu/perl-base .) at /usr/share/perl5/Debconf/FrontEnd/Readline.pm line 7.)
debconf: falling back to frontend: Teletype
Setting up openssl (1.1.0f-3) ...
Setting up libsqlite3-0:amd64 (3.16.2-5) ...
Setting up libffi6:amd64 (3.2.1-6) ...
Setting up ca-certificates (20161130+nmu1) ...
debconf: unable to initialize frontend: Dialog
debconf: (TERM is not set, so the dialog frontend is not usable.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (Can't locate Term/ReadLine.pm in @INC (you may need to install the Term::ReadLine module) (@INC contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.24.1 /usr/local/share/perl/5.24.1 /usr/lib/x86_64-linux-gnu/perl5/5.24 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.24 /usr/share/perl/5.24 /usr/local/lib/site_perl /usr/lib/x86_64-linux-gnu/perl-base .) at /usr/share/perl5/Debconf/FrontEnd/Readline.pm line 7.)
debconf: falling back to frontend: Teletype
Updating certificates in /etc/ssl/certs...
166 added, 0 removed; done.
Setting up libassuan0:amd64 (2.4.3-2) ...
Setting up libidn11:amd64 (1.33-1) ...
Setting up libidn2-0:amd64 (0.16-1) ...
Setting up libpsl5:amd64 (0.17.0-3) ...
Setting up libhogweed4:amd64 (3.3-1+b1) ...
Setting up libp11-kit0:amd64 (0.23.3-2) ...
Setting up pinentry-curses (1.0.0-2) ...
Setting up gnupg-agent (2.1.18-6) ...
Setting up gnupg (2.1.18-6) ...
Setting up libgnutls30:amd64 (3.5.8-5+deb9u1) ...
Setting up gnupg2 (2.1.18-6) ...
Setting up libldap-2.4-2:amd64 (2.4.44+dfsg-5) ...
Setting up wget (1.18-5) ...
Setting up dirmngr (2.1.18-6) ...
Processing triggers for libc-bin (2.24-11+deb9u1) ...
Processing triggers for ca-certificates (20161130+nmu1) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
+ rm -rf /var/lib/apt/lists/deb.debian.org_debian_dists_stretch-updates_InRelease /var/lib/apt/lists/deb.debian.org_debian_dists_stretch_Release /var/lib/apt/lists/deb.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/deb.debian.org_debian_dists_stretch_main_binary-amd64_Packages.lz4 /var/lib/apt/lists/lock /var/lib/apt/lists/partial /var/lib/apt/lists/security.debian.org_dists_stretch_updates_InRelease /var/lib/apt/lists/security.debian.org_dists_stretch_updates_main_binary-amd64_Packages.lz4
+ dpkg --print-architecture
+ awk -F- { print $NF }
+ dpkgArch=amd64
+ wget -O /usr/local/bin/gosu https://github.com/tianon/gosu/releases/download/1.10/gosu-amd64
--2017-07-06 21:29:56--  https://github.com/tianon/gosu/releases/download/1.10/gosu-amd64
Resolving github.com (github.com)... 192.30.255.113, 192.30.255.112
Connecting to github.com (github.com)|192.30.255.113|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://github-production-release-asset-2e65be.s3.amazonaws.com/19708981/0afb9a88-8591-11e6-9802-291a1e7e3b2b?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20170706%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20170706T212957Z&X-Amz-Expires=300&X-Amz-Signature=e156cda5a071c595e0fd3262892c670cde20112b72185f571cd1785da9b599f4&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3Dgosu-amd64&response-content-type=application%2Foctet-stream [following]
--2017-07-06 21:29:57--  https://github-production-release-asset-2e65be.s3.amazonaws.com/19708981/0afb9a88-8591-11e6-9802-291a1e7e3b2b?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20170706%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20170706T212957Z&X-Amz-Expires=300&X-Amz-Signature=e156cda5a071c595e0fd3262892c670cde20112b72185f571cd1785da9b599f4&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3Dgosu-amd64&response-content-type=application%2Foctet-stream
Resolving github-production-release-asset-2e65be.s3.amazonaws.com (github-production-release-asset-2e65be.s3.amazonaws.com)... 52.216.230.75
Connecting to github-production-release-asset-2e65be.s3.amazonaws.com (github-production-release-asset-2e65be.s3.amazonaws.com)|52.216.230.75|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1286720 (1.2M) [application/octet-stream]
Saving to: '/usr/local/bin/gosu'

