From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6662700470316826624 X-Received: by 2002:a19:f703:: with SMTP id z3mr250969lfe.8.1551431382516; Fri, 01 Mar 2019 01:09:42 -0800 (PST) X-BeenThere: isar-users@googlegroups.com Received: by 2002:a19:f516:: with SMTP id j22ls738288lfb.5.gmail; Fri, 01 Mar 2019 01:09:41 -0800 (PST) X-Google-Smtp-Source: APXvYqxDHlxVW9hh8GS6d6DxbY/Mcpuaj3spuSVUy5vpjtgZQAkRdYfV4aXJOdY8C6WLwzc70DtE X-Received: by 2002:ac2:4292:: with SMTP id m18mr246403lfh.15.1551431381942; Fri, 01 Mar 2019 01:09:41 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1551431381; cv=none; d=google.com; s=arc-20160816; b=QduBJF4PSsF4gfHfRtip9VaxB6QgfOlEJ2NacXu8zjEoZSrChBEBD/Kh8VMPgGxmDf 0rIbsYxdOglAJCSHmNeP9T9NwCOfHAPqwb+2sBDE1/pSPPsDMbZDs9MHK98fiuaE/TQg om1PXngJWTItg28irlp4Jb6D0Vtp49Xmgtjx9sC3pUXH/JPEnWNgrUpTsivX7bsU69Pt Spc/5gAWxXmbrALncjTfNiJTgg7dwbNv0ys7pN4Lb7ZYJRFgbxkJpd856FaQk4WBgsRb dxs5qJEPJTm2bdYuGM/QQgqGDkQd+hlNWL1cKcgekUItsdVQ48ImpQ1CTupsietsqrsd eQWQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=user-agent:in-reply-to:content-disposition:content-description :mime-version:references:message-id:subject:cc:to:from:date; bh=fCc/HyZmsjrIZk6P7nAkzYiIxlVwZWoZs6R7QJ28+a0=; b=IEjyLC2TeOR+AI6k3gykpnsLIL5nDQDChkSZVRsN4qLpamgJ64KxvJuqZp2sp77N7w 6hFCIFCxHa7vZLe/IFS+Nxxx0A+UJ5/cC8MmVfBPXO8YSRbBNjxghLUhCQ7n8Bfl93+l JyKc9Vch0r95c57vOitbQ+ehMktXmgyFH0j5XScMe1VwhkyIuRpBlPpzQ1RgcKH6SS+p NaLwXhtWIzmvVaitSt/ur4x4ZNxeXjAyuk/KiEjf0PRwDjc7Z98JTZGT9OSpulQijJmL LL+F6Oqte07cD/tSEjVXJFvYXjqffriJNSio0ojpphuNhvoA3XrLQyPsZbT39FaBCPPo TbbQ== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of andreas.reichel.ext@siemens.com designates 192.35.17.2 as permitted sender) smtp.mailfrom=andreas.reichel.ext@siemens.com Return-Path: Received: from thoth.sbs.de (thoth.sbs.de. [192.35.17.2]) by gmr-mx.google.com with ESMTPS id y13si461864lfg.4.2019.03.01.01.09.41 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 01 Mar 2019 01:09:41 -0800 (PST) Received-SPF: pass (google.com: domain of andreas.reichel.ext@siemens.com designates 192.35.17.2 as permitted sender) client-ip=192.35.17.2; Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of andreas.reichel.ext@siemens.com designates 192.35.17.2 as permitted sender) smtp.mailfrom=andreas.reichel.ext@siemens.com Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by thoth.sbs.de (8.15.2/8.15.2) with ESMTPS id x2199fEu014964 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 1 Mar 2019 10:09:41 +0100 Received: from iiotirae (golem.ppmd.siemens.net [139.25.69.17]) by mail1.sbs.de (8.15.2/8.15.2) with SMTP id x2199e6Y017270; Fri, 1 Mar 2019 10:09:40 +0100 Date: Fri, 1 Mar 2019 10:08:04 +0100 From: Andreas Reichel To: Henning Schild Cc: isar-users@googlegroups.com Subject: Re: [PATCH v2 3/3] Separate apt-key entries from default keyring Message-ID: <20190301090804.GA10350@iiotirae> References: <20190227151856.11594-1-andreas.reichel.ext@siemens.com> <20190227151856.11594-4-andreas.reichel.ext@siemens.com> <20190227171443.7bb07fc2@md1za8fc.ad001.siemens.