Re: [PATCH v2 3/3] Separate apt-key entries from default keyring

[Andreas Reichel <andreas.reichel.ext@siemens.com>]

On Wed, Feb 27, 2019 at 05:14:43PM +0100, Henning Schild wrote:
> Is this fixing an issue introduced in p1? I guess you should just
> squash it ;).
> 
> Henning

This is a matter of taste... as discussed for those building in a
container, it is no issue, for others, who don't it MIGHT be,
if they want to keep their keyring exactly as it was.
> 
> 
> Am Wed, 27 Feb 2019 16:18:56 +0100
> schrieb "[ext] Andreas J. Reichel" <andreas.reichel.ext@siemens.com>:
> 
> > From: Andreas Reichel <andreas.reichel.ext@siemens.com>
> > 
> > Per default, apt-key add adds keys to /etc/apt/trusted.gpg.
> > However, when building without a container, we don't want to
> > contaminate the host. Therefore, we specify a keyring file
> > in /etc/apt/trusted.gpg.d directory named `isar.gpg`. This file can
> > be deleted after the build.
> > 
> > This is necessary because we don't want to specify single keyrings
> > to debootstrap since we might need a mixture of several keyrings
> > as per default and would have to find all needed keyrings on the
> > system, export their keys and reimport into the build keyring, which
> > is more complicated and unneeded this way.
> > 
> > Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
> > ---
> >  meta/classes/isar-bootstrap-helper.bbclass              | 1 +
> >  meta/classes/isar-image.bbclass                         | 1 +
> >  meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb | 2 +-
> >  meta/recipes-core/isar-bootstrap/isar-bootstrap.inc     | 2 +-
> >  4 files changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/meta/classes/isar-bootstrap-helper.bbclass
> > b/meta/classes/isar-bootstrap-helper.bbclass index 26abf62..769cbef
> > 100644 --- a/meta/classes/isar-bootstrap-helper.bbclass
> > +++ b/meta/classes/isar-bootstrap-helper.bbclass
> > @@ -22,6 +22,7 @@ HOST_DISTRO ?= "debian-stretch"
> >  HOST_ARCH ?= "${@get_deb_host_arch()}"
> >  
> >  HOST_DISTRO_APT_SOURCES += "conf/distro/${HOST_DISTRO}.list"
> > +ISARKEYRING = "/etc/apt/trusted.gpg.d/isar.gpg"
> >  
> >  def reverse_bb_array(d, varname):
> >      array = d.getVar(varname, True)
> > diff --git a/meta/classes/isar-image.bbclass
> > b/meta/classes/isar-image.bbclass index cdd1651..4a89bd7 100644
> > --- a/meta/classes/isar-image.bbclass
> > +++ b/meta/classes/isar-image.bbclass
> > @@ -82,6 +82,7 @@ isar_image_cleanup() {
> >          fi
> >          rm -f "${IMAGE_ROOTFS}/etc/apt/sources-list"
> >      '
> > +    sudo rm -f "${ISARKEYRING}"
> >  }
> >  
> >  do_rootfs() {
> > diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb
> > b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb index
> > a793585..b70d2a8 100644 ---
> > a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb +++
> > b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb @@ -11,8
> > +11,8 @@ WORKDIR =
> > "${TMPDIR}/work/${DISTRO}-${DISTRO_ARCH}/${PN}-${HOST_DISTRO}-${HOST_A
> > DEPLOY_ISAR_BOOTSTRAP =
> > "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}"
> > ISAR_BOOTSTRAP_LOCK =
> > "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}.lock" -require
> > isar-bootstrap.inc inherit isar-bootstrap-helper +require
> > isar-bootstrap.inc do_generate_keyring[stamp-extra-info] =
> > "${DISTRO}-${DISTRO_ARCH}" 
> > diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index
> > 2ef3b1e..4613732 100644 ---
> > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++
> > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -179,7
> > +179,7 @@ do_generate_keyring() { chmod 777 "${APTKEYTMPDIR}"
> >          for keyfile in ${@d.getVar("APTKEYFILES", True)}; do
> >             cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename "$keyfile")"
> > -           sudo apt-key add "$keyfile"
> > +           sudo apt-key --keyring "${ISARKEYRING}" add "$keyfile"
> >          done
> >      fi
> >  }
> 

-- 
Andreas Reichel
Dipl.-Phys. (Univ.)
Software Consultant

Andreas.Reichel@tngtech.com, +49-174-3180074
TNG Technology Consulting GmbH, Betastr. 13a, 85774 Unterfoehring
Geschaeftsfuehrer: Henrik Klagges, Dr. Robert Dahlke, Gerhard Mueller
Sitz: Unterfoehring * Amtsgericht Muenchen * HRB 135082