Bug 14574

`location update` fails without a useful error if the public signing key (`/var/lib/location/signing-key.pem` by default) does not exist, and it leaves the database that it has downloaded behind. The database is not updated, so that every host where the key is missing keeps running on an old database without anybody noticing.

Version: libloc 0.9.19 (python3-location / location 0.9.19-1.build-45.1)

What happens:

  # location update
  Downloaded new database from Wed, 21 Oct 2026 04:40:13 GMT
  Could not download a new database

The download was successful. The error is raised afterwards:

* Downloader._check_database() (src/python/location/downloader.py) logs "Downloaded new database ..." and then runs `open(public_key, "r")` to verify the database. If the key does not exist, this raises FileNotFoundError.
* Nothing in Downloader.download() catches it, so it leaves the function without reaching the `os.unlink(t.name)` at the end of it. The temporary file, which has been created with NamedTemporaryFile(dir=tmpdir, delete=False) next to the database, stays in /var/lib/location. We found a 50 MB tmp... file there that has been left behind by a failed run.
* handle_update() in src/scripts/location.in catches FileNotFoundError around d.download() to detect that no mirror had a file, and reports "Could not download a new database". That is the wrong message here, since the key is the file that is missing, and nothing says so.

Expected:

* A missing or unreadable public key is reported as such, with its path, ideally before anything is being downloaded.
* The downloaded temporary file is removed in all error cases (try/finally around the whole download), not only if no mirror delivered a database.
* The update timer (location-update.service) should fail visibly, and should not just log one line, if the database cannot be updated for days. It exits with status 0 now, as we saw on a host after 18:17:01 UTC.

How we ran into this:

On a DNS server that serves from the database with PowerDNS, /var/lib/location/database.db and signing-key.pem were both missing after the upgrade of the location package to 0.9.19-1.build-45.1 (see #14573). `location update` could not bring the database back, as described above. The server kept answering from the database that it had loaded before. libloc 0.9.19 keeps using the loaded database if the file disappears, but the next restart of the service would have failed.

Workaround: restore signing-key.pem (apt-get install --reinstall location, or copy the public key from another host), then run `location update`.