Re: [PATCH 0/1] Fix remote key fetching apt keyring

[Henning Schild <henning.schild@siemens.com>]

On Wed, 20 Feb 2019 12:21:32 +0100
"[ext] Andreas J. Reichel" <andreas.reichel.ext@siemens.com> wrote:

> From: Andreas Reichel <andreas.reichel.ext@siemens.com>
> 
> Since my last mail was not answered, but this is an important topic,
> here is a patch that shows what the problem is.
> 
> If we fetch the user apt key from remote, we need the basename,
> if we fetch it locally we need the absolute path...
> 
> While this might not be the best way to fix this, it works as good
> as the rest of this code...
> 
> At least it fixes Isar again up to adding the key to the keyring.
> 
> But this still does not fix the next problem with the docker-ce key:
> 
> | I: Running command: debootstrap --arch arm64 --foreign --verbose
> --variant=minbase --include=locales
> --components=main,contrib,non-free
> --keyring /build/build/tmp/work/debian-stretch-arm64/isar-bootstrap-target/apt-keyring.gpg
> stretch /build/build/tmp/work/debian-stretch-arm64/isar-bootstrap-target/rootfs
> http://ftp.debian.org/debian | I: Retrieving InRelease | I:
> Retrieving Release | I: Retrieving Release.gpg | I: Checking Release
> signature | E: Release signed by unknown key (key id EF0F382A1A7B6500)
> 
> So something additionally must be done. Since I am not an expert on
> debian keyring/debootstrap and dpkg signing I will try to find a
> solution but maybe somebody has a good idea already?

A hack that will probably work is a recipe that fetches all the debs
with unpack=false and overrides do_build with true. You will have
many .debs in your WORKDIR and they will get into our repo as if you
built them ;). Now you can sign them with your own key, or forget about
signatures alltogether.

Henning

> Andreas Reichel (1):
>   Fix path to user gpg-keys
> 
>  meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>