E: Failed to fetch https://us-west1-apt.pkg.dev/projects/my-project/dists/quickstart-apt-repo/main/binary-amd64/Packages 403 Forbidden [IP: 74.125.20.82 443]
E: Some index files failed to download. They have been ignored, or old ones used instead.
errors:
- error:
code: 16
message: The request does not have valid authentication credentials.
gcsSource:
uris:
- gs://my-bucket/debs/python/python3-gflags_1.5.1-5_all.deb
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eThis guide covers troubleshooting steps for managing OS packages in Artifact Registry, with a focus on issues related to authentication, permissions, credential helpers, authentication plugins, missing uploaded artifacts, and authentication errors for uploaded packages.\u003c/p\u003e\n"],["\u003cp\u003eErrors with \u003ccode\u003e401\u003c/code\u003e or \u003ccode\u003e403\u003c/code\u003e codes indicate authentication or permission problems, which can stem from issues with the VM's service account, insufficient permissions, incorrect access scopes, or improperly configured Apt/Yum settings.\u003c/p\u003e\n"],["\u003cp\u003eIf the VM cannot locate the Apt credential helper, the \u003ccode\u003eapt-transport-artifact-registry\u003c/code\u003e package might not be installed, requiring the installation of the Apt repository signing keys and re-running the VM preparation steps.\u003c/p\u003e\n"],["\u003cp\u003eIssues with Yum or DNF authentication plugins, indicated by the "Plugin 'artifact-registry' can't be imported" error, can be resolved by running the plugin directly to check for dependency, Python, or other underlying issues.\u003c/p\u003e\n"],["\u003cp\u003eIf a recently uploaded package is not found by the Apt or Yum client, it may be due to the package index not being updated, and you can verify the successful upload by using the Google Cloud CLI command \u003ccode\u003egcloud artifacts files list\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Troubleshoot OS package issues\n\nLearn about troubleshooting steps that you might find helpful if you run into\nproblems managing OS packages in Artifact Registry.\nFor information about resolving issues with Artifact Registry remote repositories for OS packages, see [Troubleshoot remote repositories](/artifact-registry/docs/troubleshoot-remote#os-pkgs).\n\nAuthentication and permissions issues\n-------------------------------------\n\nYou cannot connect to a repository for actions such as installing a package.\nThe output from the package manager includes a `401` or `403` error, which\nindicates issues with authentication or permissions.\n\nExample Apt errors: \n\n```\nErr:1 ar+https://us-west1-apt.pkg.dev/projects/my-project my-package Release\n Error downloading: code 401\n``` \n\n```\nE: Failed to fetch https://us-west1-apt.pkg.dev/projects/my-project/dists/quickstart-apt-repo/main/binary-amd64/Packages 403 Forbidden [IP: 74.125.20.82 443]\nE: Some index files failed to download. They have been ignored, or old ones used instead.\n```\n\nExample Yum error: \n\n```\n/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden\n```\n\nThere are a number of possible causes for these errors. Ensure that your VM meets\nthe following requirements:\n\n1. Verify that the VM has an associated service account.\n\n ### Compute Engine VM\n\n 1. Go to the [VM instances](https://console.cloud.google.com/compute/instances) page.\n 2. In the list of VMs, click the name of your VM.\n\n On the **Details** tab, the service account and access scopes appear under\n **API and identity management**.\n\n By default, Compute Engine VMs use the Compute Engine\n [default service account](/compute/docs/access/service-accounts#default_service_account) and have a limited set of\n [access scopes](/compute/docs/access/service-accounts#default_scopes). The default service account email address\n is in the format \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`-compute@developer.gserviceaccount.com`.\n\n To change the service account or attach a service account to a VM, see the\n [Changing the service account and access scopes for an instance](/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes).\n\n ### Other VM\n\n For other VMs, you must have a service account to act on behalf of the VM.\n 1. If you don't have a service account, then [create a service account](/compute/docs/access/create-enable-service-accounts-for-instances#createanewserviceaccount).\n\n 2. Grant the Artifact Registry Reader (`roles.artifactregistry.reader`)\n role while you're creating the service account so that you don't need\n to configure permissions in a separate step.\n\n2. Ensure that the VM service account has read permissions to the repository as\n well as the `cloud-platform` API access scope.\n\n ### Compute Engine VM\n\n Artifact Registry automatically retrieves VM service account credentials. If the\n repository is in a different project than the VM, then you must\n [grant](/artifact-registry/docs/access-control#grant) the Artifact Registry Reader role to the VM service\n account. You must also ensure that the VM has the `cloud-platform` access\n scope.\n\n To set the `cloud-platform` access scope,\n 1. Stop the VM instance, replacing \u003cvar translate=\"no\"\u003eINSTANCE\u003c/var\u003e with the\n VM instance name.\n\n gcloud compute instances stop \u003cvar translate=\"no\"\u003eINSTANCE\u003c/var\u003e\n\n 2. Set the access scope:\n\n gcloud compute instances set-service-account \u003cvar translate=\"no\"\u003eINSTANCE\u003c/var\u003e \\\n --scopes=cloud-platform\n\n 3. Restart the VM instance.\n\n gcloud compute instances start \u003cvar translate=\"no\"\u003eINSTANCE\u003c/var\u003e\n\n ### Other VM\n\n [Grant](/artifact-registry/docs/access-control#grant) the Artifact Registry Reader role to the VM service\n account. By default user-managed service accounts have the `cloud-platform`\n access scope.