No PubKey for Intel MKL libraries

[jcchuang]

Not sure if it's a universal issue (or a universal workaround)...

I ran into the following error when building the docker image. As a workaround, I was able to proceed by modifying Dockerfile and changing the PubKey from GPG-PUB-KEY-INTEL-SW-PRODUCTS-2019.PUB to GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB.

If this is a proper solution/workaround, I can also repost this issue as a pull request.

0.720 Get:4 https://apt.repos.intel.com/mkl all InRelease [4438 B]
0.741 Hit:5 http://security.ubuntu.com/ubuntu focal-security InRelease
0.849 Err:4 https://apt.repos.intel.com/mkl all InRelease
0.849   The following signatures couldn't be verified because the public key is not available: NO_PUBKEY BAC6F0C353D04109
0.947 Reading package lists...
1.890 W: GPG error: https://apt.repos.intel.com/mkl all InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY BAC6F0C353D04109
1.890 E: The repository 'https://apt.repos.intel.com/mkl all InRelease' is not signed.
------
Dockerfile:23
--------------------
  22 |         wget -qO- 'https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS-2019.PUB' |  apt-key add -
  23 | >>> RUN sh -c 'echo deb https://apt.repos.intel.com/mkl all main > /etc/apt/sources.list.d/intel-mkl.list' && \
  24 | >>>     apt-get update && \
  25 | >>>     apt-get install -y intel-mkl-64bit-2020.0-088
  26 |     
--------------------
ERROR: failed to solve: process "/bin/sh -c sh -c 'echo deb https://apt.repos.intel.com/mkl all main > /etc/apt/sources.list.d/intel-mkl.list' &&     apt-get update &&     apt-get install -y intel-mkl-64bit-2020.0-088" did not complete successfully: exit code: 100
make: *** [build-docker] Error 1

[eu9ene]

We haven't touched this repo for a while. Yes, the intel key should be updated. We made a similar fix here:

https://github.com/mozilla/firefox-translations-models/blob/e03ba4ea06654fbda159d22ab0c26f9fd71d400d/evals/Dockerfile#L16

PRs are welcome :)

[jcchuang]

As of today (February 12, 2024), the generic PubKey GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB is the same as the 2023 version of the PubKey GPG-PUB-KEY-INTEL-SW-PRODUCTS-2023.PUB. (There is no 2024 version.)

Do you have a preference for using the generic or the year-specific PubKey? The PR currently uses the generic version, but I can also modify the PR to use the 2023 version.

#28

[eu9ene]

Thank you for fixing! I don't have a preference and not sure what's the difference from usage perspective. Whatever will last longer is likely a better option (probably generic one?).

[jcchuang]

I agree with you that we probably should go with the generic one.

Under other circumstances, I would typically freeze the code by using matching year-specific library and key(s).

In this case, however, it seems like Intel periodically re-signs their libraries using the latest key. If I have to take a guess, I would go with the generic/latest key so that the PubKey file matches the (latest) key used to sign the library.