[nodejs-github-bot]

If you are reading this PR soon after it has been merged, you may find that new Docker images are missing or appear broken. Check back later and see the README for background information.

[MikeMcC399]

https://status.canonical.com/#/ is suffering from a major outage, affecting also the availability of:

keyserver.ubuntu.com
keyserver.ubuntu.com:11371

used to verify the Docker builds.

The checks are able to verify the builds for Node.js 26 only.

Unfortunately for Node.js 22 and 24, they rely on checking also Yarn v1 Classic, and that key has a single point of failure with the Ubuntu key server.

[spiechu]

@MikeMcC399 can you re-run the build? Canonical is declaring keyserver is operational again.

[MikeMcC399]

can you re-run the build? Canonical is declaring keyserver is operational again.

I retried, however it's not working yet from within GitHub. There may be some network delays / caching etc.

We will try again soon.

Locally I'm able to check 6A010C5166006599AA17F08146C2130DFD2497F5 - the Yarn v1 signing key

https://keyserver.ubuntu.com/pks/lookup?search=6A010C5166006599AA17F08146C2130DFD2497F5&fingerprint=on&op=index

[LittleGnome]

In case the Ubuntu keyserver stays unreachable from GitHub runners for longer: I opened #2693, which adds a third source for the Yarn v1 key (https://dl.yarnpkg.com/debian/pubkey.gpg) when both keyservers fail, and pins the expected signer (72ECF46A56B4AD39C907BBB71646B01B86E50310) via VALIDSIG, so only that key is trusted regardless of where it was imported from.

Since the update workflow regenerates update-branch from the templates on main, this PR would pick up the fix automatically once #2693 is merged. Local builds of 22/trixie, 22/bookworm-slim and 22/alpine3.23 succeed via the fallback while keyserver.ubuntu.com times out; details are in #2693.

Of course, if the keyserver recovers first, a re-run here is all that's needed.

[MikeMcC399]

Although https://status.canonical.com/#/ states that their keyservers are observed operational, that is not what we are seeing in GitHub, and not what I see locally:

16.45 + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 6A010C5166006599AA17F08146C2130DFD2497F5
61.79 gpg: keyserver receive failed: Connection timed out

This keyserver is used to build many of the other official images published by Docker on the official images Docker Hub site, so it's going to be affecting many pending builds.

Please bear in mind that building the images generally takes several hours for all the architectures involved. It is never an immediate release. See https://github.com/nodejs/docker-node#release-availability for links to background information.

We will continue tracking.

[nschonni]

Although there is still the failure for the Yarn key check, I think this can land. It will either not be an issue with the Dockerhub CI or will stall the same there

[MikeMcC399]

@nschonni

Let's land it and pass it on to the official site, we can add a comment there.

[tianon]

It only caused the comment posting to fail -- the PR at docker-library/official-images#22729 was updated successfully.

[MikeMcC399]

Thanks! @tianon I should have checked there first!

[MikeMcC399]

GitHub Actions is now able to build all images again, so it should also be good in the official Docker images environment.