[PATCH v2 3/3] Separate apt-key entries from default keyring

["Andreas J. Reichel" <andreas.reichel.ext@siemens.com>]

From: Andreas Reichel <andreas.reichel.ext@siemens.com>

Per default, apt-key add adds keys to /etc/apt/trusted.gpg.
However, when building without a container, we don't want to contaminate
the host. Therefore, we specify a keyring file in /etc/apt/trusted.gpg.d
directory named `isar.gpg`. This file can be deleted after the build.

This is necessary because we don't want to specify single keyrings
to debootstrap since we might need a mixture of several keyrings
as per default and would have to find all needed keyrings on the system,
export their keys and reimport into the build keyring, which is more
complicated and unneeded this way.

Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
---
 meta/classes/isar-bootstrap-helper.bbclass              | 1 +
 meta/classes/isar-image.bbclass                         | 1 +
 meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb | 2 +-
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc     | 2 +-
 4 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/meta/classes/isar-bootstrap-helper.bbclass b/meta/classes/isar-bootstrap-helper.bbclass
index 26abf62..769cbef 100644
--- a/meta/classes/isar-bootstrap-helper.bbclass
+++ b/meta/classes/isar-bootstrap-helper.bbclass
@@ -22,6 +22,7 @@ HOST_DISTRO ?= "debian-stretch"
 HOST_ARCH ?= "${@get_deb_host_arch()}"
 
 HOST_DISTRO_APT_SOURCES += "conf/distro/${HOST_DISTRO}.list"
+ISARKEYRING = "/etc/apt/trusted.gpg.d/isar.gpg"
 
 def reverse_bb_array(d, varname):
     array = d.getVar(varname, True)
diff --git a/meta/classes/isar-image.bbclass b/meta/classes/isar-image.bbclass
index cdd1651..4a89bd7 100644
--- a/meta/classes/isar-image.bbclass
+++ b/meta/classes/isar-image.bbclass
@@ -82,6 +82,7 @@ isar_image_cleanup() {
         fi
         rm -f "${IMAGE_ROOTFS}/etc/apt/sources-list"
     '
+    sudo rm -f "${ISARKEYRING}"
 }
 
 do_rootfs() {
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb
index a793585..b70d2a8 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb
@@ -11,8 +11,8 @@ WORKDIR = "${TMPDIR}/work/${DISTRO}-${DISTRO_ARCH}/${PN}-${HOST_DISTRO}-${HOST_A
 DEPLOY_ISAR_BOOTSTRAP = "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}"
 ISAR_BOOTSTRAP_LOCK = "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}.lock"
 
-require isar-bootstrap.inc
 inherit isar-bootstrap-helper
+require isar-bootstrap.inc
 
 do_generate_keyring[stamp-extra-info] = "${DISTRO}-${DISTRO_ARCH}"
 
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index 2ef3b1e..4613732 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -179,7 +179,7 @@ do_generate_keyring() {
         chmod 777 "${APTKEYTMPDIR}"
         for keyfile in ${@d.getVar("APTKEYFILES", True)}; do
            cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename "$keyfile")"
-           sudo apt-key add "$keyfile"
+           sudo apt-key --keyring "${ISARKEYRING}" add "$keyfile"
         done
     fi
 }
-- 
2.21.0