     0K .......... .......... .......... .......... ..........  3%  292K 4s
    50K .......... .......... .......... .......... ..........  7%  339K 4s
   100K .......... .......... .......... .......... .......... 11% 7.08M 2s
   150K .......... .......... .......... .......... .......... 15%  681K 2s
   200K .......... .......... .......... .......... .......... 19%  707K 2s
   250K .......... .......... .......... .......... .......... 23% 9.54M 2s
   300K .......... .......... .......... .......... .......... 27% 11.0M 1s
   350K .......... .......... .......... .......... .......... 31%  727K 1s
   400K .......... .......... .......... .......... .......... 35% 6.53M 1s
   450K .......... .......... .......... .......... .......... 39% 10.5M 1s
   500K .......... .......... .......... .......... .......... 43% 11.0M 1s
   550K .......... .......... .......... .......... .......... 47%  860K 1s
   600K .......... .......... .......... .......... .......... 51% 4.60M 1s
   650K .......... .......... .......... .......... .......... 55% 9.50M 1s
   700K .......... .......... .......... .......... .......... 59% 11.0M 0s
   750K .......... .......... .......... .......... .......... 63% 11.0M 0s
   800K .......... .......... .......... .......... .......... 67% 10.8M 0s
   850K .......... .......... .......... .......... .......... 71% 13.9M 0s
   900K .......... .......... .......... .......... .......... 75% 1.08M 0s
   950K .......... .......... .......... .......... .......... 79% 6.56M 0s
  1000K .......... .......... .......... .......... .......... 83% 6.30M 0s
  1050K .......... .......... .......... .......... .......... 87% 6.83M 0s
  1100K .......... .......... .......... .......... .......... 91% 7.73M 0s
  1150K .......... .......... .......... .......... .......... 95% 10.9M 0s
  1200K .......... .......... .......... .......... .......... 99% 11.3M 0s
  1250K ......                                                100% 64.6M=0.7s

2017-07-06 21:29:58 (1.66 MB/s) - '/usr/local/bin/gosu' saved [1286720/1286720]

+ wget -O /usr/local/bin/gosu.asc https://github.com/tianon/gosu/releases/download/1.10/gosu-amd64.asc
--2017-07-06 21:29:58--  https://github.com/tianon/gosu/releases/download/1.10/gosu-amd64.asc
Resolving github.com (github.com)... 192.30.255.112, 192.30.255.113
Connecting to github.com (github.com)|192.30.255.112|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://github-production-release-asset-2e65be.s3.amazonaws.com/19708981/0afb862e-8591-11e6-8c1a-503ca4b54c7c?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20170706%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20170706T212958Z&X-Amz-Expires=300&X-Amz-Signature=22295671bf3d1fc4b4846fc80319969985143609f3b1782505232bd5d52d4125&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3Dgosu-amd64.asc&response-content-type=application%2Foctet-stream [following]
--2017-07-06 21:29:58--  https://github-production-release-asset-2e65be.s3.amazonaws.com/19708981/0afb862e-8591-11e6-8c1a-503ca4b54c7c?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20170706%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20170706T212958Z&X-Amz-Expires=300&X-Amz-Signature=22295671bf3d1fc4b4846fc80319969985143609f3b1782505232bd5d52d4125&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3Dgosu-amd64.asc&response-content-type=application%2Foctet-stream
Resolving github-production-release-asset-2e65be.s3.amazonaws.com (github-production-release-asset-2e65be.s3.amazonaws.com)... 52.216.192.16
Connecting to github-production-release-asset-2e65be.s3.amazonaws.com (github-production-release-asset-2e65be.s3.amazonaws.com)|52.216.192.16|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 543 [application/octet-stream]
Saving to: '/usr/local/bin/gosu.asc'

     0K                                                       100% 12.1M=0s

2017-07-06 21:29:58 (12.1 MB/s) - '/usr/local/bin/gosu.asc' saved [543/543]

