Failed to build template - qubes-builder-v2 -

User Support
1

I really don’t understand this error message and how to fix it. I just ran sudo ./qb template prep with the default arch example config, but it effects every template build. I’m pretty sure that I’m did nothing wrong with importing and trusting the keys. Any ideas what I could done wrong? And how to fix?

Also /builder was empty before.

sudo ./qb template prep

Running template stages: prep
19:00:21 [qb.fetch.builder-archlinux.fetch] copy-in (cmd): docker cp /tmp/tmpeh7ve6k3/. 0c49fe0458129fd2ad4cdc318d60031460ff75fe7d282cf5c8b41b19c812d0d6:/
19:00:21 [qb.fetch.builder-archlinux.fetch] copy-in (cmd): docker cp /tmp/tmpeh7ve6k3/. 0c49fe0458129fd2ad4cdc318d60031460ff75fe7d282cf5c8b41b19c812d0d6:/builder
19:00:21 [qb.fetch.builder-archlinux.fetch] copy-in (cmd): docker cp /tmp/tmpeh7ve6k3/. 0c49fe0458129fd2ad4cdc318d60031460ff75fe7d282cf5c8b41b19c812d0d6:/builder/plugins
19:00:21 [qb.fetch.builder-archlinux.fetch] copy-in (cmd): docker cp /home/user/qubes-builderv2/qubesbuilder/plugins/fetch 0c49fe0458129fd2ad4cdc318d60031460ff75fe7d282cf5c8b41b19c812d0d6:/builder/plugins
19:00:21 [qb.fetch.builder-archlinux.fetch] Using executor docker:0c49fe045812 to run 'sudo mkdir -p -- /builder /builder/build /builder/plugins /builder/distfiles&&sudo chown -R -- user:user /builder&&cd /builder&&/builder/plugins/fetch/scripts/get-and-verify-source.py https://github.com/qubesos/qubes-builder-archlinux.git /builder/builder-archlinux /builder/keyring /builder/plugins/fetch/keys --git-branch main --minimum-distinct-maintainers 1'.
19:00:23 [qb.fetch.builder-archlinux.fetch] --> Verifying tags...
19:00:23 [qb.fetch.builder-archlinux.fetch] ERROR: CalledProcessError(1, ['git', '-c', 'gpg.program=/usr/bin/gpg', '-c', 'gpg.minTrustLevel=fully', 'verify-tag', '--raw', '--', 'dc64c67f9fa1f7d7aa49294abf42f70615fb087f']); stderr: b'[GNUPG:] NEWSIG\n[GNUPG:] ERRSIG 063938BA42CFA724 1 8 00 1773435478 9 0064428F455451B3EBE78A7F063938BA42CFA724\n[GNUPG:] NO_PUBKEY 063938BA42CFA724\n[GNUPG:] FAILURE gpg-exit 33554433\n'
19:00:23 [qb.fetch.builder-archlinux.fetch] ---> Invalid tag dc64c67f9fa1f7d7aa49294abf42f70615fb087f.
19:00:23 [qb.fetch.builder-archlinux.fetch] Not enough distinct tag signatures. Found 0, mandatory minimum is 1.
19:00:23 [qb] An error occurred: Failed to run 'sudo mkdir -p -- /builder /builder/build /builder/plugins /builder/distfiles&&sudo chown -R -- user:user /builder&&cd /builder&&/builder/plugins/fetch/scripts/get-and-verify-source.py https://github.com/qubesos/qubes-builder-archlinux.git /builder/builder-archlinux /builder/keyring /builder/plugins/fetch/keys --git-branch main --minimum-distinct-maintainers 1' (status=1).
19:00:23 [qb] 
Traceback (most recent call last):
  File "/home/user/qubes-builderv2/qubesbuilder/cli/cli_base.py", line 107, in __call__
    rv = self.main(*args, standalone_mode=False, **kwargs)  # type: ignore[call-overload]
  File "/usr/lib/python3.14/site-packages/click/core.py", line 1435, in main
    rv = self.invoke(ctx)
  File "/home/user/qubes-builderv2/qubesbuilder/cli/cli_base.py", line 85, in invoke
    return super().invoke(ctx)
           ~~~~~~~~~~~~~~^^^^^
  File "/usr/lib/python3.14/site-packages/click/core.py", line 1902, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/home/user/qubes-builderv2/qubesbuilder/cli/cli_base.py", line 85, in invoke
    return super().invoke(ctx)
           ~~~~~~~~~~~~~~^^^^^
  File "/usr/lib/python3.14/site-packages/click/core.py", line 1933, in invoke
    rv.append(sub_ctx.command.invoke(sub_ctx))
              ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/click/core.py", line 1298, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/click/core.py", line 853, in invoke
    return callback(*args, **kwargs)
  File "/usr/lib/python3.14/site-packages/click/decorators.py", line 46, in new_func
    return f(get_current_context().obj, *args, **kwargs)
  File "/home/user/qubes-builderv2/qubesbuilder/cli/cli_template.py", line 93, in prep
    _template_stage(
    ~~~~~~~~~~~~~~~^
        config=obj.config,
        ^^^^^^^^^^^^^^^^^^
    ...<2 lines>...
        template_timestamp=template_timestamp,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/home/user/qubes-builderv2/qubesbuilder/cli/cli_template.py", line 59, in _template_stage
    job.run(template_timestamp=template_timestamp)
    ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/qubes-builderv2/qubesbuilder/plugins/fetch/__init__.py", line 173, in run
    executor.run(cmd, copy_in, copy_out, environment=self.environment)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/qubes-builderv2/qubesbuilder/executors/container.py", line 286, in run
    raise e
  File "/home/user/qubes-builderv2/qubesbuilder/executors/container.py", line 257, in run
    raise ExecutorError(msg, name=self.container.id)
qubesbuilder.executors.ExecutorError: Failed to run 'sudo mkdir -p -- /builder /builder/build /builder/plugins /builder/distfiles&&sudo chown -R -- user:user /builder&&cd /builder&&/builder/plugins/fetch/scripts/get-and-verify-source.py https://github.com/qubesos/qubes-builder-archlinux.git /builder/builder-archlinux /builder/keyring /builder/plugins/fetch/keys --git-branch main --minimum-distinct-maintainers 1' (status=1).
2

