I am trying to deploy a service (let's say keystone) using juju-deployer and have set the "openstack-origin" to the private debian repo that we have set up. I have set the openstack-origin like this:

"openstack-origin": "deb http://local-mirror.company.com/ubuntu-cloud trusty-updates/juno main"

When I deploy the service it successfully adds the debian repo to the source list by adding a new file /etc/apt/sources.list.d/juju_deb.list and the content is the same as what I set openstack-origin to:

deb http://local-mirror.company.com/ubuntu-cloud trusty-updates/juno mainu

So far so good. The issue is that when the system goes to install packages from that repo we see the following error:

WARNING: The following packages cannot be authenticated!
  python-dogpile.core python-netaddr python-six python-stevedore
  python-oslo.config python-pbr python-keystoneclient
  python-keystonemiddleware python-ldappool python-sqlalchemy python-migrate
  python-alembic alembic python-oslo.i18n python-oslo.utils python-oslo.db
  python-oslo.serialization python-posix-ipc python-eventlet python-amqp
  python-oslo.messaging python-pycadf python-dogpile.cache
  python-sqlalchemy-ext python-keystone keystone
E: There are problems and -y was used without --force-yes

If I manually get on that system that juju is attempting to install the service on then I can reproduce the issue by performing an sudo apt-get -y install keystone and I can also see that I get the following error if I try sudo apt-get update:

W: GPG error: http://local-mirror.company.com trusty-updates/juno Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5EDB1B62EC4926EA

So... my question is how do I make juju add the appropriate public key to this system when it adds the debian repo to the source list so that when it tries to install the package we don't get a hook error? To be clear I am not asking how to add the key manually using apt-key - I need to be able to add the key from juju-deployer when the new service is deployed.


For the OpenStack charms a key for a deb url source entry can be specified in the openstack-origin config setting separated by a pipe character. When the key is included as part of the openstack-origin setting, the charms will attempt to import the key from keyserver.ubuntu.com.

e.g. juju set openstack-origin nova-compute openstack-origin="deb http://ppa.launchpad.net/billy-olsen/testfix-kilo/ubuntu vivid main|FA0FD8E1"

One thing to note is that the OpenStack charms use the openstack-origin information to determine which OpenStack release is being installed. As such, it is very important to include the codename of the OpenStack release in the the deb mirrors or ppas. Failure to do so will result in errors when deploying the charms.

  • I will try this ASAP, but where is this in the documentation? – Alex Iannicelli Oct 9 '15 at 11:51
  • Unfortunately, at this time it is not in the documentation. However, the bug that was raised by @beisner was modified to make sure that this is adequately documented. – Billy Olsen Oct 9 '15 at 21:41
  • Is it possible to set Juju to allow an unsigned private repo? I am trying to automate setting up a local APT repo on one of my MAAS/Juju nodes, and install custom Openstack packages from there. – Imran Khakoo Oct 14 '16 at 9:57

A new bug has been raised.

To summarize:

The OpenStack charms provide a config option to specify an arbitrary apt repo, but do not provide a mechanism for adding a corresponding public key for scenarios where a custom apt repo is hosted outside of Launchpad.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.