boorad/mapr_cookbooks — pull request #1 by trinitronx (2014-08-27 15:54:33+00:00)
Title: Attempt to fix apt repo key error

I was getting the following apt package authentication error:

WARNING: The following packages cannot be authenticated!
mapr-core mapr-fileserver mapr-cldb
STDERR: E: There are problems and -y was used without --force-yes

So I figured the problem was to add the mapr repo gnupg key to the apt keyring (this pull request). However, it appears that this still didn't fix the problem, and I'm getting the same error.

I checked that the key was indeed getting downloaded and added to the apt keyring, and that it was correct:

vagrant@nodeX:/var/chef/cache$ sudo apt-get -q -y install mapr-cldb=3.0.2.22510.GA-1
sudo: unable to resolve host nodeX
Reading package lists...
Building dependency tree...
Reading state information...
The following extra packages will be installed:
libcrypt-passwdmd5-perl mapr-core mapr-fileserver mtools sdparm syslinux syslinux-common
Suggested packages:
floppyd
The following NEW packages will be installed:
libcrypt-passwdmd5-perl mapr-cldb mapr-core mapr-fileserver mtools sdparm syslinux syslinux-common
0 upgraded, 8 newly installed, 0 to remove and 63 not upgraded.
Need to get 269 MB of archives.
After this operation, 4,188 kB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
mapr-core mapr-fileserver mapr-cldb
E: There are problems and -y was used without --force-yes

vagrant@nodeX:/var/chef/cache$ sudo apt-key update
sudo: unable to resolve host nodeX
gpg: key 437D05B5: "Ubuntu Archive Automatic Signing Key " not changed
gpg: key FBB75451: "Ubuntu CD Image Automatic Signing Key " not changed
gpg: key C0B21F32: "Ubuntu Archive Automatic Signing Key (2012) " not changed
gpg: key EFE21092: "Ubuntu CD Image Automatic Signing Key (2012) " not changed
gpg: Total number processed: 4
gpg: unchanged: 4
vagrant@nodeX:/var/chef/cache$ sudo apt-key list
sudo: unable to resolve host nodeX
/etc/apt/trusted.gpg
--------------------
pub 1024D/437D05B5 2004-09-12
uid Ubuntu Archive Automatic Signing Key
sub 2048g/79164387 2004-09-12

pub 1024D/FBB75451 2004-12-30
uid Ubuntu CD Image Automatic Signing Key

pub 4096R/C0B21F32 2012-05-11
uid Ubuntu Archive Automatic Signing Key (2012)

pub 4096R/EFE21092 2012-05-11
uid Ubuntu CD Image Automatic Signing Key (2012)

pub 2048R/D2051F97 2014-05-06
uid MapR Technologies, Inc. Linux Package Signing Key (2014)
sub 2048R/DE308A91 2014-05-06

vagrant@nodeX:/var/chef/cache$ curl -Ls http://package.mapr.com/releases/pub/gnugpg.key | shasum -a 256 | sed -e 's/-/gnugpg.key/' | (cd /var/chef/cache/ && shasum -a 256 -c - )
gnugpg.key: OK

I think that the real problem was that the MapR packages in the repo are not really signed via gnupg. I can tell this because there is no `Release.gpg` here: http://package.mapr.com/releases/v3.0.2/ubuntu/dists/mapr/

Compare this to an official Ubuntu Repo: http://us.archive.ubuntu.com/ubuntu/dists/precise/

If it helps, [this Debian Wiki Page][1] explains how apt determines if a package is securely signed, and also how to set up a secure apt repository with a signed `Release.gpg` file.

[1]: https://wiki.debian.org/SecureApt