Upgrade a Publisher for China (PRC)

The Publisher upgrade for China process has been updated.

Affected versions: R133, R134, R135, R136
Platforms: Ubuntu 22.04 (Jammy) — China deployment (.prc_dp marker present)
EHF scope: This script unblocks the upgrade path to the current latest release.
Permanent fix: R137 — once on R137 the built-in wizard handles upgrades without this script.

Background

Publishers deployed in China on Docker Engine 29.0+ (fresh installations) may fail to upgrade with the following error:

Upgrade Publisher image has failed: crypto/rsa: verification error

This is caused by a behavioral change in Docker 29.0+: the containerd image store (the new default on fresh installations) changed what docker inspect returns for the image identifier, which breaks the post-download signature verification step.

The script below resolves this for all affected versions and provides a one-command upgrade path.

Prerequisites

• A Publisher VM is running R133, R134, R135, or R136
• The VM has outbound HTTPS access to:
  • npa-ova.oss-cn-shenzhen.aliyuncs.com (script + signatures).
  • ns-1-registry.cn-shenzhen.cr.aliyuncs.com (publisher image).
• python3 and curl are available on the VM (included in standard Ubuntu images).
• Commands must be run as root or with sudo.

Step 1: Download the upgrade script

curl https://npa-ova.oss-cn-shenzhen.aliyuncs.com/publisher.netskope.com/latest/generic/setup_and_upgrade_china_publisher.py \
-o setup_and_upgrade_china_publisher.py

Step 2: Verify script integrity (SHA-256)

sha256sum setup_and_upgrade_china_publisher.py

Confirm the output matches the following checksum exactly before proceeding:

1aac37c33b9c49389731d38ddce8b101c4c403614946b0fd66a2a011ea063d65  setup_and_upgrade_china_publisher.py

Step 3: Run the script

python3 setup_and_upgrade_china_publisher.py --upgrade latest

The script will:

1. Create the required China deployment marker and public key under resources/.
2. Redirect the Docker CE repository to the Aliyun mirror.
3. Verify the Publisher image signature before downloading (pre-pull).
4. Download the Publisher image from the China registry.
5. Verify the image signature after downloading (post-pull, with v1/v2 fallback).
6. Retag and start the updated Publisher.

Expected Output

A successful run ends with:

[INFO] - Pre-pull signature verification (v1 — config digest)
[INFO] - Publisher signature v1 retrieved successfully
[INFO] - Signature v1 verification: OK
[INFO] - Pulling publisher docker image
[INFO] - Post-pull verified with v2 signature (containerd: docker inspect Id == manifest digest)
[INFO] - Initiating publisher upgrade
Netskope Private Access Publisher upgrade is complete.
Version: 135.0.0.XXXXX

Troubleshooting

Symptom	Action
Could not retrieve publisher image signature	Check outbound HTTPS to npa-ova.oss-cn-shenzhen.aliyuncs.com
Post-pull image verification failed with both v1 and v2	Ensure the script version matches the checksum in Step 2; contact Support.
docker manifest inspect timeout	Check outbound access to ns-1-registry.cn-shenzhen.cr.aliyuncs.com
Script exits with no upgrade.	Publisher may already be on the latest version; check the Version: in the output

After the Upgrade

After the Publisher is upgraded successfully to the current latest release, this script has done its job, and it has unblocked the upgrade path.

The script does not automatically upgrade to R137. When R137 becomes available:

• The R137 wizard includes the permanent fix natively.
• Use the standard publisher wizard upgrade flow (no script required) to move from the current release to R137.

If you need to re-run the script against a specific tag before R137 is available:

python3 setup_and_upgrade_china_publisher.py --upgrade <tag>