AWS CodeBuild所有构建失败求助：apt update因Yarn签名失效报错

此前稳定运行一年的AWS CodeBuild配置，昨晚突然全部构建失败。INSTALL阶段执行apt update时，因Yarn仓库GPG签名过期（EXPKEYSIG 23E7166788B63E1E）导致命令退出状态100，更换任意AWS构建环境问题一致。

解决步骤 #

方法1：更新Yarn GPG密钥 #

在buildspec.yml的INSTALL阶段、apt update命令前添加以下指令，重新导入有效的Yarn GPG密钥：

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor | tee /usr/share/keyrings/yarnkey.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/yarnkey.gpg] https://dl.yarnpkg.com/debian stable main" | tee /etc/apt/sources.list.d/yarn.list

方法2：临时跳过签名验证（仅应急使用） #

若需快速恢复构建，可修改apt update命令跳过签名检查：

apt update --allow-unauthenticated

方法3：使用预安装Yarn的CodeBuild镜像 #

切换到AWS CodeBuild官方预安装Yarn的镜像（如aws/codebuild/standard:6.0及以上版本），避免手动配置Yarn仓库。

构建日志详情 #

[Container] 2023/01/25 11:08:31 Waiting for agent ping
[Container] 2023/01/25 11:08:32 Waiting for DOWNLOAD_SOURCE
[Container] 2023/01/25 11:09:01 Phase is DOWNLOAD_SOURCE
[Container] 2023/01/25 11:09:01 CODEBUILD_SRC_DIR=/codebuild/output/src499283105/src/github.com/TeamTizo/Tizohub
[Container] 2023/01/25 11:09:01 YAML location is /codebuild/output/src499283105/src/github.com/TeamTizo/Tizohub/buildspec.yml
[Container] 2023/01/25 11:09:01 Setting HTTP client timeout to higher timeout for Github and GitHub Enterprise sources
[Container] 2023/01/25 11:09:01 Processing environment variables
[Container] 2023/01/25 11:09:01 Setting HTTP client timeout to higher timeout for Github and GitHub Enterprise sources
[Container] 2023/01/25 11:09:01 Setting HTTP client timeout to higher timeout for Github and GitHub Enterprise sources
[Container] 2023/01/25 11:09:01 No runtime version selected in buildspec.
[Container] 2023/01/25 11:09:03 Moving to directory /codebuild/output/src499283105/src/github.com/TeamTizo/Tizohub
[Container] 2023/01/25 11:09:03 Configuring ssm agent with target id: codebuild:a8fabfec-8d23-4369-bfcd-40ebd15907f6
[Container] 2023/01/25 11:09:03 Successfully updated ssm agent configuration
[Container] 2023/01/25 11:09:03 Registering with agent
[Container] 2023/01/25 11:09:03 Phases found in YAML: 4
[Container] 2023/01/25 11:09:03  INSTALL: 3 commands
[Container] 2023/01/25 11:09:03  PRE_BUILD: 9 commands
[Container] 2023/01/25 11:09:03  BUILD: 3 commands
[Container] 2023/01/25 11:09:03  POST_BUILD: 3 commands
[Container] 2023/01/25 11:09:03 Phase complete: DOWNLOAD_SOURCE State: SUCCEEDED
[Container] 2023/01/25 11:09:03 Phase context status code:  Message: 
[Container] 2023/01/25 11:09:03 Entering phase INSTALL
[Container] 2023/01/25 11:09:03 Running command ls -alt
total 272
drwxr-xr-x  3 root root     21 Jan 25 11:09 ..
drwxr-xr-x  9 root root    147 Jan 25 11:09 writable
drwxr-xr-x 10 root root   4096 Jan 25 11:09 .
drwxr-xr-x 36 root root   4096 Jan 25 11:09 system
-rw-r--r--  1 root root    384 Jan 25 11:09 th_env.php
drwxr-xr-x  3 root root    173 Jan 25 11:09 public
-rw-r--r--  1 root root   2236 Jan 25 11:09 spark
-rw-r--r--  1 root root   3895 Jan 25 11:08 package-lock.json
-rw-r--r--  1 root root   2061 Jan 25 11:08 phpunit.xml.dist
drwxr-xr-x 49 root root   4096 Jan 25 11:08 modules
-rw-r--r--  1 root root      0 Jan 25 11:08 error.log
-rw-r--r--  1 root root   1870 Jan 25 11:08 buildspec.yml
-rw-r--r--  1 root root   1861 Jan 25 11:08 composer.json
-rw-r--r--  1 root root 222990 Jan 25 11:08 composer.lock
drwxr-xr-x  3 root root     20 Jan 25 11:08 devops
drwxr-xr-x 14 root root    248 Jan 25 11:08 app
drwxr-xr-x  4 root root     36 Jan 25 11:08 build
-rw-r--r--  1 root root    684 Jan 25 11:08 .env
-rw-r--r--  1 root root   2038 Jan 25 11:08 .gitignore
-rw-r--r--  1 root root   1159 Jan 25 11:08 LICENSE
-rw-r--r--  1 root root     31 Jan 25 11:08 README.md
drwxr-xr-x  4 root root     87 Jan 25 11:08 .git