\n3. Verify that you have followed the steps to prepare the VM to access the\n repository. See the [Apt](/artifact-registry/docs/os-packages/debian/configure#prepare-apt) or [Yum](/artifact-registry/docs/os-packages/rpm/configure#prepare-yum) preparation\n instructions.\n\n4. Verify that you have correctly configured [Apt](/artifact-registry/docs/os-packages/debian/configure#config-apt) or\n [Yum](/artifact-registry/docs/os-packages/rpm/configure#config-yum) to access the repository.\n\n If you are connecting to an Apt repository from a Compute Engine VM, make\n sure that the repository URL includes the `ar+` prefix.\n\nCredential helper issues\n------------------------\n\nThe following error message appears when the VM can't locate the Apt credential\nhelper: \n\n```\nE: Unable to locate package apt-transport-artifact-registry\n```\n\nThe error occurs when you try to install the `apt-transport-artifact-registry`\npackage on a VM that was created from an image that doesn't include the Apt\nrepository signing key.\n\nTo resolve this issue, do the following:\n\n1. Install the signing key on the VM:\n\n ### Debian VM\n\n Install the Apt repository signing keys, using the following command: \n\n curl https://\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e-apt.pkg.dev/doc/repo-signing-key.gpg | sudo apt-key add -\n\n\n Replace \u003cvar translate=\"no\"\u003e\u003ccode translate=\"no\" dir=\"ltr\"\u003eLOCATION\u003c/code\u003e\u003c/var\u003e with the regional or multi-regional\n [location](/artifact-registry/docs/repo-locations) of the repository.\n\n ### Ubuntu VM\n\n Install the Apt repository signing keys, using the following command: \n\n curl https://\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e-apt.pkg.dev/doc/repo-signing-key.gpg | sudo apt-key add - && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -\n\n\n Replace \u003cvar translate=\"no\"\u003e\u003ccode translate=\"no\" dir=\"ltr\"\u003eLOCATION\u003c/code\u003e\u003c/var\u003e with the regional or multi-regional\n [location](/artifact-registry/docs/repo-locations) of the repository.\n\n2. Re-try the\n [VM preparation steps](/artifact-registry/docs/os-packages/debian/configure#compute-engine-vm).\n\nAuthentication plugin issues\n----------------------------\n\nThe following error message appears when there is an issue with the Yum or DNF\nauthentication plugin: \n\n```\nPlugin \"artifact-registry\" can't be imported\n```\n\nThis error can occur for several reasons. To resolve the error, try running the\nplugin directly to confirm dependencies, check for Python issues, or reveal\nother possible underlying problems.\n\nTo run the plugin directly, use one the of following commands:\n\n- For the Yum plugin:\n\n python /usr/lib/yum-plugins/artifact-registry.py\n\n- For the DNF plugin:\n\n python3 /usr/lib/python\u003cvar translate=\"no\"\u003eVERSION-NUMBER\u003c/var\u003e/site-packages/dnf-plugins/artifact-registry.py\n\n Replace \u003cvar translate=\"no\"\u003eVERSION-NUMBER\u003c/var\u003e with the default Python version for\n the Linux distribution. For example, Enterprise Linux 8 includes Python 3.6.\n\n You can list the files in the installed plugin package to verify name of the\n Python library directory. \n\n rpm -ql dnf-plugin-artifact-registry|grep artifact-registry.py\n\nMissing recently uploaded artifacts\n-----------------------------------\n\nIf your Apt or Yum client does not find a package that was recently uploaded or\nimported to your repository, it might be because the process to regenerate the\nApt or Yum package index is not yet complete.\n\nFor small repositories, regenerating the Apt or Yum index file can take several\nseconds. For larger repositories, reindexing might take several minutes or\nlonger.\n\nTo verify that a package was successfully added to the repository, use\nthe Google Cloud CLI to list files in the package. Run the command: \n\n gcloud artifacts files list \\\n --package=\u003cvar translate=\"no\"\u003ePACKAGE\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT-ID\u003c/var\u003e \\\n --repository=\u003cvar translate=\"no\"\u003eREPOSITORY\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\n\nFor example, you can check that the `python-gflags` package named\n`python3-gflags_1.5.1-5_all.deb` was uploaded successfully to the repository\n`us-west1-apt.pkg.dev\\apt-project\\apt-repo` with the command: \n\n gcloud artifacts files list \\\n --package=python-gflags \\\n --project=apt-project \\\n --repository=apt-repo \\\n --location=us-west1\n\nIf the package was uploaded successfully, the file appears in the output\nwith a unique identifier in the filename, similar to the following example: \n\n FILE CREATE_TIME UPDATE_TIME SIZE (MB) OWNER\n pool/python3-gflags_1.5.1-5_all_2414c7af6a64c99a5f488aad366d637a.deb 2023-01-12T20:39:53 2023-01-12T20:39:53 0.035 projects/apt-project/locations/us-west1/repositories/apt-repo/packages/python3-gflags/versions/1.5.1-5\n\nAuthentication error for some uploaded or imported packages\n-----------------------------------------------------------\n\nIf the time to import or upload files exceeds the authentication token expiry\nperiod, uploads beyond the expiry period will fail. Tokens expire 60 minutes\nafter you obtain them. An error similar to the following example appears in\noutput from the import command if the token has expired. \n\n errors:\n - error:\n code: 16\n message: The request does not have valid authentication credentials.\n gcsSource:\n uris:\n - gs://my-bucket/debs/python/python3-gflags_1.5.1-5_all.deb\n\nTo address this issue:\n\n1. Try uploading or importing the specific package only to verify that you can add the package individually instead of in a batch import.\n2. If multiple packages failed, import or upload in smaller batches so that the operation does not exceed the token expiry period."]]
