Unsupported GPG key format error when building OSI images with apt

[rezib]

When building an OSI image with apt, the following error is reported:

$ fatbuildrctl build -a node-debian11 -s firehpc/envs --watch
Submitted node-debian11 build task ef9cf866-b259-4246-a62b-52c6d7ee8e95
 ⚬ INFO: Running build ef9cf866-b259-4246-a62b-52c6d7ee8e95
 ⚬ INFO: Extracting tarball /run/fatbuildr/fatbuildr-artifact-bidcu0it.tar.xz in destination /var/lib/fatbuildr/workspaces/default/ef9cf866-b259-4246-a62b-52c6d7ee8e95
 ⚬ INFO: Building the OS image based node-debian11
‣ Changing ownership of output file /var/lib/fatbuildr/workspaces/default/ef9cf866-b259-4246-a62b-52c6d7ee8e95/debian~bullseye to user root…
‣ Changed ownership of /var/lib/fatbuildr/workspaces/default/ef9cf866-b259-4246-a62b-52c6d7ee8e95/debian~bullseye
‣ Removing output files…
‣ Detaching namespace
‣ Setting up temporary workspace.
‣ Temporary workspace set up in /var/tmp/mkosi-t3aw8lt7
‣ Running second (final) stage…
‣  Mounting image…
‣   Setting up basic OS tree…
‣   Mounting Package Cache
‣    Installing Debian…
I: Retrieving InRelease 
I: Checking Release signature
I: Valid Release signature (key id A4285295FC7B1A81600062A9605C66F00D6C9793)
I: Retrieving Packages 
I: Validating Packages 
…
I: Configuring mount...
I: Configuring libc-bin...
I: Unpacking the base system...
I: Unpacking ca-certificates...
I: Unpacking openssl...
I: Configuring the base system...
I: Configuring openssl...
I: Configuring ca-certificates...
I: Configuring ca-certificates...
I: Base system installed successfully.
…
‣     Mounting API VFS…
Hit:1 http://deb.debian.org/debian bullseye InRelease
Get:2 http://deb.debian.org/debian bullseye-updates InRelease [44.1 kB]        
Err:1 http://deb.debian.org/debian bullseye InRelease                          
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 648ACFD622F3D138 NO_PUBKEY 0E98404D386FA1D9 NO_PUBKEY 605C66F00D6C9793
Err:2 http://deb.debian.org/debian bullseye-updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 648ACFD622F3D138 NO_PUBKEY 0E98404D386FA1D9
Get:3 https://security.debian.org/debian-security bullseye-security InRelease [48.4 kB]
Err:3 https://security.debian.org/debian-security bullseye-security InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 112695A0E562B32A NO_PUBKEY 54404762BBB6E853
Reading package lists... Done
W: Unable to read /etc/apt/apt.conf.d/ - DirectoryExists (2: No such file or directory)
W: Download is performed unsandboxed as root as file '/var/tmp/mkosi-t3aw8lt7/root/var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye_InRelease' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)
W: http://deb.debian.org/debian/dists/bullseye/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bookworm-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bookworm-security-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bookworm-stable.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg are ignored as the file has an unsupported filetype.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.debian.org/debian bullseye InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 648ACFD622F3D138 NO_PUBKEY 0E98404D386FA1D9 NO_PUBKEY 605C66F00D6C9793
W: http://deb.debian.org/debian/dists/bullseye-updates/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bookworm-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye-updates/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bookworm-security-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye-updates/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bookworm-stable.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye-updates/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye-updates/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye-updates/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye-updates/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye-updates/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg are ignored as the file has an unsupported filetype.
W: http://deb.debian.org/debian/dists/bullseye-updates/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg are ignored as the file has an unsupported filetype.
W: GPG error: http://deb.debian.org/debian bullseye-updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 648ACFD622F3D138 NO_PUBKEY 0E98404D386FA1D9
E: The repository 'http://deb.debian.org/debian bullseye-updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: https://security.debian.org/debian-security/dists/bullseye-security/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bookworm-automatic.gpg are ignored as the file has an unsupported filetype.
