基于node:8-jessie的Docker镜像遇Packages 404及GPG签名过期问题求助

在容器化环境使用node:8-jessie镜像时，突然出现Packages无法找到的404错误，报错信息如下：

W: Failed to fetch http://security.debian.org/debian-security/dists/jessie/updates/main/binary-amd64/Packages 404 Not Found [IP: 151.101.130.132 80]

W: Failed to fetch http://deb.debian.org/debian/dists/jessie/main/binary-amd64/Packages 404 Not Found

E: Some index files failed to download. They have been ignored, or old ones used instead.

调整Dockerfile后仍出现相同404错误，还新增GPG签名过期错误：

W: GPG error: http://archive.debian.org jessie-backports InRelease: The following signatures were invalid: KEYEXPIRED 1587841717 KEYEXPIRED 1668891673

当前Dockerfile内容：

FROM node:8-jessie

RUN echo 'deb http://archive.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list
RUN sed -i '/jessie-updates/d' /etc/apt/sources.list
RUN apt-get -o Acquire::Check-Valid-Until=false update

问题根源 #

Debian Jessie已终止官方支持，原官方源地址已下线，且用于签名的GPG密钥已过期，导致apt无法正常拉取包索引和验证签名。

修复方案 #

1. 替换全部apt源为归档源 #

将默认的sources.list完全替换为Debian官方归档源，覆盖主源、更新源和安全更新源：

RUN echo "deb http://archive.debian.org/debian jessie main" > /etc/apt/sources.list
RUN echo "deb http://archive.debian.org/debian jessie-updates main" >> /etc/apt/sources.list
RUN echo "deb http://archive.debian.org/debian-security jessie/updates main" >> /etc/apt/sources.list

2. 跳过有效期检查和签名验证 #

添加apt参数，忽略包索引的有效期限制和过期的GPG签名验证，确保更新命令能顺利执行：

RUN apt-get -o Acquire::Check-Valid-Until=false -o Apt::Get::AllowUnauthenticated=true update

完整可用的Dockerfile示例 #

FROM node:8-jessie

# 替换所有apt源为官方归档源
RUN echo "deb http://archive.debian.org/debian jessie main" > /etc/apt/sources.list
RUN echo "deb http://archive.debian.org/debian jessie-updates main" >> /etc/apt/sources.list
RUN echo "deb http://archive.debian.org/debian-security jessie/updates main" >> /etc/apt/sources.list

# 执行更新，跳过有效期检查和签名验证
RUN apt-get -o Acquire::Check-Valid-Until=false -o Apt::Get::AllowUnauthenticated=true update

内容的提问来源于stack exchange，提问作者Kim Briones