||/ Name           Version             Architecture Description
+++-==============-===================-============-============================================
ii  lxc-templates  3.0.4.48.g4765da8-1 amd64        Linux Containers userspace tools (templates)


Hello !

Context: we want to create a lxc with the lxc-debian template on a bookworm server without any access to internet.

We identified three issues preventing to achieve our goal and had to edit the /usr/share/lxc/templates/lxc-debian to succeed.

Description:

The download_debian() function states that it must verify signatures using /etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg but since bookworm, debian-archive-keyring install gpg files into the /usr/share/keyrings folder only. See https://packages.debian.org/bookworm/all/debian-archive-keyring/filelist versus bullseye version.

Path lreleasekeyring=/etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg does not exist hence it always tries to download from http://ftp-master.debian.org <http://ftp-master.debian.org/>. Which fails on a no internet access server.

A workaround is to add the --keyring /usr/share/keyrings/debian-archive-$release-stable.gpg args to the command as followed:
 lxc-create -n test -t debian -- --mirror http://mymirror/debian --security-mirror http://mymirror/debian-security  --release bookworm --keyring /usr/share/keyrings/debian-archive-buster-stable.gpg

A solution would be to modify the line 436 from:
-     lreleasekeyring=/etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg
+    lreleasekeyring=/usr/share/keyrings/debian-archive-$release-stable.gpg

OR install the gpg keys back to etc/apt/trusted.gpg.d/ folder or whatever you see as a better fit ;).

Regards,

Eppii

Hi,

Thanks for the report.

Eppii <eppii@gandi.net> wrote on 13/06/2024 at 09:54:47+0200:

You can also create a symlink as a workaround.

It'll require a bit more flexibility to stay backward compatible. :)

The motivation behind moving the keys to /usr is that /etc is for sysops to
maintain configuration/variable parts. These keys are not to be touched,
so they should go to a place that is not to be touched by sysops.

I'll design a patch.

Thx,

Would be great! x3

Eppii

Hello,

Just a comment about backward compatibility bellow:

It seems that pub keys lives into /usr/share/keyrings/ from a long time now, and will stay this way in the future; see https://packages.debian.org/buster/all/debian-archive-keyring/filelist

Shouldn’t it source from the beginning into the /usr path?

We believe that the bug you reported is fixed in the latest version of
lxc-templates, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1073132@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Pierre-Elliott Bécue <peb@debian.org> (supplier of updated lxc-templates package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 15 Sep 2026 22:46:12 +0200
Source: lxc-templates
Architecture: source
Version: 3.0.4.97.ga9feb21-2
Distribution: unstable
Urgency: medium
Maintainer: pkg-lxc <pkg-lxc-devel@lists.alioth.debian.org>
Changed-By: Pierre-Elliott Bécue <peb@debian.org>
Closes: 1073132
Changes:
 lxc-templates (3.0.4.97.ga9feb21-2) unstable; urgency=medium
 .
   * d/control:
     - Drop busybox-static: the busybox template is shipped by liblxc-common.
     - Drop the cdebootstrap alternative: templates explicitly use debootstrap.
     - Move bridge-utils and mmdebstrap from Recommends to Suggests.
     - Explicitly recommend wget and ca-certificates for downloads.
     - Suggest bzip2, curl, gpg, openssh-server and squashfs-tools for templates
       that need them.
   * d/p:
     - Reindex old patches
     - 0006: Fix debian template key checking by using /usr/share/keyrings
       (Closes: #1073132)
     - 0007: Fix ubuntu-cloud template
Checksums-Sha1:
 b731161f396cb4f27e6b9dec38c5b4ee1cd3b171 2096 lxc-templates_3.0.4.97.ga9feb21-2.dsc
 499d62a6207c552874793eb16537e601ecac6142 13496 lxc-templates_3.0.4.97.ga9feb21-2.debian.tar.xz
 85c2c0a01880acd79b4e25b422b2122a57fa841f 5623 lxc-templates_3.0.4.97.ga9feb21-2_amd64.buildinfo
Checksums-Sha256:
 4bf7749787f30a30ad367f71e40177e88b696eb7881302dd8b002e5688890b48 2096 lxc-templates_3.0.4.97.ga9feb21-2.dsc
 772f929fc06bc55c12cb743379d460137e384e554b20c123e9f52744a178d25a 13496 lxc-templates_3.0.4.97.ga9feb21-2.debian.tar.xz
 de58988b7e2f413e518e70b40361695d0835eddb7eb22e9749a5fd9f0792ceeb 5623 lxc-templates_3.0.4.97.ga9feb21-2_amd64.buildinfo
Files:
 7640ec6265850582ea7ef7f98a202646 2096 admin optional lxc-templates_3.0.4.97.ga9feb21-2.dsc
 f3990982dacf263d8ee7d36b4550b011 13496 admin optional lxc-templates_3.0.4.97.ga9feb21-2.debian.tar.xz
 b4399c869579cc5ab230fa31074c54ed 5623 admin optional lxc-templates_3.0.4.97.ga9feb21-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEE5CQeth7uIW7ehIz87iFbn7jEWwsFAmqps4MPHHBlYkBkZWJp
YW4ub3JnAAoJEO4hW5+4xFsLhJQQAJeX0YHP6H+7wZvwyPSoGXObuSjKxeeF480F
mwEwca/w3pGOql3nyWh5w/fl2h3oukk416UvXJH1Im7I1SVZ3FTz47W8AinXLBB3
tpMNDz0V2xBQz2RRHqemc3UEejCbs4Q4zByaD8dMizEY/23+pZwrV1Ne14xithEn
5Lb44J89chyJtxvvq8+RY7QphsiRvGoJLRUsKmnIC0ahFNL7bjPFb//KUVgkawlD
PYtRx6KsriBYGRKDC/Rl7+aQjz/iur8GfZH/uyAJRcQcuKxRKltUZgHU+m+yhSws
ubPPA0yKvLgEjifJb4eh7iT3bysQD6yw961HASSb5bvsVAVUybahA+P7ShusmveX
4zyDlYJ5bUwQyKaVEX21RWunnJW/ZQMlbR7gxbwS+x9IFUwbp37xHK4TdmS3SM6S
lg/Y8l/+tTvPLcTL2vlVK6zSHo16vkB7LNx/NEjPj03BZ38QDlkjBh7NfogJY+cK
kuqD4KP6JB02PrnvMc7+RBSbPm5I1zBUzY1LWiyLgZadSRFYApX+QtYBnEBvStuS
Pzp2jbQppZY9fuR5pru6hfeQFFKkWw6GnwR7I6IsRkD9fbW263ozWLMQwMApPKgN
cTtVXY8W3BoOleXBG1m07BAzVAZjUWCbYgG9Mz1KRZqUttzg0f7SdNwrHJMhX28a
GUMREcyu
=ejPX
-----END PGP SIGNATURE-----