From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6665315485614080000 X-Received: by 2002:a5d:638b:: with SMTP id p11mr328979wru.6.1551893593802; Wed, 06 Mar 2019 09:33:13 -0800 (PST) X-BeenThere: isar-users@googlegroups.com Received: by 2002:adf:fe47:: with SMTP id m7ls608063wrs.0.gmail; Wed, 06 Mar 2019 09:33:13 -0800 (PST) X-Google-Smtp-Source: APXvYqz217kSyjcxFGajP6RDC+M3E8LSgeq+xUmKd0eb58VmThjaTAF9mFhkRoezimljAAplc21Z X-Received: by 2002:a5d:638b:: with SMTP id p11mr328976wru.6.1551893593340; Wed, 06 Mar 2019 09:33:13 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1551893593; cv=none; d=google.com; s=arc-20160816; b=P6xKqAJ4qJrIaX4M8RxXrFm1QunOTm4Xc6TNK1BkUPmnkmCShyIgD16OrdNjRiP//Y rfZP2M9o1GYjejkyurjO7BH257zz0W9jm/fRa/8SmagQQKzI9tLEjVYuPxSa8PZ8jw6w HRMizMoU3TY81AMChbuJs2yOfsR9cVsLWk15AN2BqbTTrTVbSuarRRbQGkfXHmqjdDWH SXXM2dBlK4Gk9vbNnzkIjhs3LV9m/tFwx26ikuIqf2dqocb6fA7uuA331dO8bbVbQwII DWQupVWuomKWde/Q0b+aqrF9c8afvRaul8HB1AykXMjbwaJcpdf+u2Yedkmzgk6cFUZS 3ILw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date; bh=2T7ucFArShI+R6ayo0PIhCSvB4+i6tDm/xO/DwUs3ew=; b=pvAZwb7fg0nBIyouTzBPHQ4uWXpkjQPkoe0Ttkmx1zHvHOorTtqsw5+dBcW+CdGAuN zC+P+t5GhNC51SsyCUAWqjLHttf9T3a09hFs2ypfrP8bBE41cbuxfjcR0p13nZlrztj7 egzHYFp8G6lNmcMyK3kSaS8OtGDR2Nd/s7nbAlr5AmY7uoa1cJHKtbIuam/Ujvn6dGff 9DQv8h3DoUIX8d4p8/WXYnRgFTDher8b0l+YpVo/XHPKGxM0mW3NQUQnm7bHdCTo0JJZ tMym/tD+G0IoPv8JN7H1E48dde2Z4M1aQZdckvfOy+kTFCKbhH/hAiHcRvAs1MXsefuX 6HdQ== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.28 as permitted sender) smtp.mailfrom=henning.schild@siemens.com Return-Path: Received: from goliath.siemens.de (goliath.siemens.de. [192.35.17.28]) by gmr-mx.google.com with ESMTPS id o184si92463wma.0.2019.03.06.09.33.13 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 06 Mar 2019 09:33:13 -0800 (PST) Received-SPF: pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.28 as permitted sender) client-ip=192.35.17.28; Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.28 as permitted sender) smtp.mailfrom=henning.schild@siemens.com Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by goliath.siemens.de (8.15.2/8.15.2) with ESMTPS id x26HXCuc016023 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Wed, 6 Mar 2019 18:33:13 +0100 Received: from md1za8fc.ad001.siemens.net ([139.25.69.211]) by mail1.sbs.de (8.15.2/8.15.2) with ESMTP id x26HXCvx032007; Wed, 6 Mar 2019 18:33:12 +0100 Date: Wed, 6 Mar 2019 18:33:12 +0100 From: Henning Schild To: "[ext] Andreas J. Reichel" Cc: Subject: Re: [PATCH v3 4/6] Use apt-key to generate apt-keyring Message-ID: <20190306183312.644b9069@md1za8fc.ad001.siemens.net> In-Reply-To: <20190306162619.826-5-andreas.reichel.ext@siemens.com> References: <20190306162619.826-1-andreas.reichel.ext@siemens.com> <20190306162619.826-5-andreas.reichel.ext@siemens.com> X-Mailer: Claws Mail 3.17.3 (GTK+ 2.24.32; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-TUID: VDTKVoGsmA2X Am Wed, 6 Mar 2019 17:26:16 +0100 schrieb "[ext] Andreas J. Reichel" : > From: Andreas Reichel > > Use apt-key instead of manually calling gpg. > > Signed-off-by: Andreas Reichel > --- > meta/classes/isar-bootstrap-helper.bbclass | 12 ++++++++++++ > meta/classes/isar-image.bbclass | 1 + > .../isar-bootstrap/isar-bootstrap-host.bb | 2 +- > .../isar-bootstrap/isar-bootstrap.inc | 15 > +++++++-------- 4 files changed, 21 insertions(+), 9 deletions(-) > > diff --git a/meta/classes/isar-bootstrap-helper.bbclass > b/meta/classes/isar-bootstrap-helper.bbclass index d780b85..1f24037 > 100644 --- a/meta/classes/isar-bootstrap-helper.bbclass > +++ b/meta/classes/isar-bootstrap-helper.bbclass > @@ -22,6 +22,7 @@ HOST_DISTRO ?= "debian-stretch" > HOST_ARCH ?