apt-get update fails when using gitpod/workspace-full-vnc

[ChristianHuff-DEV]

Bug description

When using the Image gitpod/workspace-full-vnc running sudo apt-get update inside the workspace fails due to the following error:

W: GPG error: http://download.opensuse.org/repositories/home:/ungoogled_chromium/Ubuntu_Focal  InRelease: The following signatures were invalid: EXPKEYSIG 02456C79B2FD48BF home:ungoogled_chromium OBS Project <home:[email protected]>
E: The repository 'http://download.opensuse.org/repositories/home:/ungoogled_chromium/Ubuntu_Focal  InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Steps to reproduce

1. Open a workspace configured to use the image gitpod/workspace-full-vnc
2. Open a terminal and run sudo apt-get update

Workspace affected

All workspaces using the image. (i.e. https://christianhuf-updatetest-2d0tybv92zw.ws-eu51.gitpod.io/)

Expected behavior

No error occurs and the update command finishes.

Example repository

https://github.com/ChristianHuff-DEV/update-test

Anything else?

Using the default image the error isn't reproducable.

[kylos101]

@axonasif were you working this issue? I ask because it was set to in-progress on the project, but, there is no assignee. Lemme know?

[axonasif]

@axonasif were you working this issue? I ask because it was set to in-progress on the project, but, there is no assignee. Lemme know?

Umm yes, I do intend to work on it. However in this particular case I was testing out a github to slack integration 🙈
Sorry if that caused confusion 😅

[J0F3]

I have the same problem. Any news how to fix that?
Thx!

[ChristianHuff-DEV]

As a workaround I removed the source list entry in my .gitpod.Dockerfile:

RUN sudo rm /etc/apt/sources.list.d/ungoogled_chromium.list

Not sure what the impact of that is. Probably Chromium won't be installed?

[J0F3]

Thanks @ChristianHuff-DEV. I am also doing that for now.
As long as you do not install any packages from "ungoogled_chromium" by our own it should not have any impact at all. Chromium is still in the Image as it was already installed at built time of gitpod/workspace-full-vnc itself.

[axonasif]

Seems like ungoogled-chromium isn't well maintained.

See:

• Unable to update due key expired (EXPKEYSIG 02456C79B2FD48BF) ungoogled-software/ungoogled-chromium-debian#303
• Repository maintenance ungoogled-software/ungoogled-chromium-debian#301

Falling back to google-chrome with a few additional tweaks at #875:

• Disable welcome screen
• Disable 'set as default browser' prompt

to make it a bit more development focused.

[J0F3]

@axonasif Great news! Thank you!
But when looking at the image tag on docker hub I am a bit confused what to do now: https://hub.docker.com/r/gitpod/workspace-full-vnc/tags?page=1&ordering=last_updated

It says the latest tag was last updated 6 days ago and the latest "fixed" tag (which the GitPod documentation recommends to us use) is even 21 days old (https://hub.docker.com/layers/workspace-full-vnc/gitpod/workspace-full-vnc/2022-06-20-19-54-55/images/sha256-452b2d5d604c51fa39273668dc26c83b114e1611e4415ebe10443faf2a72cab6?context=explore)

So does that mean the update ist actually not published yet?

Thanks!

[axonasif]

Hi @J0F3, sorry for such a late reply. If you're still on it, you could use latest tag or the most recent timestamped tag now.