From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6662700470316826624 X-Received: by 2002:a50:915d:: with SMTP id f29mr525913eda.12.1551283965438; Wed, 27 Feb 2019 08:12:45 -0800 (PST) X-BeenThere: isar-users@googlegroups.com Received: by 2002:a50:97e2:: with SMTP id f31ls645669edb.0.gmail; Wed, 27 Feb 2019 08:12:45 -0800 (PST) X-Google-Smtp-Source: AHgI3IZOuHW3rKaY1/Cn4Eryw1UDI0tc6F2UFxhv+rSJJQW2k71ZLAwWvroMkbvUQ1XPW/ispuWu X-Received: by 2002:a50:d1d6:: with SMTP id i22mr526453edg.1.1551283964967; Wed, 27 Feb 2019 08:12:44 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1551283964; cv=none; d=google.com; s=arc-20160816; b=oJ5N5+8q/sce+UapIW1/s70YBNPnM9ZY49kn5HX+nYPAOwv1AR5iDKH3RAuO5AUfNc MAW/O8bAMEW9UpuhmJfkoVWmjegdYIyZNtwVU9i2SWWl2MSikeuw9fMV26NJ3pyL8xQ8 n4Dpx/pvYST1EQY/vjAMTM+azV+aXzIK52iQBiC9iyXw8ZjzSO58MfZMQjhw3qW4fe6K dDJ8hiug1K449ih25NE4i4bjyQ7GuylTwpKagW34d6iBUrcYyoFOTlaecRIrOlMrMaFO zTa89c8ibxs9Fg48zJxhr0VB1YkOflYGzHmcF/+l1wit/MO0lvbRb6G6qjH8DOxBb0c9 XObg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date; bh=kidG43qpjuEr3bP5SpN4T9mMXVqNNMGH9uDwGY9fvCk=; b=u8ldTSyljkGKI3XM21mqYmbtORMMnB8XXpofOW+mdJm2X5Ek4Z0fTvjDQeeF94kr9o b4RV68/aS1sa53sKGFhnhi+XOKAxLgSXRqQpRWaoRBeiG8ipLRWfTYXQHbnc1yD3g7S/ TqwWqOhH8hUBqnWwuUrx2JuCgWAMS37RBNCt6t09TC06NVKBQiD1XoPDWc9SOLiyn1th eadhc5ifDDMgMyYqvFnc7N0B+XCyacIycXqYSdjTI/fT0Qr9hr+GyTpTAmH46sUpvk5Y yLTldqAq10g6Nv0bvdkUB0AFXk3p2SKO6mXO/da3WKA+Nkg2XcxhssY8WoHPu+NAtteT gLaA== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.14 as permitted sender) smtp.mailfrom=henning.schild@siemens.com Return-Path: Received: from david.siemens.de (david.siemens.de. [192.35.17.14]) by gmr-mx.google.com with ESMTPS id i16si182397ede.0.2019.02.27.08.12.44 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 27 Feb 2019 08:12:44 -0800 (PST) Received-SPF: pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.14 as permitted sender) client-ip=192.35.17.14; Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.14 as permitted sender) smtp.mailfrom=henning.schild@siemens.com Received: from mail2.sbs.de (mail2.sbs.de [192.129.41.66]) by david.siemens.de (8.15.2/8.15.2) with ESMTPS id x1RGCijI022530 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Wed, 27 Feb 2019 17:12:44 +0100 Received: from md1za8fc.ad001.siemens.net ([139.25.69.171]) by mail2.sbs.de (8.15.2/8.15.2) with ESMTP id x1RGCi8v006643; Wed, 27 Feb 2019 17:12:44 +0100 Date: Wed, 27 Feb 2019 17:12:42 +0100 From: Henning Schild To: "[ext] Andreas J. Reichel" Cc: Subject: Re: [PATCH v2 1/3] Fix and simplify apt keyring generation Message-ID: <20190227171242.5c2c73b4@md1za8fc.ad001.siemens.net> In-Reply-To: <20190227151856.11594-2-andreas.reichel.ext@siemens.com> References: <20190227151856.11594-1-andreas.reichel.ext@siemens.com> <20190227151856.11594-2-andreas.reichel.ext@siemens.com> X-Mailer: Claws Mail 3.17.3 (GTK+ 2.24.32; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-TUID: hfANDR+Tg05T Am Wed, 27 Feb 2019 16:18:54 +0100 schrieb "[ext] Andreas J. Reichel" : > From: Andreas Reichel > > Different fetcher stored keys in different sub dirs, and we can never > be sure about where downloaded files go. > To avoid this without making any assumptions, we ask the fetcher where > the file will be after it is downloaded. This way we also don't need > to parse the URL manually. > > The code is simplified by removing duplicate code and using apt-key > instead of manually calling gpg. > > Signed-off-by: Andreas Reichel > --- > meta/classes/isar-bootstrap-helper.bbclass | 11 ++++++ > .../isar-bootstrap/isar-bootstrap.inc | 39 > +++++++++---------- 2 files changed, 29 insertions(+), 21 deletions(-) > > diff --git a/meta/classes/isar-bootstrap-helper.bbclass > b/meta/classes/isar-bootstrap-helper.bbclass index d780b85..b8c41f9 > 100644 --- a/meta/classes/isar-bootstrap-helper.bbclass > +++ b/meta/classes/isar-bootstrap-helper.bbclass > @@ -119,6 +119,16 @@ setup_root_file_system() { > export LANG=C > export LANGUAGE=C > export LC_ALL=C > + > + if [ -d ${TMPDIR}/aptkeys ]; then > + for keyfile in ${TMPDIR}/aptkeys/* > + do > + kfn="tmp/$(basename $keyfile)" > + cp $keyfile "$ROOTFSDIR/$kfn" > + sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key