Re: [PATCH 0/1] Fix remote key fetching apt keyring

[Andreas Reichel <andreas.reichel.ext@siemens.com>]

On Wed, Feb 20, 2019 at 12:27:15PM +0100, Jan Kiszka wrote:
> On 20.02.19 12:21, [ext] Andreas J. Reichel wrote:
> > From: Andreas Reichel <andreas.reichel.ext@siemens.com>
> > 
> > Since my last mail was not answered, but this is an important topic,
> > here is a patch that shows what the problem is.
> > 
> > If we fetch the user apt key from remote, we need the basename,
> > if we fetch it locally we need the absolute path...
> > 
> > While this might not be the best way to fix this, it works as good
> > as the rest of this code...
> > 
> > At least it fixes Isar again up to adding the key to the keyring.
> > 
> > But this still does not fix the next problem with the docker-ce key:
> > 
> > | I: Running command: debootstrap --arch arm64 --foreign --verbose --variant=minbase --include=locales --components=main,contrib,non-free --keyring /build/build/tmp/work/debian-stretch-arm64/isar-bootstrap-target/apt-keyring.gpg stretch /build/build/tmp/work/debian-stretch-arm64/isar-bootstrap-target/rootfs http://ftp.debian.org/debian
> > | I: Retrieving InRelease
> > | I: Retrieving Release
> > | I: Retrieving Release.gpg
> > | I: Checking Release signature
> > | E: Release signed by unknown key (key id EF0F382A1A7B6500)
> > 
> > So something additionally must be done. Since I am not an expert on
> > debian keyring/debootstrap and dpkg signing I will try to find a
> > solution but maybe somebody has a good idea already?
> > 
> 
> Baurzhan, Maxim, any idea?
> 
I foudn a solution, one has to trust the key manually:

The following snippet can do this:

gpg --keyring build/tmp/work/debian-stretch-arm64/isar-bootstrap-target/apt-keyring.gpg --list-keys --with-colons | \
    sed -E -n -e 's/^fpr:::::::::([0-9A-F]+):$/\1:6:/p' | \
    gpg --import-ownertrust --keyring build/tmp/work/debian-stretch-arm64/isar-bootstrap-target/apt-keyring.gpg

I will try and write a patch for this.

Andreas
> Jan
> 
> -- 
> Siemens AG, Corporate Technology, CT RDA IOT SES-DE
> Corporate Competence Center Embedded Linux

-- 
Andreas Reichel
Dipl.-Phys. (Univ.)
Software Consultant

Andreas.Reichel@tngtech.com, +49-174-3180074
TNG Technology Consulting GmbH, Betastr. 13a, 85774 Unterfoehring
Geschaeftsfuehrer: Henrik Klagges, Dr. Robert Dahlke, Gerhard Mueller
Sitz: Unterfoehring * Amtsgericht Muenchen * HRB 135082