From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6665315485307895808 X-Received: by 2002:adf:8121:: with SMTP id 30mr616848wrm.22.1551966077850; Thu, 07 Mar 2019 05:41:17 -0800 (PST) X-BeenThere: isar-users@googlegroups.com Received: by 2002:a1c:67c4:: with SMTP id b187ls59281wmc.5.canary-gmail; Thu, 07 Mar 2019 05:41:17 -0800 (PST) X-Google-Smtp-Source: APXvYqxrrscAjYueKhWv65hqEbXGeAoWl59yLg/LEi4eTqq0zmjbSVzb+B93xCPOrRNs/lxmH3ez X-Received: by 2002:a1c:6c15:: with SMTP id h21mr994512wmc.10.1551966077399; Thu, 07 Mar 2019 05:41:17 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1551966077; cv=none; d=google.com; s=arc-20160816; b=aC1uvb9PaMyLUysptNOd8BaXCo8xhu6/nIAsQnNbiRHYkcCLvurNt5BNLR8MqlQSq9 jWRWi+rt4ahW7XPenljVpykhDH4IbIY2dJbAFBOd6hKm4oeFfsPO8waSMd+uPE9uDUN5 CFgNuPl0pKtEzCYnnFj+ApJJvX3lglhh62Ymbc0qCZiBnHWU6ljs5qY3rtNiOHP49uCg bAVsmNOonmVtHO0aXEg7kaRCOIxqIWEWwyAAR7s0+bnmwREdsvih5/cwF+fu48fHUxaq XIviLVWWj6ftzk8GiPaXwzXHXLuLJVNicfhWta2s11FC2QdlirE892moba5bwPvtMnSx ujVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date; bh=RHCnUcsgmur0/nAmjPM6Wp0GVmUSIDtiiibcjX+k1gk=; b=wnjx6mYp6NMQH+AYCqgPdoDy369sQw97WyzNJY/iWdCGOwTsYQqefwUqW9JPQqrp7c hWcWPvlohD3eLWQd7D8Zn0swUKONbFg/U65sC4hiujE9sW+/Ag9Ie9IfROwXY0FJCN69 Y9He2ddEN65VNPwCbdcEyhIoDM6IfCf26ZZu5eQX9++E48vVniEfwteBx6hFWfrF69ya ueg2N8VdSwUgtzxGfU8kP9i/0sLAiWLymYfHdFTpgAHyzFsoUXe6XELAH/qvsyP7UPNc s+ifkGr1oGOlXjz8HC1BZ+E6z9zR2WDa3xiO4VFUCSjn/kgCR2JbcS8GMEHi02oCWDSE dUCQ== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.2 as permitted sender) smtp.mailfrom=henning.schild@siemens.com Return-Path: Received: from thoth.sbs.de (thoth.sbs.de. [192.35.17.2]) by gmr-mx.google.com with ESMTPS id m1si289615wrj.4.2019.03.07.05.41.17 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 07 Mar 2019 05:41:17 -0800 (PST) Received-SPF: pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.2 as permitted sender) client-ip=192.35.17.2; Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.2 as permitted sender) smtp.mailfrom=henning.schild@siemens.com Received: from mail2.sbs.de (mail2.sbs.de [192.129.41.66]) by thoth.sbs.de (8.15.2/8.15.2) with ESMTPS id x27DfHZ6009283 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 7 Mar 2019 14:41:17 +0100 Received: from md1za8fc.ad001.siemens.net ([139.25.69.211]) by mail2.sbs.de (8.15.2/8.15.2) with ESMTP id x27DfGS5014427; Thu, 7 Mar 2019 14:41:16 +0100 Date: Thu, 7 Mar 2019 14:41:16 +0100 From: Henning Schild To: Andreas Reichel Cc: Subject: Re: [PATCH v3 6/6] If we use a custom keyring debootstrap may fall to https Message-ID: <20190307144116.7a687d08@md1za8fc.ad001.siemens.net> In-Reply-To: <20190307091438.GB10773@iiotirae> References: <20190306162619.826-1-andreas.reichel.ext@siemens.com> <20190306162619.826-7-andreas.reichel.ext@siemens.com> <20190306184311.0ffb1069@md1za8fc.ad001.siemens.net> <20190307091438.GB10773@iiotirae> X-Mailer: Claws Mail 3.17.3 (GTK+ 2.24.32; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-TUID: YT7yvHJEuDME Am Thu, 7 Mar 2019 10:14:39 +0100 schrieb Andreas Reichel : > On Wed, Mar 06, 2019 at 06:43:11PM +0100, Henning Schild wrote: > > Am Wed, 6 Mar 2019 17:26:18 +0100 > > schrieb "[ext] Andreas J. Reichel" > > : > > > From: Andreas Reichel > > > > > > See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891009 > > > > > > So if we have something in aptkeyring, append https-support to > > > OVERRIDES. > > > > > > Furthermore, the conditional append for https-support was missing > > > in qemuamd64-stretch.conf, thus, remove this from all the distros > > > and put it into