CI failure "buster-backports InRelease: The following signatures couldn't be verified because the public key is not available" #27531

Is there an existing issue for this?

• I have searched the existing issues

Current behaviour

Not sure if this CI failure would be fixed by a rebase but the failure happens reliably in the merge_base phase of the "[no wallet, libbitcoinkernel] [focal]" the task in #26485 when the task is rerun:

https://cirrus-ci.com/task/6566074339033088

Reading package lists...
W: GPG error: http://deb.debian.org/debian buster-backports InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 648ACFD622F3D138 NO_PUBKEY 0E98404D386FA1D9
E: The repository 'http://deb.debian.org/debian buster-backports InRelease' is not signed.

Exit status: 100

Expected behaviour

Would expect CI task to succeed, or fail for other PRs as well. Unclear why task seems to fail reliably only for this PR

Steps to reproduce

Rerun CI task https://cirrus-ci.com/task/6566074339033088

Relevant log output

No response

How did you obtain Bitcoin Core

Other

What version of Bitcoin Core are you using?

master

Operating system and version

CI

Machine specifications

No response

Think this might be part of #27492?

Yeah, sorry this is a duplicate. My recommendation for now would be to rebase, if there has been no or only stale review, and ignore the failure for now? My long term hope is that Cirrus fixes the issue. An alternative might be to revert this part of the CI change.

Thanks. The thing I don't understand is why rebasing fixes the problem when rerunning the task doesn't fix the problem.

This failure doesn't seem to have anything to do with the contents of the PR, so I wouldn't expect pushing a rebased version of the PR to change anything. How is rebasing actually different than rerunning? Does a github push clear some cirrus cache that would otherwise not be cleared? I think I've been confused about this behavior in other contexts so would appreciate any pointers to understand why it happens.

Yeah, in Cirrus there is a setting to merge the cirrus.yaml of the pull request with the one in the target branch. It is enabled, however it doesn't merge the git contents. Thus, there is a workaround step to achieve that: https://github.com/bitcoin/bitcoin/blob/91ccb62faab21b2b52b089cc04f3a5c1bf6989cc/.cirrus.yml#L27

However, the workaround does not work for Cirrus Docker Env files. Ideally this is fixed by Cirrus CI. I don't see another workaround than either rebasing or removing the Env feature here.