Re: [PATCH v3 4/6] Use apt-key to generate apt-keyring

[Henning Schild <henning.schild@siemens.com>]

Am Wed, 6 Mar 2019 17:26:16 +0100
schrieb "[ext] Andreas J. Reichel" <andreas.reichel.ext@siemens.com>:

> From: Andreas Reichel <andreas.reichel.ext@siemens.com>
> 
> Use apt-key instead of manually calling gpg.
> 
> Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
> ---
>  meta/classes/isar-bootstrap-helper.bbclass        | 12 ++++++++++++
>  meta/classes/isar-image.bbclass                   |  1 +
>  .../isar-bootstrap/isar-bootstrap-host.bb         |  2 +-
>  .../isar-bootstrap/isar-bootstrap.inc             | 15
> +++++++-------- 4 files changed, 21 insertions(+), 9 deletions(-)
> 
> diff --git a/meta/classes/isar-bootstrap-helper.bbclass
> b/meta/classes/isar-bootstrap-helper.bbclass index d780b85..1f24037
> 100644 --- a/meta/classes/isar-bootstrap-helper.bbclass
> +++ b/meta/classes/isar-bootstrap-helper.bbclass
> @@ -22,6 +22,7 @@ HOST_DISTRO ?= "debian-stretch"
>  HOST_ARCH ?= "${@get_deb_host_arch()}"
>  
>  HOST_DISTRO_APT_SOURCES += "conf/distro/${HOST_DISTRO}.list"
> +ISARKEYRING = "/etc/apt/trusted.gpg.d/isar.gpg"
>  
>  def reverse_bb_array(d, varname):
>      array = d.getVar(varname, True)
> @@ -119,6 +120,16 @@ setup_root_file_system() {
>      export LANG=C
>      export LANGUAGE=C
>      export LC_ALL=C
> +
> +    if [ -d ${TMPDIR}/aptkeys ]; then
> +        for keyfile in ${TMPDIR}/aptkeys/*
> +        do
> +            kfn="$(basename $keyfile)"
> +            cp $keyfile "$ROOTFSDIR/tmp/$kfn"
> +            sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key add
> "/tmp/$kfn"
> +            rm "$ROOTFSDIR/tmp/$kfn"
> +        done
> +    fi
>      sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update \
>          -o Dir::Etc::sourcelist="sources.list.d/isar-apt.list" \
>          -o Dir::Etc::sourceparts="-" \
> @@ -128,6 +139,7 @@ setup_root_file_system() {
>          sudo -E chroot "$ROOTFSDIR" /usr/bin/dpkg --add-architecture
> ${DISTRO_ARCH} sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update
>      fi
> +    sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key update
>      sudo -E chroot "$ROOTFSDIR" \
>          /usr/bin/apt-get ${APT_ARGS} --download-only $PACKAGES \
>              ${IMAGE_TRANSIENT_PACKAGES}
> diff --git a/meta/classes/isar-image.bbclass
> b/meta/classes/isar-image.bbclass index cdd1651..4a89bd7 100644
> --- a/meta/classes/isar-image.bbclass
> +++ b/meta/classes/isar-image.bbclass
> @@ -82,6 +82,7 @@ isar_image_cleanup() {
>          fi
>          rm -f "${IMAGE_ROOTFS}/etc/apt/sources-list"
>      '
> +    sudo rm -f "${ISARKEYRING}"
>  }
>  
>  do_rootfs() {
> diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb index
> a793585..b70d2a8 100644 ---
> a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb +++
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb @@ -11,8
> +11,8 @@ WORKDIR =
> "${TMPDIR}/work/${DISTRO}-${DISTRO_ARCH}/${PN}-${HOST_DISTRO}-${HOST_A
> DEPLOY_ISAR_BOOTSTRAP =
> "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}"
> ISAR_BOOTSTRAP_LOCK =
> "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}.lock" -require
> isar-bootstrap.inc inherit isar-bootstrap-helper +require
> isar-bootstrap.inc do_generate_keyring[stamp-extra-info] =
> "${DISTRO}-${DISTRO_ARCH}" 
> diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index
> 98c5c6b..8002a53 100644 ---
> a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -23,10 +23,8
> @@ APTSRCS = "${WORKDIR}/apt-sources" APTSRCS_INIT =
> "${WORKDIR}/apt-sources-init" BASEAPTSRCS =
> "${WORKDIR}/base-apt-sources" APTKEYFILES = ""
> -APTKEYRING = "${WORKDIR}/apt-keyring.gpg"
> -DEBOOTSTRAP_KEYRING = ""
>  DEPLOY_ISAR_BOOTSTRAP ?= ""
> -DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales"
> +DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales gnupg2"

When i talked about the OVERRIDES i meant also adding gnupg2 depending
on a condition. And that condition would probably be, if
DISTRO_APT_KEYS is non-empty.

DISTRO_APT_KEYS != "" && OVERRIDES += "gnupg-support"
DISTRO_BOOTSTRAP_BASE_PACKAGES_append_gnupg-support = " gnupg2"
 
>  DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org
> file:///${REPO_BASE_DIR} \n" if
> bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) else "" }"
> @@ -43,7 +41,6 @@ python () { if own_pub_key:
>              aptkeys += own_pub_key.split()
>  
> -    d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
>      for key in aptkeys:
>          d.appendVar("SRC_URI", " %s" % key)
>          fetcher = bb.fetch2.Fetch([key], d)
> @@ -171,13 +168,17 @@ def get_distro_components_argument(d, is_host):
>      else:
>          return ""
>  
> +APTKEYTMPDIR := "${TMPDIR}/aptkeys"
> +
> +do_generate_keyring[cleandirs] = "${APTKEYTMPDIR}"
>  do_generate_keyring[dirs] = "${DL_DIR}"
>  do_generate_keyring[vardeps] += "DISTRO_APT_KEYS"
>  do_generate_keyring() {
>      if [ -n "${@d.getVar("APTKEYFILES", True) or ""}" ]; then
> +        chmod 777 "${APTKEYTMPDIR}"
>          for keyfile in ${@d.getVar("APTKEYFILES", True)}; do
> -           gpg --no-default-keyring --keyring "${APTKEYRING}" \
> -               --no-tty --homedir "${DL_DIR}"  --import "$keyfile"
> +           cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename "$keyfile")"
> +           sudo apt-key --keyring "${ISARKEYRING}" add "$keyfile"

This whole switching from gpg to "sudo chroot apt-key" would make a
nice stand-alone patch, but i do not feel strong about that.

Henning

>          done
>      fi
>  }
> @@ -219,7 +220,6 @@ isar_bootstrap() {
>              if [ ${IS_HOST} ]; then
>                  ${DEBOOTSTRAP} $debootstrap_args \
>                                 ${@get_distro_components_argument(d,
> True)} \
> -                               ${DEBOOTSTRAP_KEYRING} \
>                                 "${@get_distro_suite(d, True)}" \
>                                 "${ROOTFSDIR}" \
>                                 "${@get_distro_source(d, True)}"
> @@ -228,7 +228,6 @@ isar_bootstrap() {
>                   "${DEBOOTSTRAP}" $debootstrap_args \
>                                    --arch="${DISTRO_ARCH}" \
>                                    ${@get_distro_components_argument(d,
> False)} \
> -                                  ${DEBOOTSTRAP_KEYRING} \
>                                    "${@get_distro_suite(d, False)}" \
>                                    "${ROOTFSDIR}" \
>                                    "${@get_distro_source(d, False)}"