CI Docker Build Issue (intel public key needs updating?)

[mofosyne]

Regarding the docker build issue in master branch it appears that https://repositories.intel.com/gpu/ubuntu is down with an access denied message

#7 4.701 Reading package lists...
#7 5.410 W: GPG error: https://repositories.intel.com/gpu/ubuntu jammy InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 28DA432DAAC8BAEA
#7 5.410 E: The repository 'https://repositories.intel.com/gpu/ubuntu jammy InRelease' is not signed.
#7 ERROR: process "/bin/sh -c apt-get update &&     apt-get install -y git" did not complete successfully: exit code: 100

This causes this error

5.410 W: GPG error: https://repositories.intel.com/gpu/ubuntu jammy InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 28DA432DAAC8BAEA
5.410 E: The repository 'https://repositories.intel.com/gpu/ubuntu jammy InRelease' is not signed.
------
main-intel.Dockerfile:6
--------------------
   5 |     ARG LLAMA_SYCL_F16=OFF
   6 | >>> RUN apt-get update && \
   7 | >>>     apt-get install -y git
   8 |     
--------------------
ERROR: failed to solve: process "/bin/sh -c apt-get update &&     apt-get install -y git" did not complete successfully: exit code: 100
Error: buildx failed with: ERROR: failed to solve: process "/bin/sh -c apt-get update &&     apt-get install -y git" did not complete successfully: exit code: 100

---

If i understand to access this, you need to have the latest public key which intel says in https://dgpu-docs.intel.com/driver/installation.html#repository-public-key-used-for-package-and-repository-signing to be:

wget -qO - https://repositories.intel.com/gpu/intel-graphics.key |
     sudo gpg --yes --dearmor --output /usr/share/keyrings/intel-graphics.gpg

So the question is if the public key we are using is more current?

[mofosyne]

Hmmm... .devops/main-intel.Dockerfile doesn't actually store any reference to a pubkey, instead it points to a specific docker image from intel/oneapi-basekit. Did intel make a build obsolete?

ARG ONEAPI_VERSION=2024.0.1-devel-ubuntu22.04

FROM intel/oneapi-basekit:$ONEAPI_VERSION as build

ARG LLAMA_SYCL_F16=OFF
RUN apt-get update && \
    apt-get install -y git

WORKDIR /app

COPY . .

RUN if [ "${LLAMA_SYCL_F16}" = "ON" ]; then \
        echo "LLAMA_SYCL_F16 is set" && \
        export OPT_SYCL_F16="-DLLAMA_SYCL_F16=ON"; \
    fi && \
    cmake -B build -DLLAMA_SYCL=ON -DCMAKE_C_COMPILER=icx -DCMAKE_CXX_COMPILER=icpx ${OPT_SYCL_F16} && \
    cmake --build build --config Release --target main

FROM intel/oneapi-basekit:$ONEAPI_VERSION as runtime

COPY --from=build /app/build/bin/main /main

ENV LC_ALL=C.utf8

ENTRYPOINT [ "/main" ]

https://hub.docker.com/r/intel/oneapi-basekit

[ggerganov]

Thanks for having a look - I'm not familiar with the Docker builds, so no idea how to fix this. Let's give it a day or two to see if someone finds a solution before disabling the CI

[mofosyne]

Not a problem. This PR is now ready and CI passing, when ready to disable the CI for this. Hopefully someone figures out what's up with the CI

#7515

[mofosyne]

As @ngxson pointed out. This is an upstream issue on intel side. So decided to immediately merge in the test disable commit.

Also according to Xavier_V in intel community forum, he was also experiencing a similar issue on 05-21-2024, which is a few days ago. So this doesn't appear to be an isolated incident.

Source: https://community.intel.com/t5/Intel-oneAPI-Math-Kernel-Library/APT-Repository-not-working-signatures-invalid/m-p/1599436

---

Keeping this ticket open, so we can revisit reactivating these disabled tests a week later or so.