[Container] 2023/01/25 11:09:03 Running command apt update

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Get:1 http://security.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
Get:2 https://apt.corretto.aws stable InRelease [10.7 kB]
Get:3 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy InRelease [23.8 kB]
Get:4 https://dl.yarnpkg.com/debian stable InRelease [17.1 kB]
Get:5 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:6 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [114 kB]
Get:7 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [99.8 kB]
Get:8 https://apt.corretto.aws stable/main amd64 Packages [11.8 kB]
Get:9 https://apt.corretto.aws stable/main i386 Packages [3514 B]
Get:10 http://security.ubuntu.com/ubuntu jammy-security/restricted i386 Packages [31.1 kB]
Get:11 http://security.ubuntu.com/ubuntu jammy-security/multiverse i386 Packages [990 B]
Get:12 http://security.ubuntu.com/ubuntu jammy-security/multiverse amd64 Packages [4732 B]
Get:13 http://security.ubuntu.com/ubuntu jammy-security/main i386 Packages [293 kB]
Get:14 http://security.ubuntu.com/ubuntu jammy-security/universe amd64 Packages [793 kB]
Get:15 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages [740 kB]
Get:16 http://security.ubuntu.com/ubuntu jammy-security/restricted amd64 Packages [681 kB]
Get:17 http://security.ubuntu.com/ubuntu jammy-security/universe i386 Packages [605 kB]
Get:18 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy/main i386 Packages [2955 B]
Get:19 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy/main amd64 Packages [2960 B]
Err:4 https://dl.yarnpkg.com/debian stable InRelease
  The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
Get:20 http://archive.ubuntu.com/ubuntu jammy/universe i386 Packages [9385 kB]
Get:21 http://archive.ubuntu.com/ubuntu jammy/multiverse amd64 Packages [266 kB]
Get:22 http://archive.ubuntu.com/ubuntu jammy/multiverse i386 Packages [134 kB]
Get:23 http://archive.ubuntu.com/ubuntu jammy/restricted amd64 Packages [164 kB]
Get:24 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages [1792 kB]
Get:25 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages [17.5 MB]
Get:26 http://archive.ubuntu.com/ubuntu jammy/restricted i386 Packages [36.7 kB]
Get:27 http://archive.ubuntu.com/ubuntu jammy/main i386 Packages [1324 kB]
Get:28 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages [1055 kB]
Get:29 http://archive.ubuntu.com/ubuntu jammy-updates/restricted amd64 Packages [730 kB]
Get:30 http://archive.ubuntu.com/ubuntu jammy-updates/restricted i386 Packages [31.5 kB]
Get:31 http://archive.ubuntu.com/ubuntu jammy-updates/universe i386 Packages [705 kB]
Get:32 http://archive.ubuntu.com/ubuntu jammy-updates/multiverse amd64 Packages [8978 B]
Get:33 http://archive.ubuntu.com/ubuntu jammy-updates/main i386 Packages [516 kB]
Get:34 http://archive.ubuntu.com/ubuntu jammy-updates/multiverse i386 Packages [1738 B]
Get:35 http://archive.ubuntu.com/ubuntu jammy-updates/universe amd64 Packages [999 kB]
Get:36 http://archive.ubuntu.com/ubuntu jammy-backports/universe amd64 Packages [7286 B]
Get:37 http://archive.ubuntu.com/ubuntu jammy-backports/universe i386 Packages [5545 B]
Get:38 http://archive.ubuntu.com/ubuntu jammy-backports/main amd64 Packages [3520 B]
Get:39 http://archive.ubuntu.com/ubuntu jammy-backports/main i386 Packages [3479 B]
Reading package lists...
W: https://apt.corretto.aws/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: https://dl.yarnpkg.com/debian/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging <yarn@dan.cx>
E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.

[Container] 2023/01/25 11:09:09 Command did not exit successfully apt update exit status 100
[Container] 2023/01/25 11:09:09 Phase complete: INSTALL State: FAILED
[Container] 2023/01/25 11:09:09 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: apt update. Reason: exit status 100

内容的提问来源于stack exchange，提问作者steve