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Description: message Content-Disposition: inline In-Reply-To: <20190227171443.7bb07fc2@md1za8fc.ad001.siemens.net> User-Agent: Mutt/1.11.3 (2019-02-01) X-TUID: oWKsfEdHLGFf On Wed, Feb 27, 2019 at 05:14:43PM +0100, Henning Schild wrote: > Is this fixing an issue introduced in p1? I guess you should just > squash it ;). > > Henning This is a matter of taste... as discussed for those building in a container, it is no issue, for others, who don't it MIGHT be, if they want to keep their keyring exactly as it was. > > > Am Wed, 27 Feb 2019 16:18:56 +0100 > schrieb "[ext] Andreas J. Reichel" : > > > From: Andreas Reichel > > > > Per default, apt-key add adds keys to /etc/apt/trusted.gpg. > > However, when building without a container, we don't want to > > contaminate the host. Therefore, we specify a keyring file > > in /etc/apt/trusted.gpg.d directory named `isar.gpg`. This file can > > be deleted after the build. > > > > This is necessary because we don't want to specify single keyrings > > to debootstrap since we might need a mixture of several keyrings > > as per default and would have to find all needed keyrings on the > > system, export their keys and reimport into the build keyring, which > > is more complicated and unneeded this way. > > > > Signed-off-by: Andreas Reichel > > --- > > meta/classes/isar-bootstrap-helper.bbclass | 1 + > > meta/classes/isar-image.bbclass | 1 + > > meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb | 2 +- > > meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 2 +- > > 4 files changed, 4 insertions(+), 2 deletions(-) > > > > diff --git a/meta/classes/isar-bootstrap-helper.bbclass > > b/meta/classes/isar-bootstrap-helper.bbclass index 26abf62..769cbef > > 100644 --- a/meta/classes/isar-bootstrap-helper.bbclass > > +++ b/meta/classes/isar-bootstrap-helper.bbclass > > @@ -22,6 +22,7 @@ HOST_DISTRO ?= "debian-stretch" > > HOST_ARCH ?= "${@get_deb_host_arch()}" > > > > HOST_DISTRO_APT_SOURCES += "conf/distro/${HOST_DISTRO}.list" > > +ISARKEYRING = "/etc/apt/trusted.gpg.d/isar.gpg" > > > > def reverse_bb_array(d, varname): > > array = d.getVar(varname, True) > > diff --git a/meta/classes/isar-image.bbclass > > b/meta/classes/isar-image.bbclass index cdd1651..4a89bd7 100644 > > --- a/meta/classes/isar-image.bbclass > > +++ b/meta/classes/isar-image.bbclass > > @@ -82,6 +82,7 @@ isar_image_cleanup() { > > fi > > rm -f "${IMAGE_ROOTFS}/etc/apt/sources-list" > > ' > > + sudo rm -f "${ISARKEYRING}" > > } > > > > do_rootfs() { > > diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb index > > a793585..b70d2a8 100644 --- > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb +++ > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb @@ -11,8 > > +11,8 @@ WORKDIR = > > "${TMPDIR}/work/${DISTRO}-${DISTRO_ARCH}/${PN}-${HOST_DISTRO}-${HOST_A > > DEPLOY_ISAR_BOOTSTRAP = > > "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}" > > ISAR_BOOTSTRAP_LOCK = > > "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}.lock" -require > > isar-bootstrap.inc inherit isar-bootstrap-helper +require > > isar-bootstrap.inc do_generate_keyring[stamp-extra-info] = > > "${DISTRO}-${DISTRO_ARCH}" > > diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index > > 2ef3b1e..4613732 100644 --- > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++ > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -179,7 > > +179,7 @@ do_generate_keyring() { chmod 777 "${APTKEYTMPDIR}" > > for keyfile in ${@d.getVar("APTKEYFILES", True)}; do > > cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename "$keyfile")" > > - sudo apt-key add "$keyfile" > > + sudo apt-key --keyring "${ISARKEYRING}" add "$keyfile" > > done > > fi > > } > -- Andreas Reichel Dipl.-Phys. (Univ.) Software Consultant Andreas.Reichel@tngtech.com, +49-174-3180074 TNG Technology Consulting GmbH, Betastr. 13a, 85774 Unterfoehring Geschaeftsfuehrer: Henrik Klagges, Dr. Robert Dahlke, Gerhard Mueller Sitz: Unterfoehring * Amtsgericht Muenchen * HRB 135082