Aws-codebuild-docker-images: aws/codebuild/standard:4.0 apt-get update -y fails reason: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures were invalid..

[cd-vis]

We are using the aws/codebuild/standard:4.0 in a build step in CodePipeline. The build fails at apt-get update -y exit status 100
Reason:
Reading package lists...
95W: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging [e-mail]
96E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.

I found this issue, not sure if it is related but it's from yesterday:
https://github.com/yarnpkg/yarn/issues/7866

[chrislove01]

Same here

Added this to build spec to fix temporarily

    commands:
    #temp gpg error fix
    - curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
    #temp gpg error fix
    - apt-get update

[pdoerning]

Accordingly also effecting Version 3.0 and 5.0 as build specs are the same.

[thomaschaaf]

I created an AWS Support case: Case ID 7949152351

[repl-mike-roest]

Also effecting 2.0 as well

I've also opened a support case with AWS linking to this issue

[subinataws]

Thanks for reporting the issue. We are working on updating these images.

As a workaround for CodeBuild standard image, please add the following command to your buildspec prior to any apt commands: 'curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -'. For Amazon Linux 2 images, add 'rpm --import https://dl.yarnpkg.com/rpm/pubkey.gpg'.

[tony-welch-vqd]

Same issue here using aws/codebuild/standard:4.0

[diegoclair]

Same here with standard 3.0 and 5.0 ..
I found this command and it work too: apt-key adv --refresh-keys --keyserver keyserver.ubuntu.com
This command was mentioned here: https://github.com/yarnpkg/yarn/issues/7866
I don't know the exactly difference of the command curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -

[alana314]

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - worked for me but make sure it's before any apt-get commands, or apt-get will fail

[prasanthnarasimha]

Same issue. Using aws/codebuild/standard:4.0.
Resolved by adding the following command in buildspec before apt-get udpate
curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -

[subinataws]

This should be resolved now. Let us know if you face any more issues.

[cd-vis]

I have removed the workaround and the build is successful.

[repl-mike-roest]

@subinataws
I'm still getting failures using the standard:2.0 image

Reading package lists...
185 | W: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <[email protected]>
186 | E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.
187

Build started at
2021/02/05 13:08:05

[subinataws]

@repl-mike-roest - standard:2.0 image is unfortunately no longer maintained. Could you please use one of the supported images: https://github.com/aws/aws-codebuild-docker-images#image-maintenance ?

Also, do note that only the maintained images are pre-cached on the build server on AWS cloud. Using standard:2.0, for example, would lead to long provisioning time as images will be downloaded from ECR every time.

[repl-mike-roest]

@subinataws thanks I've migrated our projects to 4.0 and they're working