[Release] Uploading binaries fail with unable to open database file on RPM uploads

[raulcd]

Describe the bug, including details regarding any error messages, version, and platform.

When executing the binary signing and upload of artifacts: dev/release/05-binary-upload.sh 25.0.0 1 it fails with:

Successfully uploaded 15 assets to apache-arrow-25.0.0-rc1
31bd089f3983c13a5e74129a7f5d168be1d9f390aa880888d24fc903f3714933
Pseudo-terminal will not be allocated because stdin is not a terminal.
Warning: Permanently added '[127.0.0.1]:32768' (ED25519) to the list of known hosts.
gpg: keybox '/home/arrow/.gnupg/pubring.kbx' created
gpg: /home/arrow/.gnupg/trustdb.gpg: trustdb created
gpg: key 9E922B2D60E9FD1C: public key "Raul Cumplido Dominguez (CODE SIGNING KEY) <raulcd@apache.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
Warning: Permanently added '[127.0.0.1]:32768' (ED25519) to the list of known hosts.
tar xf binary/tmp/artifacts/almalinux-10-amd64.tar.gz -C /tmp/rc/yum/repositories/incoming
tar xf binary/tmp/artifacts/almalinux-10-arm64.tar.gz -C /tmp/rc/yum/repositories/incoming
mv /tmp/rc/yum/repositories/incoming/almalinux/10/Source/Packages /tmp/rc/yum/repositories/incoming/almalinux/10/Source/SPackages
tar xf binary/tmp/artifacts/almalinux-9-amd64.tar.gz -C /tmp/rc/yum/repositories/incoming
tar xf binary/tmp/artifacts/almalinux-9-arm64.tar.gz -C /tmp/rc/yum/repositories/incoming
mv /tmp/rc/yum/repositories/incoming/almalinux/9/Source/Packages /tmp/rc/yum/repositories/incoming/almalinux/9/Source/SPackages
tar xf binary/tmp/artifacts/almalinux-8-amd64.tar.gz -C /tmp/rc/yum/repositories/incoming
tar xf binary/tmp/artifacts/almalinux-8-arm64.tar.gz -C /tmp/rc/yum/repositories/incoming
mv /tmp/rc/yum/repositories/incoming/almalinux/8/Source/Packages /tmp/rc/yum/repositories/incoming/almalinux/8/Source/SPackages
tar xf binary/tmp/artifacts/amazon-linux-2023-amd64.tar.gz -C /tmp/rc/yum/repositories/incoming
tar xf binary/tmp/artifacts/amazon-linux-2023-arm64.tar.gz -C /tmp/rc/yum/repositories/incoming
mv /tmp/rc/yum/repositories/incoming/amazon-linux/2023/Source/Packages /tmp/rc/yum/repositories/incoming/amazon-linux/2023/Source/SPackages
tar xf binary/tmp/artifacts/centos-9-stream-amd64.tar.gz -C /tmp/rc/yum/repositories/incoming
tar xf binary/tmp/artifacts/centos-9-stream-arm64.tar.gz -C /tmp/rc/yum/repositories/incoming
mv /tmp/rc/yum/repositories/incoming/centos/9-stream/Source/Packages /tmp/rc/yum/repositories/incoming/centos/9-stream/Source/SPackages
Downloading: almalinux - 100.0% [63/63] 00:01:19 00:00:00  2/s
Downloading: amazon-linux - 100.0% [42/42] 00:00:45 00:00:00  3/s
Downloading: centos - 100.0% [63/63] 00:01:26 00:00:00  0/s
error: Unable to open sqlite database /var/lib/rpm/rpmdb.sqlite: unable to open database file
error: cannot open Packages index using sqlite - Operation not permitted (1)
error: cannot open Packages database in /var/lib/rpm
error: can't create transaction lock on /var/lib/rpm/.rpm.lock (No such file or directory)
error: /tmp/apache-arrow-binary20260703-49-htq2me.asc: key 1 import failed.
rake aborted!
Command failed with status (1): [rpm --import /tmp/apache-arrow-binary20260703-49-htq2me.asc]
/host/binary-task.rb:1933:in `rpm_sign'
/host/binary-task.rb:2082:in `block (3 levels) in define_yum_rc_tasks'
/usr/share/rubygems-integration/all/gems/rake-13.2.1/exe/rake:27:in `<top (required)>'
Tasks: TOP => yum:rc => yum:rc:sign
(See full trace by running task with --trace)

This is potentially related to the update to the underlying image that uploads binaries:

• GH-50200: [Packaging][Debian] Drop support for bookworm #50201

Component(s)

Release

[raulcd]

With the following diff locally:

$ git diff
diff --git a/dev/release/binary/Dockerfile b/dev/release/binary/Dockerfile
index be72ecf5b6..65d05acaa4 100644
--- a/dev/release/binary/Dockerfile
+++ b/dev/release/binary/Dockerfile
@@ -40,6 +40,8 @@ RUN \
 
 RUN gem install apt-dists-merge -v ">= 1.0.2"
 
+RUN chmod 1777 /var/lib/rpm
+
 RUN locale-gen en_US.UTF-8
 
 RUN mkdir -p /run/sshd

I was able to sign and upload, even though I got a lot of spurious warnings:

Signing: centos-9-stream Source -   0.0% [0/1] 00:00:00 00:00:00  0/sgpg: problem with fast path key listing: Forbidden - ignored
gpg: problem with fast path key listing: Forbidden - ignored
gpg: problem with fast path key listing: Forbidden - ignored
Signing: centos-9-stream Source -  83.3% [5/6] 00:00:01 00:00:00  3/sgpg: problem with fast path key listing: Forbidden - ignored
Signing: centos-9-stream Source - 100.0% [6/6] 00:00:01 00:00:00  2/s
Signing: centos-9-stream aarch64 -  66.1% [39/59] 00:00:02 00:00:01 11/sgpg: problem with fast path key listing: Forbidden - ignored
gpg: problem with fast path key listing: Forbidden - ignored
Signing: centos-9-stream aarch64 -  96.6% [57/59] 00:00:03 00:00:00 16/sgpg: problem with fast path key listing: Forbidden - ignored
gpg: problem with fast path key listing: Forbidden - ignored
Signing: centos-9-stream aarch64 - 100.0% [59/59] 00:00:04 00:00:00  2/s
Signing: centos-9-stream x86_64 -  93.2% [55/59] 00:00:03 00:00:00 22/sgpg: problem with fast path key listing: Forbidden - ignored
gpg: problem with fast path key listing: Forbidden - ignored
gpg: problem with fast path key listing: Forbidden - ignored
Signing: centos-9-stream x86_64 -  98.3% [58/59] 00:00:04 00:00:00  2/sgpg: problem with fast path key listing: Forbidden - ignored
Signing: centos-9-stream x86_64 - 100.0% [59/59] 00:00:04 00:00:00  2/s
Uploading: almalinux-rc -  19.8% [223/1126] 00:01:04 00:08:15  1/s

[raulcd]

@kou, I've validated binaries have been signed and uploaded to artifactory. Should I create a PR with the above change?

Uploading: ubuntu-rc - 100.0% [1396/1396] 00:07:23 00:00:00  0/s
Success! The release candidate binaries are available here:
  https://packages.apache.org/artifactory/arrow/almalinux-rc/
  https://packages.apache.org/artifactory/arrow/amazon-linux-rc/
  https://packages.apache.org/artifactory/arrow/centos-rc/
  https://packages.apache.org/artifactory/arrow/debian-rc/
  https://packages.apache.org/artifactory/arrow/ubuntu-rc/