The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C

Question

I am trying to use Ubuntu 20 or Ubuntu 22 in Docker. My Dockerfile is:

from ubuntu:22.04
run DEBIAN_FRONTEND=noninteractive apt update

I build this with docker build .. The result is:

Sending build context to Docker daemon  2.048kB
Step 1/2 : from ubuntu:22.04
---> 2dc39ba059dc
Step 2/2 : run DEBIAN_FRONTEND=noninteractive apt update
---> Running in b15002ae9dd5

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
Get:1 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB] 
Get:2 http://security.ubuntu.com/ubuntu jammy-security 
InRelease [110 kB] 
Get:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [114 kB] 
Get:4 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [99.8 kB] Err:1 http://archive.ubuntu.com/ubuntu jammy InRelease   
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C 

I get this message repeated several times, until I get:

W: http://archive.ubuntu.com/ubuntu/dists/jammy/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg are ignored as the file is not readable by user '_apt' executing apt-key.

I have tried to chmod a+rwx /etc/apt -R as the first run command in the Dockerfile but it made no difference.

I have also explicitly run docker pull ubuntu:22.04 and it said it was already up-to-date. I have the exact same problem with the ubuntu:20.04 image.

I have consulted all other web sources referring to this problem, but they all require me to be able to run apt install apt-key or something else, but I can't update apt to start with so nothing works, besides the first 3 pages of search engine hits just showing how to install Docker on Ubuntu and not the other way around.

I have also tried --security-opt seccomp:unconfined as mentioned in another answer. That responded with Error response from daemon: The daemon on this platform does not support setting security options on build.

So my image doesn't have curl, wget or gnupg and I can't install it without getting this working. When I do anything with apt-key I get: E: gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of them is required for this operation

I have managed to install gnupg manually from the deb file, and manually receiving the key, which gives a similar error message:

# apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 871920D1991BC93C
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
Executing: /tmp/apt-key-gpghome.rQuYmKpjpo/gpg.1.sh --keyserver keyserver.ubuntu.com --recv-keys 871920D1991BC93C
gpg: requesting key 991BC93C from hkp server keyserver.ubuntu.com
gpg: key 991BC93C: public key "Ubuntu Archive Automatic Signing Key (2018) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA:  1)
W: The key(s) in the keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg are ignored as the file is not readable by user '' executing apt-key.

I have also tried trimming down /etc/apt/source.list to the minimum. Same problem.

How can I add the required key from the host?

As a secondary question, how can such a mainstream tool, and distribution, be broken? Has everybody moved on to something else, and what is it? I do not have good internet access so keeping up to date with what is happening in the computer world is a challenge.

Palaeography

This isn't really a programming or code-related issue, and should instead be on Ask Ubuntu. – Walleye

How can I move it? This is for programming because it is the foundation on which I need to compile something else and I am not sure if it is a docker or Debian problem? – Palaeography

Askubuntu also says I have to wait 40 minutes before I can post it, and it also says I don't have enough reputation to add tags. Would you be so kind so as to move it? – Palaeography

Ever solve this? I can't seem to install docker either on ubuntu 20.04 for the same reasons. – Skittish

Answer 1

Just upgrade the docker on the host. https://docs.docker.com/engine/install/ubuntu/

This is a rare incompatibility of a new syscall to protect keys, that older Docker doesn't support. There is no way to patch Ubuntu to work on old Docker, I spent half a day trying.

Boethius

OMG you are a lifesaver - I spent an entire day trying different gpg / apt-key approaches and this was the answer. Thanks so much! – Siegbahn

Answer 2

For older docker versions, the last working ubuntu version is 18.04

Countess

Answer 3

NOTE: I am running Ubuntu through Windows Subsystem for Linux (WSL) and using Docker Engine. Unsure if method will work for those using Docker Desktop.

The issue I had was similar. It didn't let me download from Jammy repository because it couldn't be verified.

So I cleaned the local cache and forcibly downloaded Jammy.

sudo apt-get clean
sudo apt-get update --allow-insecure-repositories

Then I installed Docker again.

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose-plugin

Tested if Docker working properly via:

sudo docker run hello-world

Fawnia