[NormB]

Summary

scripts/build/reset_sources.sh replaces the Ubuntu archive key that the build image ships with an empty file whenever keyserver.ubuntu.com cannot be reached, and exits 0. The next apt-get update then fails with NO_PUBKEY 871920D1991BC93C. This patch uses the key the image already has and asks the keyserver only when the image has none.

Details

The script runs:

gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 871920D1991BC93C
gpg --export 871920D1991BC93C | ${SUDO} tee /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg > /dev/null

Neither command is checked. In the Build & Test rtp.io module (Quick) job of run 43072186355 (2026-11-11, on #4442) and run 43068444793 (another pull request, the same day) the log shows:

gpg: keyserver receive failed: Connection refused
gpg: WARNING: nothing exported
...
Err:5 http://archive.ubuntu.com/ubuntu resolute-security InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 871920D1991BC93C
E: The repository 'http://archive.ubuntu.com/ubuntu resolute-security InRelease' is not signed.

The sippylabs/rtpproxy:latest image (Ubuntu resolute) already has that key in /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg (1167 bytes) and in /usr/share/keyrings/ubuntu-archive-keyring.gpg. The failed download overwrote the first with a 0-byte file.

Solution

• If the key file already holds the key, leave it.
• Otherwise, if the installed keyring holds it, copy the keyring to the key file.
• Otherwise ask the keyserver, up to five times. Check that the export holds the key before installing it. Exit 1 when it cannot be had, so the job stops at the step that failed.

Testing

Run in the arm64 build of sippylabs/rtpproxy:latest, with the workflow's Install git step first and keyserver.ubuntu.com pointed at 127.0.0.1 to block it. The amd64 image the workflow uses was not run locally; this pull request's own rtp.io run covers it.

Case	Before	After
Keyserver blocked, image has the key file	key file 0 bytes, script rc 0, apt reports NO_PUBKEY (6 lines) and is not signed (3 lines)	key file unchanged (1167 bytes), rc 0, no NO_PUBKEY
Keyserver blocked, key file removed, keyring present	not run	key file copied from the keyring, rc 0, no NO_PUBKEY
Keyserver blocked, no key in the image	not run	five attempts, rc 1
Keyserver reachable, no key in the image	not run	key downloaded and installed (1167 bytes), rc 0

Compatibility

The script is used only by .github/workflows/rtp.io.yml. On an image without the Ubuntu keyring (the bookworm branch of the script) the keyserver path is still taken, now with retries and a non-zero exit on failure.

[NormB]

Closing: the keyserver is reachable again and the rtp.io job passes without this change.