Unable to verify any Release files since 3.10

Version

      "versions": {
        "deb": "3.10.0",
        "npm": "0.10.0",
        "rpm": "3.38.4",
        "core": "3.116.0",
        "file": "3.116.0",
        "maven": "0.25.1",
        "ostree": "2.6.1",
        "python": "3.34.0",
        "ansible": "0.30.0",
        "certguard": "3.116.0",
        "container": "2.29.0",
        "hugging_face": "0.3.2"
      }

Describe the bug
Since version 3.10 I have two remote repositories that are unable to sync due to verify. Under version 3.9 (Pulp 113) it was working.

Remote settings:

❯ pulp deb remote show --name apt-cache_nodesource-22
{
  "pulp_href": "/pulp/api/v3/remotes/deb/apt/019a3590-f5d0-7834-b971-ff02a2a67ced/",
  "prn": "prn:deb.aptremote:019a3590-f5d0-7834-b971-ff02a2a67ced",
  "pulp_created": "2025-10-30T14:41:23.921219Z",
  "pulp_last_updated": "2026-08-20T08:09:41.983040Z",
  "name": "apt-cache_nodesource-22",
  "url": "https://deb.nodesource.com/node_22.x/",
  "pulp_labels": {},
  "policy": "immediate",
  "hidden_fields": [
    {
      "name": "client_key",
      "is_set": false
    },
    {
      "name": "proxy_username",
      "is_set": false
    },
    {
      "name": "proxy_password",
      "is_set": false
    },
    {
      "name": "username",
      "is_set": false
    },
    {
      "name": "password",
      "is_set": false
    }
  ],
  "ca_cert": null,
  "client_cert": null,
  "tls_validation": true,
  "proxy_url": null,
  "max_retries": null,
  "total_timeout": null,
  "connect_timeout": null,
  "sock_connect_timeout": null,
  "sock_read_timeout": null,
  "headers": null,
  "download_concurrency": null,
  "rate_limit": null,
  "distributions": "nodistro",
  "components": "main",
  "architectures": "amd64 arm64",
  "sync_sources": false,
  "sync_udebs": false,
  "sync_installer": false,
  "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQENBFdDN1ABCADaNd/I3j3tn40deQNgz7hB2NvT+syXe6k4ZmdiEcOfBvFrkS8B\nhNS67t93etHsxEy7E0qwsZH32bKazMqe9zDwoa3aVImryjh6SHC9lMtW27JPHFeM\nSrkt9YmH1WMwWcRO6eSY9B3PpazquhnvbammLuUojXRIxkDroy6Fw4UKmUNSRr32\n9Ej87jRoR1B2/57Kfp2Y4+vFGGzSvh3AFQpBHq51qsNHALU6+8PjLfIt+5TPvaWR\nTB+kAZnQZkaIQM2nr1n3oj6ak2RATY/+kjLizgFWzgEfbCrbsyq68UoY5FPBnu4Z\nE3iDZpaIqwKr0seUC7iA1xM5eHi5kty1oB7HABEBAAG0Ik5Tb2xpZCA8bnNvbGlk\nLWdwZ0Bub2Rlc291cmNlLmNvbT6JATgEEwECACIFAldDN1ACGwMGCwkIBwMCBhUI\nAgkKCwQWAgMBAh4BAheAAAoJEC9ZtfmbG+C0y7wH/i4xnab36dtrYW7RZwL8i6Sc\nNjMx4j9+U1kr/F6YtqWd+JwCbBdar5zRghxPcYEq/qf7MbgAYcs1eSOuTOb7n7+o\nxUwdH2iCtHhKh3Jr2mRw1ks7BbFZPB5KmkxHaEBfLT4d+I91ZuUdPXJ+0SXs9gzk\nDbz65Uhoz3W03aiF8HeL5JNARZFMbHHNVL05U1sTGTCOtu+1c/33f3TulQ/XZ3Y4\nhwGCpLe0Tv7g7Lp3iLMZMWYPEa0a7S4u8he5IEJQLd8bE8jltcQvrdr3Fm8kI2Jg\nBJmUmX4PSfhuTCFaR/yeCt3UoW883bs9LfbTzIx9DJGpRIu8Y0IL3b4sj/GoZVq5\nAQ0EV0M3UAEIAKrTaC62ayzqOIPa7nS90BHHck4Z33a2tZF/uof38xNOiyWGhT8u\nJeFoTTHn5SQq5Ftyu4K3K2fbbpuu/APQF05AaljzVkDGNMW4pSkgOasdysj831cu\nssrHX2RYS22wg80k6C/Hwmh5F45faEuNxsV+bPx7oPUrt5n6GMx84vEP3i1+FDBi\n0pt/B/QnDFBXki1BGvJ35f5NwDefK8VaInxXP3ZN/WIbtn5dqxppkV/YkO7GiJlp\nJlju9rf3kKUIQzKQWxFsbCAPIHoWv7rH9RSxgDithXtG6Yg5R1aeBbJaPNXL9wpJ\nYBJbiMjkAFaz4B95FOqZm3r7oHugiCGsHX0AEQEAAYkBHwQYAQIACQUCV0M3UAIb\nDAAKCRAvWbX5mxvgtE/OB/0VN88DR3Y3fuqy7lq/dthkn7Dqm9YXdorZl3L152eE\nIF882aG8FE3qZdaLGjQO4oShAyNWmRfSGuoH0XERXAI9n0r8m4mDMxE6rtP7tHet\ny/5M8x3CTyuMgx5GLDaEUvBusnTD+/v/fBMwRK/cZ9du5PSG4R50rtst+oYyC2ao\nx4I2SgjtF/cY7bECsZDplzatN3gv34PkcdIg8SLHAVlL4N5tzumDeizRspcSyoy2\nK2+hwKU4C4+dekLLTg8rjnRROvplV2KtaEk6rxKtIRFDCoQng8wfJuIMrDNKvqZw\nFRGt7cbvW5MCnuH8MhItOl9Uxp1wHp6gtav/h8Gp6MBa\n=MARt\n-----END PGP PUBLIC KEY BLOCK-----",
  "ignore_missing_package_indices": false
}

