apt-get updateでthe public key is not available: NO_PUBKEY

概要

CircleCIのテストが上記のエラーでコケました。ログインして試してみるとapt-get updateを実行してるところでエラーが出ていました。全部載せるとこんな感じです。

Get:1 http://deb.debian.org/debian bullseye InRelease [116 kB]
Get:2 http://security.debian.org/debian-security bullseye-security InRelease [44.1 kB]
Get:3 http://deb.debian.org/debian bullseye-updates InRelease [44.1 kB]        
Get:4 https://dl.google.com/linux/chrome/deb stable InRelease [1811 B]         
Get:5 http://deb.debian.org/debian bullseye/main amd64 Packages [8182 kB]
Get:6 http://deb.debian.org/debian bullseye-updates/main amd64 Packages.diff/Index [8361 B]
Get:7 http://deb.debian.org/debian bullseye-updates/main amd64 Packages T-2022-06-11-2007.01-F-2022-01-24-2024.03.pdiff [1188 B]
Get:7 http://deb.debian.org/debian bullseye-updates/main amd64 Packages T-2022-06-11-2007.01-F-2022-01-24-2024.03.pdiff [1188 B]
Get:8 http://security.debian.org/debian-security bullseye-security/main amd64 Packages [166 kB]
Err:4 https://dl.google.com/linux/chrome/deb stable InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 4EB27DB2A3B88B8B
Reading package lists... Done
N: Repository 'http://deb.debian.org/debian bullseye InRelease' changed its 'Version' value from '11.1' to '11.4'
W: GPG error: https://dl.google.com/linux/chrome/deb stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 4EB27DB2A3B88B8B
E: The repository 'https://dl.google.com/linux/chrome/deb stable InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Exited with code exit status 100

解決策

エラー文にあるNO_PUBKEY 4EB27DB2A3B88B8Bのキーをaptのkeyマネージャー登録すれば解決できます。

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4EB27DB2A3B88B8B

今回はcircleci上での出来事で、circle側のdockerイメージで対応する案件な気もしますが、さしあたり.circleci/config.ymlに登録しちゃいました。よく探したら対応したimageとかあるかもですが・・・

version: 2.1
jobs:
  build:
    docker:
      - image: circleci/ruby:3.0.3-browsers
        environment:
          RAILS_ENV: test
          MYSQL_HOST: 127.0.0.1
          MYSQL_USERNAME: "root"
          MYSQL_PASSWORD: ""
          MYSQL_PORT: 3306
      - image: circleci/mariadb:10.3.9
        environment:
          MYSQL_DATABASE: test_database
          MYSQL_ALLOW_EMPTY_PASSWORD: true
          MYSQL_ROOT_HOST: "%"
    working_directory: ~/test_dir
    steps:
      - run:
          name: Install depencies
          command: |
            sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4EB27DB2A3B88B8B
            sudo apt-get update --allow-releaseinfo-change

解説

スバリこちらのサイトで答えを見つけました。

https://chrisjean.com/fix-apt-get-update-the-following-signatures-couldnt-be-verified-because-the-public-key-is-not-available/

いわく・・・

The apt packaging system has a set of trusted keys that determine whether a package can be authenticated and therefore trusted to be installed on the system. Sometimes the system does not have all the keys it needs and runs into this issue. Fortunately, there is a quick fix. Each key that is listed as missing needs to be added to the apt key manager so that it can authenticate the packages.

超ざっくり翻訳すると・・・

aptのパッケージングシステムは信頼性をチェックするのに鍵のセットを持っていて、たまにシステム側に鍵が足りなことがります。鍵マネージャーに対象のキーを登録してやれば簡単に解決できます。