PGP key expiration

[tianon]

Looks like https://bugs.mysql.com/bug.php?id=85029 has resurged today with an expiration of the PGP key used for signing MySQL releases. 😅

It appears that RPM/DNF/YUM don't mind the key being expired, but APT sure does, and fails our (re)builds on 8.0 and 5.7 (Debian-based images).

@ltangvald do you think there's a chance of this key getting a renewed expiration date? If not, we'll probably consider applying something like https://github.com/debuerreotype/debuerreotype/blob/60b625d1ce31bd81525bb67fc3a33f9686bc3433/scripts/.gpgv-ignore-expiration.sh during our build instead (so we still get the cryptographic benefits of PGP but without honoring/failing on the expiration date).

For reference:

root@dddeed483b62:/# wget -qO- 'https://repo.mysql.com/RPM-GPG-KEY-mysql-2022' | gpg --import
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 467B942D3A79BD29: public key "MySQL Release Engineering <mysql-build@oss.oracle.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
root@dddeed483b62:/# wget -qO- 'https://repo.mysql.com/RPM-GPG-KEY-mysql' | gpg --import
gpg: key 8C718D3B5072E1F5: public key "MySQL Release Engineering <mysql-build@oss.oracle.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
root@dddeed483b62:/# gpg --fingerprint
/root/.gnupg/pubring.kbx
------------------------
pub   rsa4096 2021-12-14 [SC] [expired: 2023-12-14]
      859B E8D7 C586 F538 430B  19C2 467B 942D 3A79 BD29
uid           [ expired] MySQL Release Engineering <mysql-build@oss.oracle.com>

pub   dsa1024 2003-02-03 [SCA] [expired: 2022-02-16]
      A4A9 4068 76FC BD3C 4567  70C8 8C71 8D3B 5072 E1F5
uid           [ expired] MySQL Release Engineering <mysql-build@oss.oracle.com>

[hiroshinakasone]

Is b7b3b788a8d3785c new key?

https://keyserver.ubuntu.com/pks/lookup?search=mysql-build%40oss.oracle.com&fingerprint=on&op=index

[glennslaven]

If you're just looking to build a docker file from the MySQL Debian images you can just add this

rm /etc/apt/sources.list.d/mysql.list

to your Dockerfile or run in your container before doing any apt operations. Since the MySQL resources are already included in the image, you probably don't need to apt-get install any of them anyway.

[tianon]

Oh interesting, https://repo.mysql.com/RPM-GPG-KEY-mysql-2023 wasn't listed on https://repo.mysql.com/ yesterday 👀

This does require that Oracle / MySQL re-sign their APT repo with the new key if we're supposed to swap though, and I'm not sure yet if they've done that step.

root@519c19c8b144:/# wget -qO- 'https://repo.mysql.com/RPM-GPG-KEY-mysql-2023' | gpg --import
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key B7B3B788A8D3785C: public key "MySQL Release Engineering <mysql-build@oss.oracle.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
root@519c19c8b144:/# gpg --fingerprint
/root/.gnupg/pubring.kbx
------------------------
pub   rsa4096 2023-10-23 [SC] [expires: 2025-10-22]
      BCA4 3417 C3B4 85DD 128E  C6D4 B7B3 B788 A8D3 785C
uid           [ unknown] MySQL Release Engineering <mysql-build@oss.oracle.com>
sub   rsa4096 2023-10-23 [E] [expires: 2025-10-22]

[Cartman75]

They have been uploaded to debian, we have been able to use the new signed copies. I dont know about other distrabutions.

[mtovmassian]

@glennslaven thank you for the workaround and @yosifkit thank you for the fix. Can we estimate when it will be available through the Docker mysql:5.7-debian image ?

[yosifkit]

@yosifkit thank you for the fix. Can we estimate when it will be available through the Docker mysql:5.7-debian image ?

It will not be updated; the 5.7-debian images were dropped a while back when the packages were no longer updated: #987 (https://www.mysql.com/support/eol-notice.html, "Support EOL for Debian 10")

[farazsiddiqui2010]

What about the older images like mysql:5.7.42-debian. It should be supported as many productions are running with it.

[tianon]

Unfortunately, we cannot control MySQL upstream's support or end of life (we're merely packagers of what they publish).

[tianon]

"Hooray", hitting the RPM repos now 😄