[Packaging] APT repository sign doesn't work on Debian trixie

[kou]

Describe the bug, including details regarding any error messages, version, and platform.

https://github.com/ursacomputing/crossbow/actions/runs/12491251505/job/34857011325#step:17:589

  Err:1 file:/host/dev/release/../../dev/tasks/linux-packages/apt/repositories/debian trixie InRelease
    The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1729E5EF3EF74D10
  Hit:2 http://deb.debian.org/debian trixie InRelease
  Hit:3 http://deb.debian.org/debian trixie-updates InRelease
  Hit:4 http://deb.debian.org/debian-security trixie-security InRelease
  Get:5 http://deb.debian.org/debian trixie/non-free amd64 Packages [98.7 kB]
  Get:6 http://deb.debian.org/debian trixie/contrib amd64 Packages [51.0 kB]
  Reading package lists...
  Warning: file:/host/dev/release/../../dev/tasks/linux-packages/apt/repositories/debian/dists/trixie/InRelease: The key(s) in the keyring /usr/share/keyrings/apache-arrow-apt-source.gpg are ignored as the file has an unsupported filetype.
  Warning: GPG error: file:/host/dev/release/../../dev/tasks/linux-packages/apt/repositories/debian trixie InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1729E5EF3EF74D10
  Error: The repository 'file:/host/dev/release/../../dev/tasks/linux-packages/apt/repositories/debian trixie InRelease' is not signed.
  rake aborted!

Component(s)

Packaging

[raulcd]

how is the KEYS file generated? I can't seem to find where we generate /dev/tasks/linux-packages/KEYS:

   + gpg --no-default-keyring --keyring /usr/share/keyrings/apache-arrow-apt-source.gpg --import /host/dev/release/../../dev/tasks/linux-packages/KEYS
  gpg: directory '/root/.gnupg' created
  gpg: /root/.gnupg/trustdb.gpg: trustdb created
  gpg: key 1729E5EF3EF74D10: public key "Test <test@example.com>" imported
  gpg: Total number processed: 1
  gpg:               imported: 1

[kou]

Ah, it's generated here:

arrow/dev/tasks/linux-packages/github.linux.yml

Lines 101 to 108 in f5c340b

	(echo "Key-Type: RSA"; \
	echo "Key-Length: 4096"; \
	echo "Name-Real: Test"; \
	echo "Name-Email: test@example.com"; \
	echo "%no-protection") | \
	gpg --full-generate-key --batch
	GPG_KEY_ID=$(gpg --list-keys --with-colon test@example.com | grep fpr | cut -d: -f10)
	echo "GPG_KEY_ID=${GPG_KEY_ID}" >> ${GITHUB_ENV}

FYI: This happens with the current released apache-arrow-apt-source too: https://github.com/groonga/groonga/actions/runs/12499316173/job/34876380693?pr=2166#step:10:506
9.523 Err:4 https://apache.jfrog.io/artifactory/arrow/debian trixie InRelease
9.523 The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 91D18FCF079F8007
10.02 Get:5 https://packages.groonga.org/debian trixie InRelease [9539 B]

10.45 Warning: https://apache.jfrog.io/artifactory/arrow/debian/dists/trixie/InRelease: The key(s) in the keyring /usr/share/keyrings/apache-arrow-apt-source.gpg are ignored as the file has an unsupported filetype.
10.45 Warning: GPG error: https://apache.jfrog.io/artifactory/arrow/debian trixie InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 91D18FCF079F8007
10.45 Error: The repository 'https://apache.jfrog.io/artifactory/arrow/debian trixie InRelease' is not signed.

I thought that this problem and the current released apache-arrow-apt-source have the same problem but it may be a different problem...

[kou]

How to generate apache-arrow-apt-source.gpg:

arrow/dev/tasks/linux-packages/apache-arrow-apt-source/debian/rules

Lines 13 to 16 in f5c340b

	gpg \
	--no-default-keyring \
	--keyring ./apache-arrow-apt-source.gpg \
	--import KEYS

[raulcd]

It seems like a different issue but the 91D18FCF079F8007 seems to be your public key, right? (below extracted from the public keys file)

sig          91D18FCF079F8007 2010-08-30  Kouhei Sutou <kou@cozmixng.org>

The key has more than 14 years, I am unsure how they are validating the public KEYS now but probably something has changed on the process. Do you know if this is something new?

[kou]

Yes. It's my public key used for the latest release.

https://salsa.debian.org/apt-team/apt/-/merge_requests/409/diffs#e3f4163114eae4ff41ebb44a774fddac10b4e6a7_0_122 may be related. We're using the "GPG keybox database" format but it accepts only the "OpenPGP Public Key" formats.

Hmm. It seems that we need to use armor-ed format for keyring: https://salsa.debian.org/apt-team/apt/-/merge_requests/409/diffs#e3f4163114eae4ff41ebb44a774fddac10b4e6a7_0_96

[kou]

Ah, the merge request may not be related.
https://salsa.debian.org/apt-team/apt/-/merge_requests/407 may be related.

[kou]

Issue resolved by pull request 45131
#45131