W: https://security.debian.org/debian-security/dists/bullseye-security/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bookworm-security-automatic.gpg are ignored as the file has an unsupported filetype.
W: https://security.debian.org/debian-security/dists/bullseye-security/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bookworm-stable.gpg are ignored as the file has an unsupported filetype.
W: https://security.debian.org/debian-security/dists/bullseye-security/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg are ignored as the file has an unsupported filetype.
W: https://security.debian.org/debian-security/dists/bullseye-security/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg are ignored as the file has an unsupported filetype.
W: https://security.debian.org/debian-security/dists/bullseye-security/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg are ignored as the file has an unsupported filetype.
W: https://security.debian.org/debian-security/dists/bullseye-security/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg are ignored as the file has an unsupported filetype.
W: https://security.debian.org/debian-security/dists/bullseye-security/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg are ignored as the file has an unsupported filetype.
W: https://security.debian.org/debian-security/dists/bullseye-security/InRelease: The key(s) in the keyring /var/tmp/mkosi-t3aw8lt7/root/etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg are ignored as the file has an unsupported filetype.
W: GPG error: https://security.debian.org/debian-security bullseye-security InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 112695A0E562B32A NO_PUBKEY 54404762BBB6E853
E: The repository 'https://security.debian.org/debian-security bullseye-security InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/usr/lib/python3.11/site-packages/mkosi/__main__.py", line 45, in <module>
    main()
  File "/usr/lib64/python3.11/contextlib.py", line 81, in inner
    return func(*args, **kwds)
           ^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mkosi/__main__.py", line 41, in main
    run_verb(a)
  File "/usr/lib/python3.11/site-packages/mkosi/__init__.py", line 8260, in run_verb
    manifest = build_stuff(config)
               ^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mkosi/__init__.py", line 7565, in build_stuff
    image = build_image(state, manifest=manifest)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mkosi/__init__.py", line 7276, in build_image
    install_distribution(state, cached_tree)
  File "/usr/lib/python3.11/site-packages/mkosi/__init__.py", line 2985, in install_distribution
    install(state)
  File "/usr/lib64/python3.11/contextlib.py", line 81, in inner
    return func(*args, **kwds)
           ^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mkosi/__init__.py", line 2667, in install_debian
    install_debian_or_ubuntu(state)
  File "/usr/lib/python3.11/site-packages/mkosi/__init__.py", line 2616, in install_debian_or_ubuntu
    invoke_apt(state, "get", "update", ["--assume-yes"])
  File "/usr/lib/python3.11/site-packages/mkosi/__init__.py", line 2471, in invoke_apt
    return run(cmdline, env=env, text=True, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/mkosi/backend.py", line 860, in run
    return subprocess.run(cmdline, check=check, stdout=stdout, stderr=stderr, env={**os.environ, **env}, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/subprocess.py", line 571, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['/usr/bin/apt-get', '-o', 'Dir=/var/tmp/mkosi-t3aw8lt7/root', '-o', 'DPkg::Chroot-Directory=/var/tmp/mkosi-t3aw8lt7/root', '-o', 'APT::Architecture=amd64', '-o', 'dpkg::install::recursive::minimum=1000', 'update', '--assume-yes']' returned non-zero exit status 100.
 ⚬ ERROR: error while running task ef9cf866-b259-4246-a62b-52c6d7ee8e95: Command /usr/libexec/fatbuildr/u-nspawn --directory /var/lib/fatbuildr/images/default/osi.img --bind /usr/share/fatbuildr/images/common --quiet --register=no --keep-unit --bind /var/lib/fatbuildr/workspaces/default/ef9cf866-b259-4246-a62b-52c6d7ee8e95 --bind /var/cache/fatbuildr/default/node-debian11 /usr/bin/mkosi --default /var/lib/fatbuildr/workspaces/default/ef9cf866-b259-4246-a62b-52c6d7ee8e95/osi/node-debian11.mkosi --output-dir /var/lib/fatbuildr/workspaces/default/ef9cf866-b259-4246-a62b-52c6d7ee8e95 --image-id node-debian11 --image-version 1 --checksum failed with exit code 1
 ⚬ INFO: Task failed

The apt-get update command reports that the GPG keys installed by debootstrap have an unsupported filetype.