[CI] Rotate package repository keys (#7943) (#7978)

Co-authored-by: Philip Hyunsu Cho <chohyu01@cs.washington.edu>

tests/ci_build/Dockerfile.clang_tidy

@@ -7,6 +7,7 @@ ENV DEBIAN_FRONTEND noninteractive
 
 # Install all basic requirements
 RUN \
+    apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu1804/x86_64/3bf863cc.pub && \
     apt-get update && \
     apt-get install -y tar unzip wget git build-essential python3 python3-pip software-properties-common \
                        apt-transport-https ca-certificates gnupg-agent && \

tests/ci_build/Dockerfile.gpu

@@ -8,6 +8,7 @@ SHELL ["/bin/bash", "-c"]   # Use Bash as shell
 
 # Install all basic requirements
 RUN \
+    apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu1804/x86_64/3bf863cc.pub && \
     apt-get update && \
     apt-get install -y wget unzip bzip2 libgomp1 build-essential && \
     # Python

tests/ci_build/Dockerfile.gpu_build

@@ -8,6 +8,7 @@ SHELL ["/bin/bash", "-c"]   # Use Bash as shell
 
 # Install all basic requirements
 RUN \
+    apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu1604/x86_64/3bf863cc.pub && \
     apt-get update && \
     apt-get install -y software-properties-common && \
     add-apt-repository ppa:ubuntu-toolchain-r/test && \

tests/ci_build/Dockerfile.gpu_build_centos7

@@ -4,6 +4,9 @@ ARG CUDA_VERSION_ARG
 
 # Install all basic requirements
 RUN \
+    rpm --erase gpg-pubkey-7fa2af80* && \
+    curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/rhel7/x86_64/D42D0685.pub | sed '/^Version/d' \
+        > /etc/pki/rpm-gpg/RPM-GPG-KEY-NVIDIA && \
     yum install -y epel-release centos-release-scl && \
     yum-config-manager --enable centos-sclo-rh-testing && \
     yum -y update && \

tests/ci_build/Dockerfile.gpu_build_r_centos7

@@ -4,6 +4,9 @@ ARG CUDA_VERSION_ARG
 
 # Install all basic requirements
 RUN \
+    rpm --erase gpg-pubkey-7fa2af80* && \
+    curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/rhel7/x86_64/D42D0685.pub | sed '/^Version/d' \
+        > /etc/pki/rpm-gpg/RPM-GPG-KEY-NVIDIA && \
     yum install -y epel-release centos-release-scl && \
     yum-config-manager --enable centos-sclo-rh-testing && \
     yum -y update && \

tests/ci_build/Dockerfile.gpu_jvm

@@ -9,6 +9,7 @@ ENV DEBIAN_FRONTEND noninteractive
 
 # Install all basic requirements
 RUN \
+    apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu1604/x86_64/3bf863cc.pub && \
     apt-get update && \
     apt-get install -y software-properties-common && \
     add-apt-repository ppa:openjdk-r/ppa && \

tests/ci_build/Dockerfile.jvm_gpu_build

@@ -4,6 +4,9 @@ ARG CUDA_VERSION_ARG
 
 # Install all basic requirements
 RUN \
+    rpm --erase gpg-pubkey-7fa2af80* && \
+    curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/rhel7/x86_64/D42D0685.pub | sed '/^Version/d' \
+        > /etc/pki/rpm-gpg/RPM-GPG-KEY-NVIDIA && \
     yum install -y epel-release centos-release-scl && \
     yum-config-manager --enable centos-sclo-rh-testing && \
     yum -y update && \

tests/ci_build/Dockerfile.rmm

@@ -8,6 +8,7 @@ SHELL ["/bin/bash", "-c"]   # Use Bash as shell
 
 # Install all basic requirements
 RUN \
+    apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu1804/x86_64/3bf863cc.pub && \
     apt-get update && \
     apt-get install -y wget unzip bzip2 libgomp1 build-essential ninja-build git && \
     # Python

tests/ci_build/conda_env/cpu_test.yml

@@ -35,6 +35,7 @@ dependencies:
 - py-ubjson
 - cffi
 - pyarrow
+- protobuf<=3.20
 - pip:
   - shap
   - ipython                     # required by shap at import time.