No public key available when installing packages in Bitbucket Pipelines

[sergibroto]

Hello everyone,

For a couple of days I've been experiencing issues running Pipelines in my Bitbucket repository.

When running this command apt-get update && apt-get install -y python-dev python-pip I get the following error:

+ apt-get update && apt-get install -y python-dev python-pip
npm info lifecycle fa-webapp@2.30.0~postbower: fa-webapp@2.30.0
npm info ok
Get:1 http://security.debian.org jessie/updates InRelease [44.9 kB]
Ign http://archive.debian.org jessie InRelease
Get:2 http://archive.debian.org jessie Release.gpg [2420 B]
Get:3 http://archive.debian.org jessie Release [148 kB]
Ign http://archive.debian.org jessie Release
Get:4 http://security.debian.org jessie/updates/main Sources [449 kB]
Get:5 http://archive.debian.org jessie/main Sources [9169 kB]
Get:6 http://security.debian.org jessie/updates/main amd64 Packages [976 kB]
Get:7 http://archive.debian.org jessie/main amd64 Packages [9098 kB]
Fetched 19.9 MB in 26s (748 kB/s)
Reading package lists...
W: There is no public key available for the following key IDs:
AA8E81B4331F7F50
W: GPG error: http://archive.debian.org jessie Release: The following signatures were invalid: KEYEXPIRED 1587841717
Reading package lists...
Building dependency tree...
Reading state information...
The following extra packages will be installed:
build-essential dpkg-dev fakeroot libalgorithm-diff-perl
libalgorithm-diff-xs-perl libalgorithm-merge-perl libdpkg-perl libfakeroot
libfile-fcntllock-perl libpython-dev libpython2.7 libpython2.7-dev
libpython2.7-minimal libpython2.7-stdlib libtimedate-perl python-cffi
python-chardet python-colorama python-cryptography python-distlib
python-html5lib python-ndg-httpsclient python-openssl python-pkg-resources
python-ply python-pyasn1 python-pycparser python-requests python-setuptools
python-support python-urllib3 python-wheel python2.7 python2.7-dev
python2.7-minimal
Suggested packages:
debian-keyring python-cryptography-doc python-cryptography-vectors
python-genshi python-lxml python-openssl-doc python-openssl-dbg
python-distribute python-distribute-doc python-ply-doc doc-base
python2.7-doc binfmt-support
Recommended packages:
python-dev-all
The following NEW packages will be installed:
build-essential dpkg-dev fakeroot libalgorithm-diff-perl
libalgorithm-diff-xs-perl libalgorithm-merge-perl libdpkg-perl libfakeroot
libfile-fcntllock-perl libpython-dev libpython2.7 libpython2.7-dev
libtimedate-perl python-cffi python-chardet python-colorama
python-cryptography python-dev python-distlib python-html5lib
python-ndg-httpsclient python-openssl python-pip python-pkg-resources
python-ply python-pyasn1 python-pycparser python-requests python-setuptools
python-support python-urllib3 python-wheel python2.7-dev
The following packages will be upgraded:
libpython2.7-minimal libpython2.7-stdlib python2.7 python2.7-minimal
4 upgraded, 33 newly installed, 0 to remove and 180 not upgraded.
Need to get 28.3 MB of archives.
After this operation, 46.8 MB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
python-support libtimedate-perl libdpkg-perl dpkg-dev build-essential
libfakeroot fakeroot libalgorithm-diff-perl libalgorithm-diff-xs-perl
libalgorithm-merge-perl libfile-fcntllock-perl libpython-dev python-ply
python-pycparser python-cffi python-pkg-resources python-chardet
python-colorama python-cryptography python-dev python-distlib
python-html5lib python-openssl python-ndg-httpsclient python-requests
python-setuptools python-pip python-pyasn1 python-wheel
E: There are problems and -y was used without --force-yes

After doing some research (https://futurestud.io/tutorials/fix-ubuntu-debian-apt-get-keyexpired-the-following-signatures-were-invalid), it seems some packages keys are expired and they must be renewed in the server, however I have no access.

Can someone please help?

Thanks so much in advance.

[Gaetano Giunta]

We are having the same problem... It seems that the expired key is one that comes from Debian Wheezy times (expired on 25/4/2020).

To the best of my understanding, it is not common practice for the Debian maintainers to extend the lifetime of their keys, nor to re-sign packages in 'archive' repos.

Which kind of leaves the end users in the situation of having to implement workarounds (basically disabling security checks) :-(