Worker log:

2026-08-20T09:27:16.008562329+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulp_deb.app.tasks.synchronizing:WARNING: Your pulp instance is configured to prohibit use of the MD5 checksum algorithm!
2026-08-20T09:27:16.00858177+02:00 stderr F Processing MD5 IN ADDITION to a secure hash like SHA-256 is "highly recommended".
2026-08-20T09:27:16.00860263+02:00 stderr F See https://docs.pulpproject.org/pulp_deb/workflows/checksums.html for more info.
2026-08-20T09:27:16.00860588+02:00 stderr F 
2026-08-20T09:27:16.014222261+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulp_deb.app.tasks.synchronizing:INFO: Downloading Release file for distribution: "nodistro"
2026-08-20T09:27:17.221640019+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulp_deb.app.tasks.synchronizing:WARNING: Verification of InRelease failed. Removing it.
2026-08-20T09:27:17.256199407+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulp_deb.app.tasks.synchronizing:WARNING: Verification of Release + Release.gpg failed. Removing it.
2026-08-20T09:27:17.319542918+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulpcore.tasking.tasks:INFO: Task[pulp_deb.app.tasks.synchronizing.synchronize] 01a01e11-2750-7dce-9a4b-d3172db6f043 failed (NoValidSignatureForKey: [DEB0002] Unable to verify any Release files from 'https://deb.nodesource.com/node_22.x/Release' using the GPG key provided.) in domain: default
2026-08-20T09:27:17.320188005+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulpcore.tasking.tasks:INFO:   File "/usr/local/lib/python3.11/site-packages/pulpcore/tasking/tasks.py", line 86, in _execute_task
2026-08-20T09:27:17.320194006+02:00 stderr F     result = task_function()
2026-08-20T09:27:17.320213126+02:00 stderr F              ^^^^^^^^^^^^^^^
2026-08-20T09:27:17.320214966+02:00 stderr F 
2026-08-20T09:27:17.320217456+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 138, in synchronize
2026-08-20T09:27:17.320219726+02:00 stderr F     DebDeclarativeVersion(first_stage, repository, mirror=mirror).create()
2026-08-20T09:27:17.320221276+02:00 stderr F 
2026-08-20T09:27:17.320223426+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulpcore/plugin/stages/declarative_version.py", line 172, in create
2026-08-20T09:27:17.320225666+02:00 stderr F     loop.run_until_complete(pipeline)
2026-08-20T09:27:17.320227287+02:00 stderr F 
2026-08-20T09:27:17.320243697+02:00 stderr F   File "/usr/lib64/python3.11/asyncio/base_events.py", line 654, in run_until_complete
2026-08-20T09:27:17.320245817+02:00 stderr F     return future.result()
2026-08-20T09:27:17.320247467+02:00 stderr F            ^^^^^^^^^^^^^^^
2026-08-20T09:27:17.320248987+02:00 stderr F 
2026-08-20T09:27:17.320250717+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulpcore/plugin/stages/api.py", line 238, in create_pipeline
2026-08-20T09:27:17.320252347+02:00 stderr F     await asyncio.gather(*futures)
2026-08-20T09:27:17.320253937+02:00 stderr F 
2026-08-20T09:27:17.320255547+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulpcore/plugin/stages/api.py", line 40, in __call__
2026-08-20T09:27:17.320257997+02:00 stderr F     await self.run()
2026-08-20T09:27:17.320259657+02:00 stderr F 
2026-08-20T09:27:17.320261347+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/asgiref/sync.py", line 577, in thread_handler
2026-08-20T09:27:17.320263017+02:00 stderr F     raise exc_info[1]
2026-08-20T09:27:17.320264588+02:00 stderr F 
2026-08-20T09:27:17.320266188+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 330, in run
2026-08-20T09:27:17.320268258+02:00 stderr F     await self.process_release_file_d_content(d_content, pb)
2026-08-20T09:27:17.320269838+02:00 stderr F 
2026-08-20T09:27:17.320271748+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 342, in process_release_file_d_content
2026-08-20T09:27:17.320273418+02:00 stderr F     release_artifact = self.verify_gpg_artifacts(
2026-08-20T09:27:17.320275068+02:00 stderr F                        ^^^^^^^^^^^^^^^^^^^^^^^^^^
2026-08-20T09:27:17.320276608+02:00 stderr F 
2026-08-20T09:27:17.320278298+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 403, in verify_gpg_artifacts
2026-08-20T09:27:17.320280038+02:00 stderr F     raise NoValidSignatureForKey(url=os.path.join(self.remote.url, "Release"))
2026-08-20T09:27:17.320281598+02:00 stderr F 

It seems the task is trying to gather the Release file from https://deb.nodesource.com/node_22.x/Release what should be https://deb.nodesource.com/node_22.x/dists/nodistro/Release

Same thing happens with Docker repo.
The rest of the remotes are working fine

Do I have a configuration error in the remote?

Start in pulp_deb/app/tasks/synchronizing.py, especially process_release_file_d_content and verify_gpg_artifacts, and reproduce a sync against the Nodesource or Docker remote shown. Trace how the configured distribution becomes the Release URL and verify the behavior with the provided logs. Done means valid Release files can be verified and synchronized for these remotes without regressing the working remotes.