The key we use currently has been "compromised", see https://www.patreon.com/posts/dpa-new-signing-25451165 , and a new one has been issued.
We should update it ASAP.
Description
Description
Details
Details
| Project | Branch | Lines +/- | Subject | |
|---|---|---|---|---|
| integration/config | master | +210 -0 | dockerfiles: Follow-up 49281f5fd and actually cascade these updates |
Event Timeline
Comment Actions
Triaging as high priority as this is at best going to make building the images fail, at worst it's a security liability.
Comment Actions
The key we have got revoked a couple years ago and reached expiration yesterday
name=docker run --rm -it --user=root --entrypoint=bash docker-registry.wikimedia.org/releng/sury-php
# apt update && apt install gpg
# apt-key list -v
...
/etc/apt/trusted.gpg.d/php.gpg
------------------------------
pub rsa3072 2019-03-18 [SC] [expired: 2021-03-17] // <------------------ Expired
1505 8500 A023 5D97 F5D1 0063 B188 E2B6 95BD 4743
uid [ expired] DEB.SURY.ORG Automatic Signing Key <deb@sury.org>
sub rsa3072 2019-03-18 [E] [expired: 2021-03-17]Comment Actions
The sury base image has been updated via https://gerrit.wikimedia.org/r/c/integration/config/+/673226
The child images will get updated as part of other updates.
Comment Actions
As I predicted at the time, leaving this rake in the grass broke things when I tried to emergency-upgrade composer for {T281283}. In future, let's not do this. :-)
Comment Actions
Change 683040 had a related patch set uploaded (by Jforrester; author: Jforrester):
[integration/config@master] dockerfiles: Follow-up 49281f5fd and actually cascade these updates
Comment Actions
Change 683040 merged by jenkins-bot:
[integration/config@master] dockerfiles: Follow-up 49281f5fd and actually cascade these updates
Comment Actions
Mentioned in SAL (#wikimedia-releng) [2021-04-27T19:16:35Z] <James_F> Docker: Rebuilding all Sury-php derivatives for T277742.