Build failure due to expired Yarn GPG key in Cloud Workstations predefined base images

[megumish]

Summary

Docker builds using Cloud Workstations predefined base images (predefined/base, predefined/code-oss) fail during apt-get update because the Yarn Debian repository's GPG signing key has expired/rotated and the new key (62D54FD4003F6525) is not present in the base images.

Affected Images

• us-central1-docker.pkg.dev/cloud-workstations-images/predefined/base
• us-central1-docker.pkg.dev/cloud-workstations-images/predefined/code-oss
• us-west1-docker.pkg.dev/cloud-workstations-images/predefined/base
• (Likely all regional variants of predefined base and code-oss images)

Affected Dockerfiles

Dockerfiles under workloads/cloud-workstations/pipelines/workstation-images/ that extend the above base images.

Error Message

W: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 62D54FD4003F6525
E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.

Environment

• Build environment: Both local Docker builds and Cloud Build
• Base images: Google Cloud Workstations predefined images (listed above)

Root Cause

The Yarn project has rotated the GPG key used to sign their Debian repository (yarnpkg/yarn#9218, yarnpkg/yarn#9216). The previous signing subkeys expired on January 23, 2026, and the repository is now signed with a new key (62D54FD4003F6525). Since the Cloud Workstations predefined base images still contain only the old key, any apt-get update that includes the Yarn repository will fail.

This is a known recurring issue with the Yarn v1 (Classic) Debian repository — similar key expirations have occurred in 2019, 2020, and 2023.

Suggested Fix

Option 1: Refresh preinstalled APT keys (immediate workaround)

According to the Cloud Workstations documentation, base images include a script for this exact scenario. Add the following to the affected Dockerfiles before any apt-get update:

RUN /google/scripts/refresh-preinstalled-apt-keys.sh

Option 2: Manually update the Yarn GPG key

RUN curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg \
    | gpg --batch --yes --dearmor \
    -o /usr/share/keyrings/yarn-archive-keyring.gpg

Option 3: Remove the Yarn APT source (if Yarn v1 is not needed)

If the workstation images do not require Yarn v1 installed via APT, the simplest fix is to remove the source entirely:

RUN rm -f /etc/apt/sources.list.d/yarn.list || true

Yarn (if needed) can be installed via corepack enable or npm install -g yarn instead.

Additional Notes

• The upstream root cause should also be addressed in the Cloud Workstations predefined base images themselves. A separate report to Google Cloud support may be warranted to request an image rebuild with the updated key.
• This issue is being tracked across many projects that depend on the Yarn APT repository: GPG key for Yarn has expired, devcontainers/images#1752 Debian repo: New GPG key yarnpkg/yarn#9218

References

• Debian repo: New GPG key yarnpkg/yarn#9218
• Expired gpg signature yarnpkg/yarn#9216
• GPG key for Yarn has expired, devcontainers/images#1752
• Cloud Workstations: Customize container images — Third-party APT keys