public key is not available: NO_PUBKEY F76221572C52609D - linux

Question

For the below docker file:
FROM microsoft/aspnetcore-build:1.0.1
ENV DOTNET_SKIP_FIRST_TIME_EXPERIENCE 1
# This is FROM openjdk:8-jdk
RUN apt-get update && apt-get install -y --no-install-recommends \
bzip2 \
unzip \
xz-utils \
apt-transport-https \
&& rm -rf /var/lib/apt/lists/*
RUN echo 'deb http://deb.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list
RUN echo 'deb https://apt.dockerproject.org/repo debian-jessie main' > /etc/apt/sources.list.d/docker.list
# Default to UTF-8 file.encoding
ENV LANG C.UTF-8
# add a simple script that can auto-detect the appropriate JAVA_HOME value
# based on whether the JDK or only the JRE is installed
RUN { \
echo '#!/bin/sh'; \
echo 'set -e'; \
echo; \
echo 'dirname "$(dirname "$(readlink -f "$(which javac || which java)")")"'; \
} > /usr/local/bin/docker-java-home \
&& chmod +x /usr/local/bin/docker-java-home
ENV JAVA_HOME /usr/lib/jvm/java-8-openjdk-amd64
ENV JAVA_VERSION 8u111
ENV JAVA_DEBIAN_VERSION 8u111-b14-2~bpo8+1
# see https://bugs.debian.org/775775
# and https://github.com/docker-library/java/issues/19#issuecomment-70546872
ENV CA_CERTIFICATES_JAVA_VERSION 20140324
RUN set -x \
&& apt-get update \
&& apt-get install -y \
openjdk-8-jdk="$JAVA_DEBIAN_VERSION" \
ca-certificates-java="$CA_CERTIFICATES_JAVA_VERSION" \
&& rm -rf /var/lib/apt/lists/* \
&& [ "$JAVA_HOME" = "$(docker-java-home)" ]
# see CA_CERTIFICATES_JAVA_VERSION notes above
RUN /var/lib/dpkg/info/ca-certificates-java.postinst configure
##### END OF THE JDK
##### START Jenkins Slave Node Config settings
# Create Jenkins User
RUN useradd jenkins -m -s /bin/bash
RUN chown -R jenkins /home/jenkins
RUN chgrp -R jenkins /home/jenkins
RUN chown -R jenkins /tmp
RUN chgrp -R jenkins /tmp
# Add the jenkins user to sudoers
RUN echo "jenkins ALL=(ALL) ALL" >> etc/sudoers
# Must install docker to create docker images from docker container. Inception. Head... hurts.
# container must be called with -v /var/run/docker.sock:/var/run/docker.sock
RUN apt-get install -y --no-install-recommends apt-transport-https ca-certificates
RUN apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 58118E89F3A912897C070ADBF76221572C52609D
RUN apt-get update && apt-get install -y --no-install-recommends \
docker-engine \
&& rm -rf /var/lib/apt/lists/*
# This must run after the docker install
RUN gpasswd -a jenkins docker
USER jenkins
build image is failing for command at line #38
RUN set -x \
&& apt-get update \
&& apt-get install -y \
openjdk-8-jdk="$JAVA_DEBIAN_VERSION" \
ca-certificates-java="$CA_CERTIFICATES_JAVA_VERSION" \
&& rm -rf /var/lib/apt/lists/* \
&& [ "$JAVA_HOME" = "$(docker-java-home)" ]
with error:
W: GPG error: https://apt.dockerproject.org debian-jessie InRelease:
The following signatures couldn't be verified because the public key
is not available: NO_PUBKEY F76221572C52609D
W: There is no public key available for the following key IDs:
AA8E81B4331F7F50
W: Failed to fetch http://deb.debian.org/debian/dists/jessie-backports/main/binary-amd64/Packages
404 Not Found
E: Some index files failed to download. They have been ignored, or old ones used instead.
ERROR: Service 'slavedotnet' failed to build: The command '/bin/sh -c set -x && apt-get update && apt-get install -y openjdk-8-jdk="$JAVA_DEBIAN_VERSION"
ca-certificates-java="$CA_CERTIFICATES_JAVA_VERSION" && rm -rf
/var/lib/apt/lists/* && [ "$JAVA_HOME" = "$(docker-java-home)" ]'
returned a non-zero code: 100
How public key error can get resolved?

Answer 1

There are several issues here:
1) W: GPG error: https://apt.dockerproject.org debian-jessie InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F76221572C52609D
W: There is no public key available for the following key IDs:
AA8E81B4331F7F50
Solution:
Move the keyserver add actions to the place before RUN echo 'deb http://deb.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list, meanwhile add AA8E81B4331F7F50 also as next:
RUN apt-get install -y --no-install-recommends apt-transport-https ca-certificates
RUN apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 58118E89F3A912897C070ADBF76221572C52609D
RUN apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys AA8E81B4331F7F50
2) W: Failed to fetch http://deb.debian.org/debian/dists/jessie-backports/main/binary-amd64/Packages 404 Not Found
E: Some index files failed to download. They have been ignored, or old ones used instead.
Solution:
microsoft/aspnetcore-build:1.0.1 base on debian8, and you want to use openjdk8 which was default not in apt repository. So you use deb http://deb.debian.org/debian jessie-backports main.
Unfortunately, if you check http://ftp.debian.org/debian/dists/, you will find jessie-backports had been removed. So you had to switch to archived url like next (Comment the old url, just use the url next):
#RUN echo 'deb http://deb.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list
RUN echo 'deb http://archive.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list
Meanwhile, you had to add next after doing above to resolve release-file-expired-problem:
RUN echo "Acquire::Check-Valid-Until \"false\";" > /etc/apt/apt.conf.d/100disablechecks
3) ENV JAVA_VERSION 8u111
ENV JAVA_DEBIAN_VERSION 8u111-b14-2~bpo8+1
Solution:
Not sure how you get this version, but in fact after change to archive jessie backports, what you could get is something like next:
root#2ecaeffec483:/etc/apt# apt-cache policy openjdk-8-jdk
openjdk-8-jdk:
Installed: (none)
Candidate: 8u171-b11-1~bpo8+1
Version table:
8u171-b11-1~bpo8+1 0
100 http://archive.debian.org/debian/ jessie-backports/main amd64 Packages
So, you had to change to next:
ENV JAVA_VERSION 8u171
ENV JAVA_DEBIAN_VERSION 8u171-b11-1~bpo8+1

Answer 2

This script will automatically add most missing GPG keys:
#!/bin/bash
set -e
for PUBKEY in $(apt-get update 2>&1 | grep NO_PUBKEY | awk '{print $NF}')
do
wget -q "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${PUBKEY}" -O - | sed -n '/BEGIN/,/END/p' | apt-key add - 2>/dev/null
done
The only prerequisite is to have wget installed. It can also be used with curl.

Answer 3

To fix the below:
W: There is no public key available for the following key IDs:
AA8E81B4331F7F50
Just use the below code:
sudo apt-get install debian-keyring debian-archive-keyring
sudo apt-key update
sudo apt-get update