{"record":{"id":"393a4315be7759b0","repo":"kubernetes/kops","slug":"error-adding-key-v-s","errorCode":null,"errorMessage":"error adding key: %v: %s","messagePattern":"error adding key: (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/nodeup/nodetasks/aptsource.go","lineNumber":83,"sourceCode":"\t}\n\tdefer func() {\n\t\tif err := os.RemoveAll(tmpDir); err != nil {\n\t\t\tklog.Warningf(\"error deleting temp dir %q: %v\", tmpDir, err)\n\t\t}\n\t}()\n\tfilename := path.Join(tmpDir, f.Name+\".gpg\")\n\n\tif _, err := fi.DownloadURL(ctx, f.Keyring, filename, nil); err != nil {\n\t\treturn err\n\t}\n\n\targs := []string{\"apt-key\", \"add\", filename}\n\n\tklog.Infof(\"running command %s\", args)\n\tcmd := exec.Command(args[0], args[1:]...)\n\toutput, err := cmd.CombinedOutput()\n\tif exitCode := cmd.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(); err != nil && exitCode != 100 {\n\t\treturn fmt.Errorf(\"error adding key: %v: %s\", err, string(output))\n\t}\n\n\tdebs := strings.Join(f.Sources, \"\\n\")\n\n\tif err := os.WriteFile(\"/etc/apt/sources.list.d/\"+f.Name+\".list\", []byte(debs), 0); err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":65,"sourceCodeEnd":94,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/nodetasks/aptsource.go#L65-L94","documentation":"After writing the apt key to the temp file, RenderLocal runs `apt-key add <file>` and captures combined output. If the command fails with an exit code other than the tolerated 100, the error and command output are wrapped with this message. It means the repository key could not be added, so the apt source will not authenticate.","triggerScenarios":"exec of `apt-key add` returns non-zero (excluding exit 100, which is deliberately tolerated) — bad/unsupported key file, apt-key missing, or gpg errors.","commonSituations":"Deprecated/removed apt-key on Debian 12+/Ubuntu 22.04+; corrupted or wrong-format key downloaded from the keyserver; network failure producing an empty key file; expired key.","solutions":["Verify the key file content is a valid PGP key (not an HTML error page) from the keyserver URL","On distros where apt-key is removed, use signed-by keyrings (update the kOps/cluster channel so the model uses /etc/apt/trusted.gpg.d or signed-by)","Check the wrapped command output in the error for the gpg failure detail","Re-run nodeup once network/DNS to the keyserver is working"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// validate key material is a PGP public key before apt-key add\nkey, err := os.ReadFile(keyFile)\nif err != nil || !bytes.Contains(key, []byte(\"BEGIN PGP PUBLIC KEY\")) {\n  return fmt.Errorf(\"key file %s is not a valid PGP key\", keyFile)\n}\nif _, err := exec.LookPath(\"apt-key\"); err != nil {\n  return errors.New(\"apt-key unavailable on this distro; use signed-by keyrings\")","typeGuard":null,"tryCatchPattern":"if err := nodeup.Run(ctx); err != nil {\n  if strings.Contains(err.Error(), \"error adding key\") {\n    // parse the wrapped apt-key output for the gpg failure\n    klog.Errorf(\"apt key install failed: %v\", err)\n  }\n}","preventionTips":["Verify keyserver URLs return keys, not HTML error pages, before bootstrap","Plan for apt-key removal on Debian 12+/Ubuntu 22.04+ (use /etc/apt/keyrings + signed-by)","Keep kOps version current so apt-source tasks match the distro","Confirm DNS/network to keyserver from the node"],"tags":["apt","gpg","nodeup"],"backgroundTag":"apt-key-add-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}