GPG for Artifactory Debian install?

classic Classic list List threaded Threaded
10 messages Options
Reply | Threaded
Open this post in threaded view
|

GPG for Artifactory Debian install?

Lars Skjærlund
Since 4.2.0, Artifactory offers installation through Debian packages.

The download page describes the installation process as follows:

echo "deb https://jfrog.bintray.com/artifactory-pro-debs {distribution} {components}" | sudo tee -a /etc/apt/sources.list
sudo apt-get update
sudo apt-get install jfrog-artifactory-pro

However, the Debian package manager won't accept the repository without a GPG security key, so this method doesn't work.

What's the key?

Regards,
Lars
Reply | Threaded
Open this post in threaded view
|

Re: GPG for Artifactory Debian install?

Lars Skjærlund
I tried installing it anyway, telling apt-get to ignore security.

But nor does that work:

root@arty:/etc/apt/sources.list.d# apt-get --allow-unauthenticated install jfrog-artifactory-pro
Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 jfrog-artifactory-pro : Depends: java8-runtime-headless but it is not installable
E: Unable to correct problems, you have held broken packages.

The machine is a fresh test machine, installed with Debian 8 Jessie a few hours ago.

Regards,
Lars
Reply | Threaded
Open this post in threaded view
|

Re: [#33449] GPG for Artifactory Debian install?

JFrog Support
Hi Lars,

Thank you for contacting us.
Debian tools require to have java installed as a debian distribution and not installed as a regular zip or a tar gz file.
We have an open Jira for this
issue which you can follow-up.

Regarding the bintray public key, please find the relevant
information here.
We hope this helps.

Best Regards,
Guy
JFrog Support 

 
On Thu, 5 Nov at 2:24 PM , artifactory-users <[hidden email]> wrote:
I tried installing it anyway, telling apt-get to ignore security.

But nor does that work:

root@arty:/etc/apt/sources.list.d# apt-get --allow-unauthenticated install
jfrog-artifactory-pro
Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
jfrog-artifactory-pro : Depends: java8-runtime-headless but it is not
installable
E: Unable to correct problems, you have held broken packages.

The machine is a fresh test machine, installed with Debian 8 Jessie a few
hours ago.

Regards,
Lars



--
View this message in context: http://forums.jfrog.org/GPG-for-Artifactory-Debian-install-tp7580561p7580562.html
Sent from the Artifactory - Users mailing list archive at Nabble.com.

------------------------------------------------------------------------------
_______________________________________________
Artifactory-users mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/artifactory-users
33449

------------------------------------------------------------------------------

_______________________________________________
Artifactory-users mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/artifactory-users
Reply | Threaded
Open this post in threaded view
|

Re: [#33449] GPG for Artifactory Debian install?

Lars Skjærlund
Enabling jessie-backports on Debian 8 solves the Java-problem - even Jessie (only six months old) doesn't have support for Java 8.

But I can't possible see how the information at

https://bintray.com/docs/usermanual/uploads/uploads_gpgsigning.html

is relevant regarding the GPG issue: I need the public key from the keypair that was used to sign the .deb packages.

The private Jenkins repository uses it this way:

wget -q -O - http://pkg.jenkins-ci.org/debian/jenkins-ci.org.key | sudo apt-key add -
deb http://pkg.jenkins-ci.org/debian binary/
apt-get update
apt-get install jenkins

How do I get the equivalent of the jenkins-ci.org.key for the Artifactory repository?

Regards,
Lars
Reply | Threaded
Open this post in threaded view
|

Re: [#33449] GPG for Artifactory Debian install?

ssevertson
Echoing Lars's comment, the https://jfrog.bintray.com/artifactory-pro-debs repo does *not* use BinTray's public signing key. The key in use has the fingerprint "D7639232", which I cannot track down anywhere.

Please provide (and link to from the repo itself) the GPG public key used to sign the repo! This is preventing us from installing the pro version and moving forward with an evaluation.

Thanks,
--Scott
Reply | Threaded
Open this post in threaded view
|

Re: [#33449] GPG for Artifactory Debian install?

razvan.botez
I found out that using the ubuntu keyserver works for me:

# apt-key adv --keyserver keyserver.ubuntu.com --recv 6B219DCCD7639232

Cheers,
Razvan
Reply | Threaded
Open this post in threaded view
|

Re: [#33449] GPG for Artifactory Debian install?

gtrub00
Same issue for me  
W: Failed to fetch
https://jfrog.bintray.com/artifactory-pro-debs/dists/{distribution}/{components}/binary-amd64/Packages
HttpError404
I successfully executed the sudo apt-key adv --keyserver
keyserver.ubuntu.com --recv 6B219DCCD7639232 but no change in behavior



--
View this message in context: http://forums.jfrog.org/GPG-for-Artifactory-Debian-install-tp7580561p7580640.html
Sent from the Artifactory - Users mailing list archive at Nabble.com.

------------------------------------------------------------------------------
Go from Idea to Many App Stores Faster with Intel(R) XDK
Give your users amazing mobile app experiences with Intel(R) XDK.
Use one codebase in this all-in-one HTML5 development environment.
Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140
_______________________________________________
Artifactory-users mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/artifactory-users
Reply | Threaded
Open this post in threaded view
|

Re: [#33449] GPG for Artifactory Debian install?

gtrub00
In reply to this post by razvan.botez
The key mentioned above didn't work for me.  I contacted support and listed below is what they provided.  I was able to download and install the pro version using it.
$ sudo add-apt-repository ppa:webupd8team/java
$ sudo apt-get update
$ sudo apt-get install oracle-java8-installer
$ echo "deb https://jfrog.bintray.com/artifactory-pro-debs trusty main" | sudo tee -a /etc/apt/sources.list
$ sudo apt-get update
$ sudo apt-get install jfrog-artifactory-pro

Reply | Threaded
Open this post in threaded view
|

Re: [#33449] GPG for Artifactory Debian install?

razvan.botez
This post was updated on .
Well, yeah, you are supposed to replace whatever is between the {} brackets with your distro details (and you are on Ubuntu, not Debian, which is a different distro). But that's another issue.

The reason why you are able to apt-get update is that you imported the key. If you didn't have done that, you would have received an error while running the update command. ;)

Also, the " sudo tee -a /etc/apt/sources.list " part is a "Bad Idea tm.". Best practice would be to leave the main sources.list file alone and create a separate repo file /etc/apt/sources.list.d/jfrog.repo containing "deb https://jfrog.bintray.com/artifactory-pro-debs trusty main" (remove the quotes around the string and adapt to your distro details).

Not the best instructions in the Debian section, unfortunately...
Reply | Threaded
Open this post in threaded view
|

Re: [#33449] GPG for Artifactory Debian install?

Lars Skjærlund
razvan.botez wrote
Also, the " sudo tee -a /etc/apt/sources.list " part is a "Bad Idea tm.". Best practice would be to leave the main sources.list file alone and create a separate repo file /etc/apt/sources.list.d/jfrog.repo containing "deb https://jfrog.bintray.com/artifactory-pro-debs trusty main"
I second that.

Regards,
Lars