Re: Additional debian repo with different pgp key

[Henning Schild <henning.schild@siemens.com>]

On Fri, 15 Feb 2019 16:16:10 +0100
"[ext] Andreas Reichel" <andreas.reichel.ext@siemens.com> wrote:

> Hi,
> 
> I have a problem with using a separate docker repository together with
> its key.
> 
> As far as I understood it, I have to do the following:
> 
> 1st, create a list file which mentions the docker repository:
> 
> So I created a docker-stretch.list, where I have the line
> 
> ----
> deb	http://download.docker.com/linux/debian
> stretch	stable ----
> 
> This file is added via
> 
> ----
> DISTRO_APT_SOURCES_append = " conf/distro/docker-stretch.list"
> ----
> 
> which is working.
> 
> Then I add the `docker-ce` package to `IMAGE_PREINSTALL` which does
> not work because the package is untrusted. Therefore I have to import
> the pgp key, which I should be able to do with
> 
> 2nd: add the key to apt keys:
> 
> ----
> DISTRO_APT_KEYS_append = "
> https://download.docker.com/linux/debian/gpg;sha256sum=1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570"
> ----
> 
> However, then I get the following error:
> 
> ----
> | DEBUG: Executing shell function do_generate_keyring
> | gpg: WARNING: unsafe permissions on homedir '/build/build/downloads'
> | gpg: keybox
> '/build/build/tmp/work/debian-stretch-arm64/isar-bootstrap-target/apt-keyring.gpg'
> created | gpg: can't open
> '/build/build/tmp/work/debian-stretch-arm64/isar-bootstrap-target/linux/debian/gpg':
> No such file or directory | gpg: Total number processed: 0 | WARNING:
> exit code 2 from a shell command.
> 
> ----
> 
> It seems, that the last part of the URL is appended to the working
> directory. But the resulting directory does not exist.  What is the
> intended course of action for this standard scenario to use another
> debian repo for image building?
> 
> Last patch I saw on next was about local keys. But standard should be
> remote keys with URI I think, because every repo that needs one should
> provide one this way... am I wrong?

Yes every repo we get from the internet most likely also has its key
there. With the recent introduction of a file:// based signed repo
there was a patch. What happens if you revert af983a13b, i guess that
may have caused your issue.

I think that is one of our hidden features that never had a test-case,
and silently broke ... We need a testcase for adding an extra repo and
installing stuff from it.

Henning

> vG
> Andreas
>