adoptium / adoptium/infrastructure

Alpine DockerStatic Dockerfiles fail on GPG verification step

Open
#4,114 0 comments 0 reactions 0 assignees View on GitHub
ansible
Dominant language
Python
Stars
96
Forks
106
Avg merge
1d 23h
Merged PRs (30d)
13

Description

From trying to create the alpine containers on my local machine:
```
STEP 8/27: RUN wget -q `curl -s 'https://api.adoptium.net/v3/assets/feature_releases/21/ga?architecture=x64&heap_size=normal&image_type=jdk&jvm_impl=hotspot&os=alpine-linux&page=0&page_size=1&project=jdk&vendor=eclipse' | grep signature_link | awk '{split($0,a,"\""); print a[4]}'` -O /tmp/jdk21.sig
--> e02b84003212
STEP 9/27: RUN gpg --verify /tmp/jdk21.sig /tmp/jdk21.tar.gz
gpg: Signature made Wed Oct 22 00:23:16 2025 UTC
gpg: using RSA key 3B04D753C9050D9A5D343F39843C48A565F8F04B
gpg: Note: database_open 134217901 waiting for lock (held by 6) ...
gpg: Note: database_open 134217901 waiting for lock (held by 6) ...
gpg: Note: database_open 134217901 waiting for lock (held by 6) ...
gpg: Note: database_open 134217901 waiting for lock (held by 6) ...
gpg: Note: database_open 134217901 waiting for lock (held by 6) ...
gpg: keydb_search failed: Operation timed out
gpg: Note: database_open 134217901 waiting for lock (held by 6) ...
gpg: Note: database_open 134217901 waiting for lock (held by 6) ...
gpg: Note: database_open 134217901 waiting for lock (held by 6) ...
gpg: Note: database_open 134217901 waiting for lock (held by 6) ...
gpg: Note: database_open 134217901 waiting for lock (held by 6) ...
gpg: keydb_search failed: Operation timed out
gpg: Can't check signature: No public key
Error: building at STEP "RUN gpg --verify /tmp/jdk21.sig /tmp/jdk21.tar.gz": while running runtime: exit status 2
```
Not sure if this affects other platforms - I was trying Alpine in order to replicate a specific test failure on my local Fedora 42 host system.

Contributor guide

Open the contributing guide

Research direction

Start with the Alpine DockerStatic Dockerfiles and reproduce the failing build through the `gpg --verify` step shown in the report. Trace the key setup and signature-download steps, then confirm that the Alpine image builds successfully with the JDK signature verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, linux
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.