[PATCH 2/3] base-apt: Introduce BASE_REPO_KEY to sign local repo

["Maxim Yu. Osipov" <mosipov@ilbers.de>]

This patch adds the ability to sign local cached repository
by setting BASE_REPO_KEY in local.conf to SRC_URI of your
public key.

For locally stored key the value has to be specified in the
format 'file://<absolute_path_to_your_pub_key_file>'.

Prerequsite: we suppose that gpg is installed on your host system
and a default key pair is generated.

Signed-off-by: Maxim Yu. Osipov <mosipov@ilbers.de>
---
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 15 +++++++++++++--
 meta/recipes-devtools/base-apt/base-apt.bb          |  6 ++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index fbe312d..234d339 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -35,14 +35,23 @@ inherit base-apt-helper
 python () {
     from urllib.parse import urlparse
     distro_apt_keys = d.getVar("DISTRO_APT_KEYS", False)
+    wd = d.getVar("WORKDIR", True)
     if distro_apt_keys:
         d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
-        wd = d.getVar("WORKDIR", True)
         for key in distro_apt_keys.split():
             url = urlparse(key)
             filename = ''.join([wd, url.path])
             d.appendVar("SRC_URI", " %s" % key)
             d.appendVar("APTKEYFILES", " %s" % filename)
+    if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')):
+        own_pub_key = d.getVar("BASE_REPO_KEY", False)
+        if own_pub_key:
+            d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
+            for key in own_pub_key.split():
+                url = urlparse(key)
+                filename = ''.join([wd, url.path])
+                d.appendVar("SRC_URI", " %s" % key)
+                d.appendVar("APTKEYFILES", " %s" % filename)
 }
 
 def aggregate_files(d, file_list, file_out):
@@ -200,7 +209,9 @@ isar_bootstrap() {
     done
     debootstrap_args="--verbose --variant=minbase --include='${DISTRO_BOOTSTRAP_BASE_PACKAGES}'"
     if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
-        debootstrap_args="$debootstrap_args --no-check-gpg"
+        if [ -z "${BASE_REPO_KEY}" ] ; then
+            debootstrap_args="$debootstrap_args --no-check-gpg"
+        fi
     fi
     E="${@bb.utils.export_proxies(d)}"
     sudo -E flock "${ISAR_BOOTSTRAP_LOCK}" -c "\
diff --git a/meta/recipes-devtools/base-apt/base-apt.bb b/meta/recipes-devtools/base-apt/base-apt.bb
index d744ed6..1c0b4c6 100644
--- a/meta/recipes-devtools/base-apt/base-apt.bb
+++ b/meta/recipes-devtools/base-apt/base-apt.bb
@@ -5,6 +5,8 @@ SRC_URI = "file://distributions.in"
 
 inherit base-apt-helper
 
+BASE_REPO_KEY ?= ""
+
 CACHE_CONF_DIR = "${REPO_BASE_DIR}/${BASE_DISTRO}/conf"
 do_cache_config[dirs] = "${CACHE_CONF_DIR}"
 do_cache_config[stamp-extra-info] = "${DISTRO}"
@@ -16,6 +18,10 @@ do_cache_config() {
     if [ ! -e "${CACHE_CONF_DIR}/distributions" ]; then
         sed -e "s#{CODENAME}#"${BASE_DISTRO_CODENAME}"#g" \
             ${WORKDIR}/distributions.in > ${CACHE_CONF_DIR}/distributions
+        if [ "${BASE_REPO_KEY}" ] ; then
+            # To generate Release.gpg
+            echo "SignWith: yes" >> ${CACHE_CONF_DIR}/distributions
+        fi
     fi
 
     path_cache="${REPO_BASE_DIR}/${BASE_DISTRO}"
-- 
2.11.0