Regression: snapcraft started failing with craft_archives.repo.errors.AptGPGKeyInstallError
Metadata
Current evaluation
Multi-key APT GPG parsing regression was fixed by merged PR #4253 (a311e7c), updating craft-archives and shipping in the Snapcraft 7.4.4 hotfix.
Resolution: closed resolved
Reason: Craft Archives PR #86 (9a9706b) fixed key installation to accept primary fingerprints and keys with subkeys. Snapcraft PR #4253 (a311e7c) integrated the fix and released it in version 7.4.4.
Evaluated by: mr-cal-bot
No scores available.
Issue body
### Bug Description
On Friday git-ubuntu CI regressed. It uses the stable snapcraft snap.
It seems that something was switched that caused it to start failing with an error from inside craft-archives. See https://github.com/canonical/craft-archives/issues/83 for details.
### To Reproduce
In a Focal lxd container, running as the ubuntu user (eg. `lxc launch ubuntu:focal test-container && lxc shell test-container` and then `login -f ubuntu`):
```
git clone https://git.launchpad.net/git-ubuntu
git checkout 8f0d8e5
sh snap.sh
```
### Environment
Snapcraft is in destructive mode inside a lxd container.
### snapcraft.yaml
```shell
See https://git.launchpad.net/git-ubuntu/tree/snap/snapcraft.yaml although note that snap.sh modifies it slightly to work around LP: #1918968. See that script for details.
```
### Relevant log output
```shell
File "/snap/snapcraft/9362/lib/python3.8/site-packages/snapcraft_legacy/internal/project_loader/_config.py", line 304, in get_build_packages
self.install_package_repositories()
File "/snap/snapcraft/9362/lib/python3.8/site-packages/snapcraft_legacy/internal/project_loader/_config.py", line 288, in install_package_repositories
refresh_required |= key_manager.install_package_repository_key(
File "/snap/snapcraft/9362/lib/python3.8/site-packages/craft_archives/repo/apt_key_manager.py", line 257, in install_package_repository_key
self.install_key(key=key_path.read_text())
File "/snap/snapcraft/9362/lib/python3.8/site-packages/craft_archives/repo/apt_key_manager.py", line 170, in install_key
raise errors.AptGPGKeyInstallError(
craft_archives.repo.errors.AptGPGKeyInstallError: Failed to install GPG key: Key must be a single key, not multiple.
```
### Additional context
_No response_
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Multi-key APT GPG parsing regression was fixed by merged PR #4253 (a311e7c), updating craft-archives and shipping in the Snapcraft 7.4.4 hotfix. | |
| stealth/space-bunny-alpha | — | closed resolved | Apt GPG multi-key regression ("Key must be a single key, not multiple") fixed by PR #4253, merged into hotfix/7.5 as commit a311e7c, updating craft-archives; the earlier attempt PR #4241 was closed in its favour. | |
| stealth/space-bunny-alpha | — | closed resolved | Multi-key apt GPG parsing regression was fixed by merged PR #4253 (a311e7c), updating craft-archives and shipping in the 7.4.4 hotfix. | |
| qwen/qwen3.6-35b-a3b | — | — | A snapcraft regression causing AptGPGKeyInstallError from multi-key files was fixed. Resolution updated key parsing logic, with a hotfix released in version 7.4.4 and merged via PR #4241. The issue is closed. | |
| qwen/qwen3.6-35b-a3b | — | — | The AptGPGKeyInstallError regression on multi-key GPG files was fixed via PR #4241. The patch was merged and released to the edge channel. Despite some users reporting follow-up validation errors, the issue was closed after deployment. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed after a fix was merged to resolve the AptGPGKeyInstallError caused by multi-key GPG files. The patch was released on the edge channel for testing, with a stable hotfix pending. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | A fix for the multiple GPG key parsing error was merged in PR #4241 and released in snapcraft 7.4.4. The regression was resolved and the issue closed. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/craft-archives#83
(confidence 100%)
Root-cause report for the overly restrictive AptKeyManager.install_key() behavior.
-
Likely Fixed By:
canonical/snapcraft#4253
(confidence 99%)
Merged Snapcraft dependency update that shipped the upstream fix in 7.4.4.
-
Likely Fixed By:
canonical/craft-archives#86
(confidence 99%)
Upstream fix commit 9a9706b made install_key() accept keys with subkeys.
-
Related To:
canonical/snapcraft#4241
(confidence 90%)
Earlier targeted edge build posted for testing the multiple-key failure.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2024910 Failed to install GPG key: Key must be a single key, not multiple. | snapcraft (launchpad) | closed | Craft-archives upgrade in snapcraft PR #4253 (commit a311e7c) restored multi-key APT GPG parsing for package-repositories; tracked as CRAFT-1827 and merged into hotfix/7.5, shipped in Snapcraft 7.4.4. | |
| #4225 Regression: snapcraft "apt" package-repositories feature fails in destructive mode | snapcraft | closed | Regression in the 'apt' package-repositories plugin (destructive-mode /etc/apt/keyrings permission error) was fixed by reverting the craft-archives migration in commit 706872ec5, shipped in Snapcraft 7.5; reporter confirmed 7.5.2 works and the issue was closed. | |
| #5635 Fail to run snapcraft using a proxy | snapcraft | closed | Proxy-related GPG key retrieval was fixed in craft-archives#189 (daf89a2) and adopted by snapcraft#5670; the reporter confirmed the failure no longer occurs. | |
| #4253 package-repositories: update craft-archives to support multi-keys. | snapcraft | merged | Merged into hotfix/7.5 as a311e7c, updating craft-archives so package repositories support multiple keys. | |
| #2018609 Can't update repositories when building for different arch from host | snapcraft (launchpad) | closed | Cross-arch apt sources picked archive.ubuntu.com instead of ports.ubuntu.com; fixed on the snapcraft side by canonical/craft-archives#96 and snapcore/snapcraft#4303 (commit 1db0f39), released in 7.5.1/7.5.2; reporter confirmed resolved. |