Tag: keyring

Mirror the official Ubuntu repositories using aptly

This article is to show mainly how to work with aptly by mirroring an official Ubuntu mirror. If you want to know how to install and a brief description of what is aptly you may want to read our previous article – Install aptly under Ubuntu 18 LTS with Nginx serving the packages and the first steps

What we are going to do – this is what you need to have a mirror of an external application repository:

  1. Install aptly in Ubuntu 18 LTS
  2. Create a mirror in aptly
  3. Create a snapshot of the mirror created before
  4. Publish the snapshot to be used in other servers.

and at the last step there is an example how to use the mirror in your local machines.

STEP 1) Install aptly in Ubuntu 18.04 LTS.

As mentioned already you may follow our article on the subject – Install aptly under Ubuntu 18 LTS with Nginx serving the packages and the first steps. The following steps are based on this installation!
The aptly home directory is in “/srv/aptly”. We use the “aptly” user and change to it to manipulate the aptly installation.

STEP 2) Create a mirror in aptly.

Prepare the keys (aptly needs to have the Ubuntu keys in its trustedkeys keyring):

aptly@srv:~$ gpg --no-default-keyring --keyring /usr/share/keyrings/ubuntu-archive-keyring.gpg --export | gpg --no-default-keyring --keyring trustedkeys.gpg --import
gpg: key 3B4FE6ACC0B21F32: 3 signatures not checked due to missing keys
gpg: key 3B4FE6ACC0B21F32: public key "Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>" imported
gpg: key D94AA3F0EFE21092: 3 signatures not checked due to missing keys
gpg: key D94AA3F0EFE21092: public key "Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>" imported
gpg: key 871920D1991BC93C: 1 signature not checked due to a missing key
gpg: key 871920D1991BC93C: public key "Ubuntu Archive Automatic Signing Key (2018) <ftpmaster@ubuntu.com>" imported
gpg: Total number processed: 3
gpg:               imported: 3
gpg: public key of ultimately trusted key 212A3D20E4D3351D not found
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u

Probably you would like to have “main” and “universe” for the three bionic, bionic updates and bionic security.
First, main and universe for bionic repository. main is ~16G and universe is ~136, these numbers will vary in future when more packages are added.
Two commands are need for the aptly mirror:

  1. create – create the mirror.
  2. update – download the repository contents locally.

Keep on reading!

Pages: Page 1, Page 2

DBusException – Could not get owner of name ‘org.freedesktop.secrets’: no such name

There are programs, which heavily depend on a password store. Not sure why they cannot live without it but if you get errors of the following:

Traceback (most recent call last):
  File "/usr/lib64/python3.6/site-packages/dbus/bus.py", line 175, in activate_name_owner
    return self.get_name_owner(bus_name)
  File "/usr/lib64/python3.6/site-packages/dbus/bus.py", line 361, in get_name_owner
    's', (bus_name,), **keywords)
  File "/usr/lib64/python3.6/site-packages/dbus/connection.py", line 651, in call_blocking
    message, timeout)
dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NameHasNoOwner: Could not get owner of name 'org.freedesktop.secrets': no such name

The error is the same as:

The name org.freedesktop.secrets was not provided by any .service files

The chances are you are using a graphical interface, which does not start a dbus service offering “DBus Secret Service API”.
The solution is to start a program or service offering a password store, which implements the “DBus Secret Service API” offering the name “org.freedesktop.secrets”.

The best and easy workaround in the environment, which do not offer such service is to use gnome-keyring-daemon from the package gnome-keyring.

Just install the package gnome-keyring and start “gnome-keyring-daemon”:
Under Ubuntu:

sudo apt install gnome-keyring
gnome-keyring-daemon

CentOS 7 / Fedora

sudo yum install gnome-keyring
gnome-keyring-daemon

Gentoo:

root@local ~$ emerge -v gnome-keyring
root@local ~$ exit
myuser@local ~$ gnome-keyring-daemon

And after the keyring daemon has started the program, which failed before, now it would start normally.

Even KDE uses KWallet, which at present does not support “DBus Secret Service API” and you may experience such behavior under KDE Plasma Desktop. Execute the program in the console to see the output (aka the errors).

