Re: [PATCH v2 3/3] Separate apt-key entries from default keyring

[Henning Schild <henning.schild@siemens.com>]

Is this fixing an issue introduced in p1? I guess you should just
squash it ;).

Henning


Am Wed, 27 Feb 2019 16:18:56 +0100
schrieb "[ext] Andreas J. Reichel" <andreas.reichel.ext@siemens.com>:

> From: Andreas Reichel <andreas.reichel.ext@siemens.com>
> 
> Per default, apt-key add adds keys to /etc/apt/trusted.gpg.
> However, when building without a container, we don't want to
> contaminate the host. Therefore, we specify a keyring file
> in /etc/apt/trusted.gpg.d directory named `isar.gpg`. This file can
> be deleted after the build.
> 
> This is necessary because we don't want to specify single keyrings
> to debootstrap since we might need a mixture of several keyrings
> as per default and would have to find all needed keyrings on the
> system, export their keys and reimport into the build keyring, which
> is more complicated and unneeded this way.
> 
> Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
> ---
>  meta/classes/isar-bootstrap-helper.bbclass              | 1 +
>  meta/classes/isar-image.bbclass                         | 1 +
>  meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb | 2 +-
>  meta/recipes-core/isar-bootstrap/isar-bootstrap.inc     | 2 +-
>  4 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/meta/classes/isar-bootstrap-helper.bbclass
> b/meta/classes/isar-bootstrap-helper.bbclass index 26abf62..769cbef
> 100644 --- a/meta/classes/isar-bootstrap-helper.bbclass
> +++ b/meta/classes/isar-bootstrap-helper.bbclass
> @@ -22,6 +22,7 @@ HOST_DISTRO ?= "debian-stretch"
>  HOST_ARCH ?= "${@get_deb_host_arch()}"
>  
>  HOST_DISTRO_APT_SOURCES += "conf/distro/${HOST_DISTRO}.list"
> +ISARKEYRING = "/etc/apt/trusted.gpg.d/isar.gpg"
>  
>  def reverse_bb_array(d, varname):
>      array = d.getVar(varname, True)
> diff --git a/meta/classes/isar-image.bbclass
> b/meta/classes/isar-image.bbclass index cdd1651..4a89bd7 100644
> --- a/meta/classes/isar-image.bbclass
> +++ b/meta/classes/isar-image.bbclass
> @@ -82,6 +82,7 @@ isar_image_cleanup() {
>          fi
>          rm -f "${IMAGE_ROOTFS}/etc/apt/sources-list"
>      '
> +    sudo rm -f "${ISARKEYRING}"
>  }
>  
>  do_rootfs() {
> diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb index
> a793585..b70d2a8 100644 ---
> a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb +++
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb @@ -11,8
> +11,8 @@ WORKDIR =
> "${TMPDIR}/work/${DISTRO}-${DISTRO_ARCH}/${PN}-${HOST_DISTRO}-${HOST_A
> DEPLOY_ISAR_BOOTSTRAP =
> "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}"
> ISAR_BOOTSTRAP_LOCK =
> "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}.lock" -require
> isar-bootstrap.inc inherit isar-bootstrap-helper +require
> isar-bootstrap.inc do_generate_keyring[stamp-extra-info] =
> "${DISTRO}-${DISTRO_ARCH}" 
> diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index
> 2ef3b1e..4613732 100644 ---
> a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -179,7
> +179,7 @@ do_generate_keyring() { chmod 777 "${APTKEYTMPDIR}"
>          for keyfile in ${@d.getVar("APTKEYFILES", True)}; do
>             cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename "$keyfile")"
> -           sudo apt-key add "$keyfile"
> +           sudo apt-key --keyring "${ISARKEYRING}" add "$keyfile"
>          done
>      fi
>  }