The useful part of the log is this:

NO_PUBKEY 063938BA42CFA724

So it is failing before the Arch template build really starts. The fetch plugin is trying to verify the builder-archlinux git tag, but the public key for that tag signer is not in the keyring used inside /builder.

I would not lower --minimum-distinct-maintainers or bypass the tag check. First update the builder-v2 checkout and its plugins/submodules, then rebuild the local builder keyring/cache. In practice I would try from the builder checkout:

git pull --recurse-submodules
git submodule update --init --recursive

then remove the stale generated /builder/keyring/fetch cache if it was created by the failed run and run ./qb template prep again. If the same key is still missing after a clean/update, then it is probably worth opening an issue with that exact fingerprint and the builder-archlinux tag hash, because the verification key set may be out of sync with the tag being fetched.

2 Likes
3

Hey! Thank you, it kinda worked!

At least now running the command manually works, but using the qubes builder tool not, it does not detect the key for some reason.

so
sudo mkdir -p -- /builder /builder/build /builder/plugins /builder/distfiles&&sudo chown -R -- user:user /builder&&cd /builder&&/builder/plugins/fetch/scripts/get-and-verify-source.py https://github.com/qubesos/qubes-builder-archlinux.git /builder/builder-archlinux /builder/keyring /builder/plugins/fetch/keys --git-branch main --minimum-distinct-maintainers 1
works, but not
sudo ./qb template prep

4

I think that means your docker executer somehow doesn’t want to verify the GPG signature. How about switching to a Qubes executer or local executer? According to the build logs in Qubes github repositories, the official packages are built using local executer, so there might be a difference.

5

With podman it doesn’t work either…