Merge lp://staging/~xnox/debian-cd/missing-keys into lp://staging/~ubuntu-cdimage/debian-cd/ubun3

Ping, this is hindering trying to run debian-cd locally when building images.

Can you explain how is this deployed in production, given that all builds must be failing. Or are you running debian-cd in production without verifying signatures on the local mirror?

For me, clean deployments always fail like so:

Get:1 file:/home/xnox/canonical/ubuntu-cdimage/ftp focal InRelease [255 kB]
Get:1 file:/home/xnox/canonical/ubuntu-cdimage/ftp focal InRelease [255 kB]
Get:2 file:/home/xnox/canonical/ubuntu-cdimage/ftp focal-updates InRelease [79.7 kB]
Get:2 file:/home/xnox/canonical/ubuntu-cdimage/ftp focal-updates InRelease [79.7 kB]
Err:1 file:/home/xnox/canonical/ubuntu-cdimage/ftp focal InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3B4FE6ACC0B21F32 NO_PUBKEY 871920D1991BC93C
Err:2 file:/home/xnox/canonical/ubuntu-cdimage/ftp focal-updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3B4FE6ACC0B21F32 NO_PUBKEY 871920D1991BC93C

How come ubuntu-cdimage / debian-cd seem to clean the scratch dir and purge trusted.gpg.d and nothing seems to impor the keys.

I don't know why you are seeing errors due to unverified repositories that we are not seeing on nusakan. I can confirm that there is no gpg keyring in the scratch apt directory, and the sources.list doesn't include any overrides to ignore signature failures. So I don't know how this is meant to work and I don't want to make changes here without understanding it. I'd like Adam to comment on this.

Also ftr /etc/apt/trusted.gpg.d is empty on the host and /etc/apt/trusted.gpg contains the archive keys. So is this a difference between nusakan's xenial host, and a later release that you're deploying on?

I believe juliank mentioned apt bug, that it used system /etc/apt/trusted.gpg, despite all the configs asking to use alternative config apt root dir. Due to this bug, on nuasakan this probably works, but will stop working once it is upgraded.

I guess I can workaround this locally, but I do still wonder what we want to do long term, w.r.t. using the right keys for the right series in target, without poluting host keys.

So is the new host failing to perform apt-selection operations without this?

Also not all keys in host's /etc/apt/trusted.gpg.d are enough to build all the series. Should ubuntu-archive-keyring.gpg be copied in from /usr/share/keyrings instead?

Please reject this branch.

Superseded by https://code.launchpad.net/~laney/debian-cd/focal/+merge/386318

Ah, sorry for not paying attention to this touching a similar area before.