apt fail to install container-toolkit - gpg public key not available

[denis-roy-cima]

Good day @elezar

Trying to install nvidia-container-toolkit by following this guide: https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html

After pasting this command:

curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | sudo gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg \
  && curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | \
    sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' | \
    sudo tee /etc/apt/sources.list.d/nvidia-container-toolkit.list

apt-get update yields this error message:

W: GPG error: https://nvidia.github.io/libnvidia-container/stable/deb/amd64  InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DDCAE044F796ECB0
E: The repository 'https://nvidia.github.io/libnvidia-container/stable/deb/amd64  InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

It might have something to do with the fact that the GPG key is expired:

curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa4096 2017-09-28 [SCE]
      C95B321B61E88C1809C4F759DDCAE044F796ECB0
uid           NVIDIA CORPORATION (Open Source Projects) <[cudatools@nvidia.com](mailto:cudatools@nvidia.com)>
sub   rsa2048 2019-09-18 [S] [expired: 2021-06-16]

Thanks!

[github-actions]

This issue is stale because it has been open 90 days with no activity. This issue will be closed in 30 days unless new comments are made or the stale label is removed. To skip these checks, apply the "lifecycle/frozen" label.

[elezar]

@denis-roy-cima which distribution are you using? Is it configured to be more strict w.r.t to the key?

Note that the key should have no expiry date, but we have seen that some stricter distributions assume a date in this case and as such they show up as expired.

[denis-roy-cima]

Hi!

Thanks for getting back.

It is a pretty much barebone Debian 12 (Bookworm) installation with no other restrictions that I know of.

[saibotk]

This also fails on our default Ubuntu 24.04.3 LTS installation.

[github-actions]

This issue is stale because it has been open 90 days with no activity. This issue will be closed in 30 days unless new comments are made or the stale label is removed. To skip these checks, apply the "lifecycle/frozen" label.

[denis-roy-cima]

@elezar is there any way we can assist you with this?

As stated in the original message, the key shows an expiry date on vanilla debian as well as arch:

> curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --show-keys
pub   rsa4096 2017-09-28 [SCE]
      C95B321B61E88C1809C4F759DDCAE044F796ECB0
uid                      NVIDIA CORPORATION (Open Source Projects) <cudatools@nvidia.com>
sub   rsa2048 2019-09-18 [S] [expired: 2021-06-16]
                              ^^^^^^^

If it is indeed an unexpiring subkey, maybe using an expring one that gets renewed every year would be safer and avoid this kind of compatibility issue?

Thanks!

[github-actions]

This issue is stale because it has been open 90 days with no activity. This issue will be closed in 30 days unless new comments are made or the stale label is removed. To skip these checks, apply the "lifecycle/frozen" label.

[denis-roy-cima]

Refer to #81, #650 and #1460