We have encountered this error with the latest version of nagstamon under KDE Plasma Desktop (5.15.5):

myuser@my-desktop ~ $ nagstamon 
Traceback (most recent call last):
  File "/usr/lib64/python3.6/site-packages/dbus/bus.py", line 175, in activate_name_owner
    return self.get_name_owner(bus_name)
  File "/usr/lib64/python3.6/site-packages/dbus/bus.py", line 361, in get_name_owner
    's', (bus_name,), **keywords)
  File "/usr/lib64/python3.6/site-packages/dbus/connection.py", line 651, in call_blocking
    message, timeout)
dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NameHasNoOwner: Could not get owner of name 'org.freedesktop.secrets': no such name

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python-exec/python3.6/nagstamon", line 31, in <module>
    from Nagstamon.Config import conf
  File "/usr/lib64/python3.6/site-packages/Nagstamon/Config.py", line 41, in <module>
    import keyring
  File "/usr/lib64/python3.6/site-packages/keyring/__init__.py", line 3, in <module>
    from .core import (set_keyring, get_keyring, set_password, get_password,
  File "/usr/lib64/python3.6/site-packages/keyring/core.py", line 154, in <module>
    init_backend()
  File "/usr/lib64/python3.6/site-packages/keyring/core.py", line 67, in init_backend
    keyrings = filter(limit, backend.get_all_keyring())
  File "/usr/lib64/python3.6/site-packages/keyring/util/__init__.py", line 21, in wrapper
    func.always_returns = func(*args, **kwargs)
  File "/usr/lib64/python3.6/site-packages/keyring/backend.py", line 179, in get_all_keyring
    exceptions=TypeError))
  File "/usr/lib64/python3.6/site-packages/keyring/util/__init__.py", line 31, in suppress_exceptions
    for callable in callables:
  File "/usr/lib64/python3.6/site-packages/keyring/backend.py", line 171, in is_class_viable
    keyring_cls.priority
  File "/usr/lib64/python3.6/site-packages/keyring/util/properties.py", line 24, in __get__
    return self.fget.__get__(None, owner)()
  File "/usr/lib64/python3.6/site-packages/keyring/backends/SecretService.py", line 38, in priority
    list(secretstorage.get_all_collections(bus))
  File "/usr/lib64/python3.6/site-packages/secretstorage/collection.py", line 144, in get_all_collections
    service_obj = bus_get_object(bus, SS_PATH)
  File "/usr/lib64/python3.6/site-packages/secretstorage/util.py", line 55, in bus_get_object
    return bus.get_object(name, object_path, introspect=False)
  File "/usr/lib64/python3.6/site-packages/dbus/bus.py", line 241, in get_object
    follow_name_owner_changes=follow_name_owner_changes)
  File "/usr/lib64/python3.6/site-packages/dbus/proxies.py", line 248, in __init__
    self._named_service = conn.activate_name_owner(bus_name)
  File "/usr/lib64/python3.6/site-packages/dbus/bus.py", line 180, in activate_name_owner
    self.start_service_by_name(bus_name)
  File "/usr/lib64/python3.6/site-packages/dbus/bus.py", line 278, in start_service_by_name
    'su', (bus_name, flags)))
  File "/usr/lib64/python3.6/site-packages/dbus/connection.py", line 651, in call_blocking
    message, timeout)
dbus.exceptions.DBusException: org.freedesktop.DBus.Error.Spawn.ChildExited: Process org.freedesktop.secrets exited with status 127

aptly mirror – gpgv: Can’t check signature: public key not found

If you want to mirror repositories from your current aptly server to a new server you must import the GPG key from your old server because you are going to encounter the following error:

gpgv: Signature made Fri 22 Apr 2019 17:35:04 AM UTC using DSA key ID FDC7A25E
gpgv: Can't check signature: public key not found

Looks like some keys are missing in your trusted keyring, you may consider importing them from keyserver:

gpg --no-default-keyring --keyring trustedkeys.gpg --keyserver pool.sks-keyservers.net --recv-keys 181482CCFDC7A25E

Sometimes keys are stored in repository root in file named Release.key, to import such key:

wget -O - https://some.repo/repository/Release.key | gpg --no-default-keyring --keyring trustedkeys.gpg --import

ERROR: unable to fetch mirror: verification of detached signature failed: exit status 2

And the mirror command fails. The problem is

you must import the GPG key from your old server in trustedkeys.gpg (even if you have already imported it in the new server with apt-key!!!)

Here is how to list, export and import it (we are going to import it in default and trustedkeys.gpg, because it is more convenient, but it is not mandatory to be in the default).
Keep on reading!