+ mktemp -d
+ export GNUPGHOME=/tmp/tmp.eNHRnyI0Ig
+ gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
gpg: keybox '/tmp/tmp.eNHRnyI0Ig/pubring.kbx' created
gpg: /tmp/tmp.eNHRnyI0Ig/trustdb.gpg: trustdb created
gpg: key 036A9C25BF357DD4: public key "Tianon Gravi <tianon@tianon.xyz>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1
+ gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu
gpg: Signature made Wed Sep 28 22:22:56 2016 UTC
gpg:                using RSA key 036A9C25BF357DD4
gpg: Good signature from "Tianon Gravi <tianon@tianon.xyz>" [unknown]
gpg:                 aka "Tianon Gravi <tianon@debian.org>" [unknown]
gpg:                 aka "Tianon Gravi <tianon@dockerproject.org>" [unknown]
gpg:                 aka "Andrew Page (tianon) <andrew@infosiftr.com>" [unknown]
gpg:                 aka "Andrew Page (tianon) <andrew@vitalroute.com>" [unknown]
gpg:                 aka "Andrew Page (Tianon Gravi) <admwiggin@gmail.com>" [unknown]
gpg:                 aka "Tianon Gravi (Andrew Page) <tianon@infosiftr.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: B42F 6819 007F 00F8 8E36  4FD4 036A 9C25 BF35 7DD4
+ rm -r /tmp/tmp.eNHRnyI0Ig /usr/local/bin/gosu.asc
+ chmod +x /usr/local/bin/gosu
+ gosu nobody true
+ apt-get purge -y --auto-remove ca-certificates wget gnupg2 dirmngr
Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be REMOVED:
  ca-certificates* dirmngr* gnupg2* libffi6* libgmp10* libgnutls30*
  libhogweed4* libidn11* libidn2-0* libldap-2.4-2* libldap-common* libnettle6*
  libp11-kit0* libpsl5* libsasl2-2* libsasl2-modules-db* libssl1.1*
  libtasn1-6* libunistring0* openssl* wget*
0 upgraded, 0 newly installed, 21 to remove and 0 not upgraded.
After this operation, 16.6 MB disk space will be freed.
(Reading database ... 6978 files and directories currently installed.)
Removing ca-certificates (20161130+nmu1) ...
Removing dangling symlinks from /etc/ssl/certs... done.
Removing dirmngr (2.1.18-6) ...
Removing gnupg2 (2.1.18-6) ...
Removing libldap-2.4-2:amd64 (2.4.44+dfsg-5) ...
Removing wget (1.18-5) ...
Removing libgnutls30:amd64 (3.5.8-5+deb9u1) ...
Removing libp11-kit0:amd64 (0.23.3-2) ...
Removing libffi6:amd64 (3.2.1-6) ...
Removing libhogweed4:amd64 (3.3-1+b1) ...
Removing libgmp10:amd64 (2:6.1.2+dfsg-1) ...
Removing libidn11:amd64 (1.33-1) ...
Removing libpsl5:amd64 (0.17.0-3) ...
Removing libidn2-0:amd64 (0.16-1) ...
Removing libldap-common (2.4.44+dfsg-5) ...
Removing libnettle6:amd64 (3.3-1+b1) ...
Removing libsasl2-2:amd64 (2.1.27~101-g0780600+dfsg-3) ...
Removing libsasl2-modules-db:amd64 (2.1.27~101-g0780600+dfsg-3) ...
Removing openssl (1.1.0f-3) ...
Removing libssl1.1:amd64 (1.1.0f-3) ...
Removing libtasn1-6:amd64 (4.10-1.1) ...
Removing libunistring0:amd64 (0.9.6+really0.9.3-0.1) ...
Processing triggers for libc-bin (2.24-11+deb9u1) ...
(Reading database ... 6473 files and directories currently installed.)
Purging configuration files for libldap-common (2.4.44+dfsg-5) ...
Purging configuration files for libssl1.1:amd64 (1.1.0f-3) ...
debconf: unable to initialize frontend: Dialog
debconf: (TERM is not set, so the dialog frontend is not usable.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (Can't locate Term/ReadLine.pm in @INC (you may need to install the Term::ReadLine module) (@INC contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.24.1 /usr/local/share/perl/5.24.1 /usr/lib/x86_64-linux-gnu/perl5/5.24 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.24 /usr/share/perl/5.24 /usr/local/lib/site_perl /usr/lib/x86_64-linux-gnu/perl-base .) at /usr/share/perl5/Debconf/FrontEnd/Readline.pm line 7.)
debconf: falling back to frontend: Teletype
Purging configuration files for openssl (1.1.0f-3) ...
dpkg: warning: while removing openssl, directory '/etc/ssl/certs' not empty so not removed
Purging configuration files for wget (1.18-5) ...
Purging configuration files for ca-certificates (20161130+nmu1) ...
debconf: unable to initialize frontend: Dialog
debconf: (TERM is not set, so the dialog frontend is not usable.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (Can't locate Term/ReadLine.pm in @INC (you may need to install the Term::ReadLine module) (@INC contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.24.1 /usr/local/share/perl/5.24.1 /usr/lib/x86_64-linux-gnu/perl5/5.24 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.24 /usr/share/perl/5.24 /usr/local/lib/site_perl /usr/lib/x86_64-linux-gnu/perl-base .) at /usr/share/perl5/Debconf/FrontEnd/Readline.pm line 7.)
debconf: falling back to frontend: Teletype
Removing dangling symlinks from /etc/ssl/certs... done.
Purging configuration files for dirmngr (2.1.18-6) ...
 ---> 6ae4867bc446
Removing intermediate container cf03d43d6884
Successfully built 6ae4867bc446
tianon commented 7 years ago

Additionally, gosu is packaged in Stretch, so you could simply install via apt-get instead if you'd rather: https://packages.debian.org/stretch/gosu

eleidan commented 7 years ago

That rocks!!! Thank you! :+1:

eleidan commented 7 years ago

@tianon That works on local host (I can't reproduce this locally either), but fails with error on DockerHub :confused: Anyway, installing gosu from repos works like a charm :wink:

tianon commented 7 years ago

Glad to hear it! :+1: