Update to new MySQL GPG Key #808
Conversation
|
The build failure is expected, and should (fingers-crossed) be resolved when the next MySQL release is out. |
|
One complication I didn't consider is that we no longer update 5.6, so that signature is old. We could make it so 5.6 uses the old key, but that key expires soon and will not be updated (because 5.6 is no longer supported). I would suggest removing 5.6 builds. |
Since the key change is part of the regular release, we need to up the version to 5.7.37 and 8.0.28
|
What I've been doing with unsupported upstreams is just to remove the key and the /etc/apt/sources.list.d entry from them after build. Then the key can't cause trouble, but other things in the image may still be updatable by child images. |
|
Ahhh, I've looked and looked for a canonical place that says "5.6 is EOL" and all I can find is wishy-washy "EOL on X" notices, presumably because it's still technically "supported" but maybe only if you have an active support contract or something? If the public/open version is EOL, we should definitely just remove it from the repository entirely. 😅 Edit: opened a PR at #810 to completely remove 5.6 |
|
@ltangvald I've cherry-picked #810 into this one so we can kill both birds here, but I'm happy to pull that back out if you prefer? ❤️ |
|
Please don't remove 5.5 or 5.6 from dockerhub, as ddev uses those for upstream. They're only used by people who are resurrecting and updating old sites, and only used for local dev. |
|
Removing tags here will remove them from the "Supported" section on the Hub readme (and will prevent official images from spending cycles rebuilding them on the official build servers), but the tags will still be available to users who want them. (See https://github.com/docker-library/official-images#library-definition-files for more detail on this.) |
|
Since the release is out and all looks good, I'll merge this now. As mentioned, removing 5.6 from the code just means we stop building it. The image will still be there (it does mean you'll need to keep the base os layer updated yourself). |
Changes: - docker-library/mysql@f4032a1: Merge pull request docker-library/mysql#808 from ltangvald/master - docker-library/mysql@aa60002: Remove EOL 5.6 - docker-library/mysql@25b68c6: Update server versions - docker-library/mysql@e0359cc: Apply template changes - docker-library/mysql@2fc7349: Update to new MySQL GPG Key - docker-library/mysql@37cf404: Merge pull request docker-library/mysql#798 from ducksecops/master - docker-library/mysql@4207add: update GOSU to 1.14
You broke the GPG key and now the official docker images don't work. |
Not actually related to this PR. The official mysql apt repo is using a new signing key. The old one uses DSA1024, which is no longer considered secure. |
|
Got it, my mistake. Is there any insight on how long until the official images are fixed? |
|
I'm not clear on when/how rebuilds happen for official images. @tianon ? |
|
Short answer is they are built once the commits here are referenced in the |
As part of the 8.0.28 release, MySQL is introducing a new gpg key. It's a new key instead of extending the duration of the old one because the encryption algorithm has been changed.