From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6662306179908108288 X-Received: by 2002:adf:ea81:: with SMTP id s1mr1374117wrm.19.1551195590646; Tue, 26 Feb 2019 07:39:50 -0800 (PST) X-BeenThere: isar-users@googlegroups.com Received: by 2002:adf:9022:: with SMTP id h31ls1847910wrh.9.gmail; Tue, 26 Feb 2019 07:39:50 -0800 (PST) X-Google-Smtp-Source: AHgI3IZRoQWRRvoygJnEtP91B95gHiCpmhW4ywCDhHU1JRlsHghiH8ZzQlaiuFARtKKGRg9mTNJx X-Received: by 2002:a05:6000:1ce:: with SMTP id t14mr1360362wrx.29.1551195590259; Tue, 26 Feb 2019 07:39:50 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1551195590; cv=none; d=google.com; s=arc-20160816; b=jsRUdN1k4CCr6fnZkmLJEFc/289gja+2Yx4B7Tzfkpi5DzL+n6+rWDY2Fa+kUaD/n0 ZKC/oRs/BOYeJlPvylVJKO3P7/qYr+/tt/VUBSqItL8B8WHYDMR6s8HOAI7wNz2MpjNn dUKIZ7pyCkURRDbZ1Z/GGM01aeJfsicQVvh7TYwximjtVVujgzPBokKzahgDFzayp4QL kraioZhwSqPzp+/rEq8LTPcaMqnHKc0puBVuEIEguZeXj7jf3iiD504SIYWSHVQtpQGp nJgORGD2FdJYKLYuJdcqxDZwTUvTTUgcWXT1ZF9WlaJ5UYRHg6kgqEWAAb7lAXwceWGS Co5Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date; bh=8udm+Ve8CDIV7lQKwhZD4iMu9AlDX4nzFvb3VMa+uHU=; b=VFvTck4X2A/3dTRZhAlbXN0/oqg8kDDKQ3yF5u4YW9nTiAHEWpC4TWE4C90AgX+/cf bnfvcfe6NL1lV1bffH7pkIt3PGhYWNpCqiUNw058eizR8IY7fq0YqZEqCqjuUq6K5t9U JyEngwEjK9sHgWqRWHqHhTOzC4uJH+o+oZe9K+BtNTW6fgyq3tbBv0wVB1I0xRvJud0q CrY0OifnOUzhqAvFoa3RfQ9WRTDSQM/gTzDTmO0+JVlVKFZCqBljXtpTy30eZjkj4LR1 wW5bfJbdS/JVm+Yn2lD2I77yqtngpw5D6B+qdzNTL/N53NEhb+IDu4xWY5eZ/cXmn7jm N7IA== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of henning.schild@siemens.com designates 194.138.37.39 as permitted sender) smtp.mailfrom=henning.schild@siemens.com Return-Path: Received: from lizzard.sbs.de (lizzard.sbs.de. [194.138.37.39]) by gmr-mx.google.com with ESMTPS id t22si611610wmj.2.2019.02.26.07.39.50 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Feb 2019 07:39:50 -0800 (PST) Received-SPF: pass (google.com: domain of henning.schild@siemens.com designates 194.138.37.39 as permitted sender) client-ip=194.138.37.39; Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of henning.schild@siemens.com designates 194.138.37.39 as permitted sender) smtp.mailfrom=henning.schild@siemens.com Received: from mail2.sbs.de (mail2.sbs.de [192.129.41.66]) by lizzard.sbs.de (8.15.2/8.15.2) with ESMTPS id x1QFdoQ7010245 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Tue, 26 Feb 2019 16:39:50 +0100 Received: from md1za8fc.ad001.siemens.net ([139.25.68.253]) by mail2.sbs.de (8.15.2/8.15.2) with ESMTP id x1QFdn8b021489; Tue, 26 Feb 2019 16:39:49 +0100 Date: Tue, 26 Feb 2019 16:39:49 +0100 From: Henning Schild To: "[ext] Andreas J. Reichel" Cc: Subject: Re: [RFC v1 2/3] Refactor gpg code to use apt code Message-ID: <20190226163949.27cfdd7d@md1za8fc.ad001.siemens.net> In-Reply-To: <20190226134844.8632-3-andreas.reichel.ext@siemens.com> References: <20190226134844.8632-1-andreas.reichel.ext@siemens.com> <20190226134844.8632-3-andreas.reichel.ext@siemens.com> X-Mailer: Claws Mail 3.17.3 (GTK+ 2.24.32; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-TUID: LarDcIt41U9X Am Tue, 26 Feb 2019 14:48:43 +0100 schrieb "[ext] Andreas J. Reichel" : > From: Andreas Reichel > > Don't manually move around keys and keyrings, use `apt-key` to do so > > Signed-off-by: Andreas Reichel > --- > meta/classes/isar-bootstrap-helper.bbclass | 9 +++++++++ > .../isar-bootstrap/isar-bootstrap.inc | 17 > +++++++---------- 2 files changed, 16 insertions(+), 10 deletions(-) > > diff --git a/meta/classes/isar-bootstrap-helper.bbclass > b/meta/classes/isar-bootstrap-helper.bbclass index d780b85..df6fbee > 100644 --- a/meta/classes/isar-bootstrap-helper.bbclass > +++ b/meta/classes/isar-bootstrap-helper.bbclass > @@ -119,6 +119,14 @@ setup_root_file_system() { > export LANG=C > export LANGUAGE=C > export LC_ALL=C > + > + if [ -d ${TMPDIR}/aptkeys ]; then > + for keyfile in ${TMPDIR}/aptkeys/* > + do > + cp $keyfile "$ROOTFSDIR"/tmp/$(basename $keyfile) > + sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key > add /tmp/$(basename $keyfile) > + done > + fi > sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update \ > -o Dir::Etc::sourcelist="sources.list.d/isar-apt.list" \ > -o Dir::Etc::sourceparts="-" \ > @@ -128,6 +136,7 @@ setup_root_file_system() { > sudo -E chroot "$ROOTFSDIR" /usr/bin/dpkg --add-architecture > ${DISTRO_ARCH} sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update > fi > + sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key update > sudo -E chroot "$ROOTFSDIR" \ > /usr/bin/apt-get ${APT_ARGS} --download-only $PACKAGES \ > ${IMAGE_TRANSIENT_PACKAGES} > diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index > 25133be..60bd061 100644 --- > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++ > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -23,10 +23,8 > @@ APTSRCS = "${WORKDIR}/apt-sources" APTSRCS_INIT = > "${WORKDIR}/apt-sources-init" BASEAPTSRCS = > "${WORKDIR}/base-apt-sources" APTKEYFILES = "" > -APTKEYRING = "${WORKDIR}/apt-keyring.gpg" > -DEBOOTSTRAP_KEYRING = "" > DEPLOY_ISAR_BOOTSTRAP ?= "" > -DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales" > +DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales gnupg2 apt-transport-https > ca-certificates" > DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org > file:///${REPO_BASE_DIR} \n" if > bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) else "" }" > @@ -37,7 +35,6 @@ python () { distro_apt_keys = > d.getVar("DISTRO_APT_KEYS", False) wd = d.getVar("WORKDIR", True) > if distro_apt_keys: > - d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}") > for key in distro_apt_keys.split(): > url = urlparse(key) > if "https://" in key or "http://" in key: > @@ -49,7 +46,6 @@ python () { > if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')): > own_pub_key = d.getVar("BASE_REPO_KEY", False) > if own_pub_key: > - d.setVar("DEBOOTSTRAP_KEYRING", "--keyring > ${APTKEYRING}") for key in own_pub_key.split(): > url = urlparse(key) > filename = ''.join([wd, url.path]) > @@ -181,9 +177,12 @@ do_generate_keyring[dirs] = "${DL_DIR}" > do_generate_keyring[vardeps] += "DISTRO_APT_KEYS" > do_generate_keyring() { > if [ -n "${@d.getVar("APTKEYFILES", True) or ""}" ]; then > + APTKEYTMPDIR="${TMPDIR}"/aptkeys > + [ -d "${APTKEYTMPDIR}" ] || { mkdir -p "${APTKEYTMPDIR}"; \ > + chmod 777 "${APTKEYTMPDIR}"; } mkdir -p does not need test -d in fact you probably want that dir as a cleandir instead of all that > for keyfile in ${@d.getVar("APTKEYFILES", True)}; do > - gpg --no-default-keyring --keyring "${APTKEYRING}" \ > - --no-tty --homedir "${DL_DIR}" --import "$keyfile" > + cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename "$keyfile")" > + sudo apt-key add "$keyfile" As i said, would be nice to be able to undo that after the debootstrap. Talking about undo, after the last apt-key operations that tmpdir can be removed from the chroot. > done > fi > } > @@ -225,7 +224,6 @@ isar_bootstrap() { > if [ ${IS_HOST} ]; then > ${DEBOOTSTRAP} $debootstrap_args \ > ${@get_distro_components_argument(d, > True)} \ > - ${DEBOOTSTRAP_KEYRING} \ > "${@get_distro_suite(d, True)}" \ > "${ROOTFSDIR}" \ > "${@get_distro_source(d, True)}" > @@ -234,7 +232,6 @@ isar_bootstrap() { > "${DEBOOTSTRAP}" $debootstrap_args \ > --arch="${DISTRO_ARCH}" \ > ${@get_distro_components_argument(d, > False)} \ > - ${DEBOOTSTRAP_KEYRING} \ > "${@get_distro_suite(d, False)}" \ > "${ROOTFSDIR}" \ > "${@get_distro_source(d, False)}" > @@ -248,7 +245,7 @@ isar_bootstrap() { > if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then > sed -e "s#{BASE_DISTRO}#"${BASE_DISTRO}"#g" \ > -e > "s#{BASE_DISTRO_CODENAME}#"${BASE_DISTRO_CODENAME}"#g" \ > - -i ${BASEAPTSRCS} > + -i ${BASEAPTSRCS} remove that whitespace change. Henning > mkdir -p ${ROOTFSDIR}/base-apt > sudo mount --bind ${REPO_BASE_DIR} > ${ROOTFSDIR}/base-apt install -v -m644 "${BASEAPTSRCS}" \