CircleCI's ubuntu-1604 docker image seems to be having GPG key problems

We’re using CircleCI’s ubuntu-1604:201903-01 image on most of our projects, and noticed yesterday we were getting GPG issues when doing an apt update against the following repos:

  • http://dl.google.com/linux/chrome/deb stable InRelease
  • https://cli-assets.heroku.com/apt ./ InRelease

I have reproduced the error in a public repo here:

This problem is blocking a significant portion of our repos, and I’m surprised no one else has mentioned this issue anywhere.

Additionally, when I try to update to the current release from this doc https://circleci.com/docs/2.0/configuration-reference/#available-machine-images I get another issue, this time around

The repository 'https://packagecloud.io/********/trusty/ubuntu xenial Release' does not have a Release file.

try adding Google keys before using the image:
wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add -

I mean, obviously, but we shouldn’t have to do that on Circle’s own VM images.

As a work around, Circle support suggested we use apt-get instead of apt. That turns the error into a warning and the builds are able to proceed.