Failed to verify keys when building image

PostgreSQL Percona Operator for PostgreSQL
1

Description:

I am trying to build a PostgreSQL image from this repository GitHub - percona/percona-docker: Collection of Dockerfiles for Percona software. See individual directories for more details. from the commit with tag pg-operator-2.4.0 (same goes for earlier versions as well) but it fails with the following error:

[user@host postgresql-containers]$ docker build -f build/postgres/Dockerfile .
[...]
4.662 + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm
4.665   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
4.665                                  Dload  Upload   Total   Spent    Left  Speed
100 27900  100 27900    0     0  96539      0 --:--:-- --:--:-- --:--:-- 96539
4.956 + rpmkeys --checksig /tmp/percona-release.rpm
4.960 /tmp/percona-release.rpm: digests SIGNATURES NOT OK

Steps to Reproduce:

  1. Clone the repo GitHub - percona/percona-docker: Collection of Dockerfiles for Percona software. See individual directories for more details.
  2. From the top level folder of the repo run:
    docker build -f postgresql-containers/build/postgres/Dockerfile postgresql-containers/
2

Hi Marios,

Please pull latest changes of percona-docker repository.
Fix was merged 5 hours ago.

Thank you.

3

Hi @Vadim_Yalovets ,

Where is this fix merged? I am looking at the commits with tag pg-operator-* (e.g., pg-operator-2.4.0) and I am having the same problem.

4
5

Thanks @Vadim_Yalovets,

This seems to only have been merged to the main branch. Is there a plan to move this to the rest of the releases?

This actually is a hint for an actual problem: The releases (e.g., pg-operator-2.4.0) should not point to the percona-release-latest.noarch.rpm package, but they should rather point to the package they have been tested (e.g… percona-release-1.0-27.noarch.rpm). This is important for having reproducible builds, and avoid similar problems in the future.

My understanding is that currently all the builds from the old releases are broken, and only the main branch works. Is my understanding correct?

6

Hi @Marios_Cako, We have a plan to improve our builds. I hope starting from next release we will use static versions.