Re: [RFC v1 2/3] Refactor gpg code to use apt code

[Henning Schild <henning.schild@siemens.com>]

Am Tue, 26 Feb 2019 14:48:43 +0100
schrieb "[ext] Andreas J. Reichel" <andreas.reichel.ext@siemens.com>:

> From: Andreas Reichel <andreas.reichel.ext@siemens.com>
> 
> Don't manually move around keys and keyrings, use `apt-key` to do so
> 
> Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
> ---
>  meta/classes/isar-bootstrap-helper.bbclass      |  9 +++++++++
>  .../isar-bootstrap/isar-bootstrap.inc           | 17
> +++++++---------- 2 files changed, 16 insertions(+), 10 deletions(-)
> 
> diff --git a/meta/classes/isar-bootstrap-helper.bbclass
> b/meta/classes/isar-bootstrap-helper.bbclass index d780b85..df6fbee
> 100644 --- a/meta/classes/isar-bootstrap-helper.bbclass
> +++ b/meta/classes/isar-bootstrap-helper.bbclass
> @@ -119,6 +119,14 @@ setup_root_file_system() {
>      export LANG=C
>      export LANGUAGE=C
>      export LC_ALL=C
> +
> +    if [ -d ${TMPDIR}/aptkeys ]; then
> +        for keyfile in ${TMPDIR}/aptkeys/*
> +        do
> +            cp $keyfile "$ROOTFSDIR"/tmp/$(basename $keyfile)
> +            sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key
> add /tmp/$(basename $keyfile)
> +        done
> +    fi
>      sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update \
>          -o Dir::Etc::sourcelist="sources.list.d/isar-apt.list" \
>          -o Dir::Etc::sourceparts="-" \
> @@ -128,6 +136,7 @@ setup_root_file_system() {
>          sudo -E chroot "$ROOTFSDIR" /usr/bin/dpkg --add-architecture
> ${DISTRO_ARCH} sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update
>      fi
> +    sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key update
>      sudo -E chroot "$ROOTFSDIR" \
>          /usr/bin/apt-get ${APT_ARGS} --download-only $PACKAGES \
>              ${IMAGE_TRANSIENT_PACKAGES}
> diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index
> 25133be..60bd061 100644 ---
> a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -23,10 +23,8
> @@ APTSRCS = "${WORKDIR}/apt-sources" APTSRCS_INIT =
> "${WORKDIR}/apt-sources-init" BASEAPTSRCS =
> "${WORKDIR}/base-apt-sources" APTKEYFILES = ""
> -APTKEYRING = "${WORKDIR}/apt-keyring.gpg"
> -DEBOOTSTRAP_KEYRING = ""
>  DEPLOY_ISAR_BOOTSTRAP ?= ""
> -DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales"
> +DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales gnupg2 apt-transport-https
> ca-certificates" 
>  DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org
> file:///${REPO_BASE_DIR} \n" if
> bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) else "" }"
> @@ -37,7 +35,6 @@ python () { distro_apt_keys =
> d.getVar("DISTRO_APT_KEYS", False) wd = d.getVar("WORKDIR", True)
>      if distro_apt_keys:
> -        d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
>          for key in distro_apt_keys.split():
>              url = urlparse(key)
>              if "https://" in key or "http://" in key:
> @@ -49,7 +46,6 @@ python () {
>      if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')):
>          own_pub_key = d.getVar("BASE_REPO_KEY", False)
>          if own_pub_key:
> -            d.setVar("DEBOOTSTRAP_KEYRING", "--keyring
> ${APTKEYRING}") for key in own_pub_key.split():
>                  url = urlparse(key)
>                  filename = ''.join([wd, url.path])
> @@ -181,9 +177,12 @@ do_generate_keyring[dirs] = "${DL_DIR}"
>  do_generate_keyring[vardeps] += "DISTRO_APT_KEYS"
>  do_generate_keyring() {
>      if [ -n "${@d.getVar("APTKEYFILES", True) or ""}" ]; then
> +        APTKEYTMPDIR="${TMPDIR}"/aptkeys
> +        [ -d "${APTKEYTMPDIR}" ] || { mkdir -p "${APTKEYTMPDIR}"; \
> +           chmod 777 "${APTKEYTMPDIR}"; }

mkdir -p does not need test -d
in fact you probably want that dir as a cleandir instead of all that

>          for keyfile in ${@d.getVar("APTKEYFILES", True)}; do
> -           gpg --no-default-keyring --keyring "${APTKEYRING}" \
> -               --no-tty --homedir "${DL_DIR}"  --import "$keyfile"
> +           cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename "$keyfile")"
> +           sudo apt-key add "$keyfile"

As i said, would be nice to be able to undo that after the debootstrap.

Talking about undo, after the last apt-key operations that tmpdir can
be removed from the chroot.

>          done
>      fi
>  }
> @@ -225,7 +224,6 @@ isar_bootstrap() {
>              if [ ${IS_HOST} ]; then
>                  ${DEBOOTSTRAP} $debootstrap_args \
>                                 ${@get_distro_components_argument(d,
> True)} \
> -                               ${DEBOOTSTRAP_KEYRING} \
>                                 "${@get_distro_suite(d, True)}" \
>                                 "${ROOTFSDIR}" \
>                                 "${@get_distro_source(d, True)}"
> @@ -234,7 +232,6 @@ isar_bootstrap() {
>                   "${DEBOOTSTRAP}" $debootstrap_args \
>                                    --arch="${DISTRO_ARCH}" \
>                                    ${@get_distro_components_argument(d,
> False)} \
> -                                  ${DEBOOTSTRAP_KEYRING} \
>                                    "${@get_distro_suite(d, False)}" \
>                                    "${ROOTFSDIR}" \
>                                    "${@get_distro_source(d, False)}"
> @@ -248,7 +245,7 @@ isar_bootstrap() {
>              if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
>                  sed -e "s#{BASE_DISTRO}#"${BASE_DISTRO}"#g" \
>                      -e
> "s#{BASE_DISTRO_CODENAME}#"${BASE_DISTRO_CODENAME}"#g" \
> -	            -i ${BASEAPTSRCS}
> +                    -i ${BASEAPTSRCS}

remove that whitespace change.

Henning

>                  mkdir -p ${ROOTFSDIR}/base-apt
>                  sudo mount --bind ${REPO_BASE_DIR}
> ${ROOTFSDIR}/base-apt install -v -m644 "${BASEAPTSRCS}" \