Bug#745735: apt: Provide meaningful exit codes for gpg failures

--0hi+p27zzCxhmdc4
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

* David Kalnischkies [Mon Jul 27, 2026 at 11:48:12AM +0200]:
> Am Fri, Jul 24, 2026 at 06:15:07PM +0200, schrieb Michael Prokop:

> > IMO we should clearly exit with non-zero in case of failures in apt
> > in such situations.
> >=20
> > The behavior in apt v3.0.3 is still like this:
> >=20
> > | % sudo apt update
[...]

> > I've seen too many unpatched + hacked systems which ended up as such
> > due to expired GPG keys in their (usually 3rd party) Debian
> > repositories. IMO this might even warrant a CVE.
>=20
> If apt were to exit non-zero in these situations you would "see too many
> unpatched + hacked systems" as unattended upgrades from the main
> (and security) repositories of your distribution are not applied thanks
> to some tiny long forgotten 3rd party repo the user might not even have
> any packages installed from any longer=E2=80=A6
> So, I don't think there is a trivial black-or-white answer.

Ah good point, thanks.

> I also note that with `--error-on=3Dany` nowadays you can make these types
> of problems result in a non-zero exit code. There exists currently no
> way of programmatically knowing the difference through.

Hm, couldn't we consider 'apt update' + 'apt upgrade' two separate
steps, so even if 'apt update' returns with an exit code other than
zero, its consecutive 'apt upgrade' gets still executed/applied
(with only the repositories considered that do *not* raise an
error)?

Maybe I'm missing something, but isn't it already
apt-daily.service's "/usr/lib/apt/apt.systemd.daily update" which
does the update part, and unattended-upgrades.service (from
unattended-upgrades) which does the actual upgrade part then (so the
exit code not actually being relevant)?

regards
-mika-

--0hi+p27zzCxhmdc4
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEM8yxNkAa/shDo4djlqh4crfqNzcFAmpqmx8ACgkQlqh4crfq
NzemPg//V9WHcY0eTEJh2AhSVhvUDSe8SqrdTsm+rzVwf0JKAbX1RR1u98eSa/OE
d+1Cu8Pt3DvyGB4h9D2iUrmHEgHGhTGXunMimHdCFaGNB4JZg2JQZhcuDWMW4aBG
shYXaXUtAbQZHavsDvAxa6sjzhtpnUhISRj/sNp/KuogZJtbbe9bpVP3t5TTnSd9
xARCLE0ZduHYuyoKccBYURKfduvOos+WEFQpnXKsHXSmQmyjAw/Avur8TOYbspRc
aAUBkk/9pKJ7xk8hp1vl/QF+YutR4KgD68+P7B2dSNS/WDEIWdxmAp5tPwp2lE98
6+GuebkpUDVroQD948b3HHmmKz+629cloXnws+1fW+QcHKrQQ8avNSUu7I7P8CwI
a26iPJ6wPsRmG3G388XA8PdPA677drkPBWeRFlHdif/uUMchbXH5cMXPH7w9sanP
wQ/26AeoJp3IYfLeuYM8FJqV21nAbpHy70yPakAhPhlEeIIPqAuCPAfiYNbJovnr
0KwddlgqY2kgCGAx0GJAOvCPnaSgkO80HRuwkdXEr4l/IVZVujCBaLLtmNmi7RWc
BaUMeAIk9iGKNBCRsUbNeua8UUNoCKzEnHGlM+TGbYMhAkxZz3nPAXk9vLzpKMcs
RpB6QQFajgO8sJXD95WZ0ZT7UuiQRviwO0E6UoyO0oFHbYdYS5g=
=+Uv7
-----END PGP SIGNATURE-----

--0hi+p27zzCxhmdc4--