add "/$kfn" Would probably be a good idea to work in /tmp/ as well and in a subdir. Try naming your key "root" or "usr" ... > + rm "$ROOTFSDIR/$kfn" > + done > + fi > sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update \ > -o Dir::Etc::sourcelist="sources.list.d/isar-apt.list" \ > -o Dir::Etc::sourceparts="-" \ > @@ -128,6 +138,7 @@ setup_root_file_system() { > sudo -E chroot "$ROOTFSDIR" /usr/bin/dpkg --add-architecture > ${DISTRO_ARCH} sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update > fi > + sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key update > sudo -E chroot "$ROOTFSDIR" \ > /usr/bin/apt-get ${APT_ARGS} --download-only $PACKAGES \ > ${IMAGE_TRANSIENT_PACKAGES} > diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index > 234d339..2ef3b1e 100644 --- > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++ > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -23,35 > +23,30 @@ APTSRCS = "${WORKDIR}/apt-sources" APTSRCS_INIT = > "${WORKDIR}/apt-sources-init" BASEAPTSRCS = > "${WORKDIR}/base-apt-sources" APTKEYFILES = "" > -APTKEYRING = "${WORKDIR}/apt-keyring.gpg" > -DEBOOTSTRAP_KEYRING = "" > DEPLOY_ISAR_BOOTSTRAP ?= "" > -DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales" > +DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales gnupg2 apt-transport-https > ca-certificates" That looks more like leftovers from an experiment. Are you sure that is needed? In general i think that patch should be splittet into two or even more patches. Because it solves at least two problems. Henning > DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org > file:///${REPO_BASE_DIR} \n" if > bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) else "" }" > inherit base-apt-helper > python () { > - from urllib.parse import urlparse > distro_apt_keys = d.getVar("DISTRO_APT_KEYS", False) > - wd = d.getVar("WORKDIR", True) > + aptkeys = [] > + > if distro_apt_keys: > - d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}") > - for key in distro_apt_keys.split(): > - url = urlparse(key) > - filename = ''.join([wd, url.path]) > - d.appendVar("SRC_URI", " %s" % key) > - d.appendVar("APTKEYFILES", " %s" % filename) > + aptkeys += distro_apt_keys.split() > + > if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')): > own_pub_key = d.getVar("BASE_REPO_KEY", False) > if own_pub_key: > - d.setVar("DEBOOTSTRAP_KEYRING", "--keyring > ${APTKEYRING}") > - for key in own_pub_key.split(): > - url = urlparse(key) > - filename = ''.join([wd, url.path]) > - d.appendVar("SRC_URI", " %s" % key) > - d.appendVar("APTKEYFILES", " %s" % filename) > + aptkeys += own_pub_keys.split() > + > + for key in aptkeys: > + d.appendVar("SRC_URI", " %s" % key) > + fetcher = bb.fetch2.Fetch([key], d) > + filename = fetcher.localpath(key) > + d.appendVar("APTKEYFILES", " %s" % filename) > } > > def aggregate_files(d, file_list, file_out): > @@ -174,13 +169,17 @@ def get_distro_components_argument(d, is_host): > else: > return "" > > +APTKEYTMPDIR := "${TMPDIR}/aptkeys" > + > +do_generate_keyring[cleandirs] = "${APTKEYTMPDIR}" > do_generate_keyring[dirs] = "${DL_DIR}" > do_generate_keyring[vardeps] += "DISTRO_APT_KEYS" > do_generate_keyring() { > if [ -n "${@d.getVar("APTKEYFILES", True) or ""}" ]; then > + chmod 777 "${APTKEYTMPDIR}" > for keyfile in ${@d.getVar("APTKEYFILES", True)}; do > - gpg --no-default-keyring --keyring "${APTKEYRING}" \ > - --no-tty --homedir "${DL_DIR}" --import "$keyfile" > + cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename "$keyfile")" > + sudo apt-key add "$keyfile" > done > fi > } > @@ -222,7 +221,6 @@ isar_bootstrap() { > if [ ${IS_HOST} ]; then > ${DEBOOTSTRAP} $debootstrap_args \ > ${@get_distro_components_argument(d, > True)} \ > - ${DEBOOTSTRAP_KEYRING} \ > "${@get_distro_suite(d, True)}" \ > "${ROOTFSDIR}" \ > "${@get_distro_source(d, True)}" > @@ -231,7 +229,6 @@ isar_bootstrap() { > "${DEBOOTSTRAP}" $debootstrap_args \ > --arch="${DISTRO_ARCH}" \ > ${@get_distro_components_argument(d, > False)} \ > - ${DEBOOTSTRAP_KEYRING} \ > "${@get_distro_suite(d, False)}" \ > "${ROOTFSDIR}" \ > "${@get_distro_source(d, False)}"