= "${@get_deb_host_arch()}" > > HOST_DISTRO_APT_SOURCES += "conf/distro/${HOST_DISTRO}.list" > +ISARKEYRING = "/etc/apt/trusted.gpg.d/isar.gpg" > > def reverse_bb_array(d, varname): > array = d.getVar(varname, True) > @@ -119,6 +120,16 @@ setup_root_file_system() { > export LANG=C > export LANGUAGE=C > export LC_ALL=C > + > + if [ -d ${TMPDIR}/aptkeys ]; then > + for keyfile in ${TMPDIR}/aptkeys/* > + do > + kfn="$(basename $keyfile)" > + cp $keyfile "$ROOTFSDIR/tmp/$kfn" > + sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key add > "/tmp/$kfn" > + rm "$ROOTFSDIR/tmp/$kfn" > + done > + fi > sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update \ > -o Dir::Etc::sourcelist="sources.list.d/isar-apt.list" \ > -o Dir::Etc::sourceparts="-" \ > @@ -128,6 +139,7 @@ setup_root_file_system() { > sudo -E chroot "$ROOTFSDIR" /usr/bin/dpkg --add-architecture > ${DISTRO_ARCH} sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update > fi > + sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key update > sudo -E chroot "$ROOTFSDIR" \ > /usr/bin/apt-get ${APT_ARGS} --download-only $PACKAGES \ > ${IMAGE_TRANSIENT_PACKAGES} > diff --git a/meta/classes/isar-image.bbclass > b/meta/classes/isar-image.bbclass index cdd1651..4a89bd7 100644 > --- a/meta/classes/isar-image.bbclass > +++ b/meta/classes/isar-image.bbclass > @@ -82,6 +82,7 @@ isar_image_cleanup() { > fi > rm -f "${IMAGE_ROOTFS}/etc/apt/sources-list" > ' > + sudo rm -f "${ISARKEYRING}" > } > > do_rootfs() { > diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb > b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb index > a793585..b70d2a8 100644 --- > a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb +++ > b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb @@ -11,8 > +11,8 @@ WORKDIR = > "${TMPDIR}/work/${DISTRO}-${DISTRO_ARCH}/${PN}-${HOST_DISTRO}-${HOST_A > DEPLOY_ISAR_BOOTSTRAP = > "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}" > ISAR_BOOTSTRAP_LOCK = > "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}.lock" -require > isar-bootstrap.inc inherit isar-bootstrap-helper +require > isar-bootstrap.inc do_generate_keyring[stamp-extra-info] = > "${DISTRO}-${DISTRO_ARCH}" > diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index > 98c5c6b..8002a53 100644 --- > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++ > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -23,10 +23,8 > @@ APTSRCS = "${WORKDIR}/apt-sources" APTSRCS_INIT = > "${WORKDIR}/apt-sources-init" BASEAPTSRCS = > "${WORKDIR}/base-apt-sources" APTKEYFILES = "" > -APTKEYRING = "${WORKDIR}/apt-keyring.gpg" > -DEBOOTSTRAP_KEYRING = "" > DEPLOY_ISAR_BOOTSTRAP ?= "" > -DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales" > +DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales gnupg2" When i talked about the OVERRIDES i meant also adding gnupg2 depending on a condition. And that condition would probably be, if DISTRO_APT_KEYS is non-empty. DISTRO_APT_KEYS != "" && OVERRIDES += "gnupg-support" DISTRO_BOOTSTRAP_BASE_PACKAGES_append_gnupg-support = " gnupg2" > DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org > file:///${REPO_BASE_DIR} \n" if > bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) else "" }" > @@ -43,7 +41,6 @@ python () { if own_pub_key: > aptkeys += own_pub_key.split() > > - d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}") > for key in aptkeys: > d.appendVar("SRC_URI", " %s" % key) > fetcher = bb.fetch2.Fetch([key], d) > @@ -171,13 +168,17 @@ def get_distro_components_argument(d, is_host): > else: > return "" > > +APTKEYTMPDIR := "${TMPDIR}/aptkeys" > + > +do_generate_keyring[cleandirs] = "${APTKEYTMPDIR}" > do_generate_keyring[dirs] = "${DL_DIR}" > do_generate_keyring[vardeps] += "DISTRO_APT_KEYS" > do_generate_keyring() { > if [ -n "${@d.getVar("APTKEYFILES", True) or ""}" ]; then > + chmod 777 "${APTKEYTMPDIR}" > for keyfile in ${@d.getVar("APTKEYFILES", True)}; do > - gpg --no-default-keyring --keyring "${APTKEYRING}" \ > - --no-tty --homedir "${DL_DIR}" --import "$keyfile" > + cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename "$keyfile")" > + sudo apt-key --keyring "${ISARKEYRING}" add "$keyfile" This whole switching from gpg to "sudo chroot apt-key" would make a nice stand-alone patch, but i do not feel strong about that. Henning > done > fi > } > @@ -219,7 +220,6 @@ isar_bootstrap() { > if [ ${IS_HOST} ]; then > ${DEBOOTSTRAP} $debootstrap_args \ > ${@get_distro_components_argument(d, > True)} \ > - ${DEBOOTSTRAP_KEYRING} \ > "${@get_distro_suite(d, True)}" \ > "${ROOTFSDIR}" \ > "${@get_distro_source(d, True)}" > @@ -228,7 +228,6 @@ isar_bootstrap() { > "${DEBOOTSTRAP}" $debootstrap_args \ > --arch="${DISTRO_ARCH}" \ > ${@get_distro_components_argument(d, > False)} \ > - ${DEBOOTSTRAP_KEYRING} \ > "${@get_distro_suite(d, False)}" \ > "${ROOTFSDIR}" \ > "${@get_distro_source(d, False)}"