the isar-bootstrap.inc. > > > > > > Signed-off-by: Andreas Reichel > > > --- > > > meta-isar/conf/multiconfig/qemuamd64-buster.conf | 1 - > > > meta-isar/conf/multiconfig/qemuamd64-jessie.conf | 1 - > > > meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 11 > > > +++++++++++ 3 files changed, 11 insertions(+), 2 deletions(-) > > > > > > diff --git a/meta-isar/conf/multiconfig/qemuamd64-buster.conf > > > b/meta-isar/conf/multiconfig/qemuamd64-buster.conf index > > > 63df75c..da90993 100644 --- > > > a/meta-isar/conf/multiconfig/qemuamd64-buster.conf +++ > > > b/meta-isar/conf/multiconfig/qemuamd64-buster.conf @@ -18,4 +18,3 > > > @@ QEMU_MACHINE ?= "q35" QEMU_CPU ?= "" > > > QEMU_DISK_ARGS ?= "-hda ##ROOTFS_IMAGE## > > > -bios /usr/local/share/ovmf/OVMF.fd" > > > -DISTRO_BOOTSTRAP_BASE_PACKAGES_append_https-support = " > > > apt-transport-https ca-certificates" diff --git > > > a/meta-isar/conf/multiconfig/qemuamd64-jessie.conf > > > b/meta-isar/conf/multiconfig/qemuamd64-jessie.conf index > > > d1335ff..42c71df 100644 --- > > > a/meta-isar/conf/multiconfig/qemuamd64-jessie.conf +++ > > > b/meta-isar/conf/multiconfig/qemuamd64-jessie.conf @@ -15,4 +15,3 > > > @@ QEMU_MACHINE ?= "pc" QEMU_CPU ?= "" QEMU_DISK_ARGS ?= "-hda > > > ##ROOTFS_IMAGE##" > > > -DISTRO_BOOTSTRAP_BASE_PACKAGES_append_https-support = " > > > apt-transport-https ca-certificates" diff --git > > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc > > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index > > > 8002a53..64cefc6 100644 --- > > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++ > > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -25,6 > > > +25,7 @@ BASEAPTSRCS = "${WORKDIR}/base-apt-sources" APTKEYFILES > > > = "" DEPLOY_ISAR_BOOTSTRAP ?= "" DISTRO_BOOTSTRAP_BASE_PACKAGES = > > > "locales gnupg2" > > > +DISTRO_BOOTSTRAP_BASE_PACKAGES_append_https-support = " > > > apt-transport-https ca-certificates" DISTRO_APT_PREMIRRORS ?= > > > "${@ "http://ftp\.(\S+\.)?debian.org file:///${REPO_BASE_DIR} \n" > > > if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) > > > else "" }" @@ -41,6 +42,12 @@ python () { if own_pub_key: > > > aptkeys += own_pub_key.split() > > > > > > + if len(aptkeys) > 0: > > > + # debootstrap falls back to https if there is no > > > + # 'reliable' keyring, whatever that means, but it > > > happened > > > + # > > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891009 > > > + d.setVar("HAVE_CUSTOM_APT_KEYS", "True") > > > > Why this indirection and the new variable? Can you not just check > > len(aptkeys) where you check HAVE_CUSTOM_APT_KEYS? > Because aptkeys is a local variable. And we don't want that to be > global. > > > > > In fact you probably want to look at DISTRO_APT_KEYS, which seems > > to be the source feeding all the other variables. Whatever you come > > up with in v3 4/6. > Not quite, becase we have DISTRO_APT_KEYS as well as BASE_REPO_KEY. > Both can contain several keys and feed aptkeys. (That's why I > introduced aptkeys, to remove the duplicate code in the keyring > generation.) > > > > > for key in aptkeys: > > > d.appendVar("SRC_URI", " %s" % key) > > > fetcher = bb.fetch2.Fetch([key], d) > > > @@ -150,6 +157,10 @@ def get_distro_have_https_source(d, > > > is_host=False): return any(source[2].startswith("https://") for > > > source in generate_distro_sources(d, is_host)) > > > def get_distro_needs_https_support(d, is_host=False): > > > + apt_keys = d.getVar("HAVE_CUSTOM_APT_KEYS", False) > > > + if apt_keys: > > > + return "https-support" > > > + > > > > Reusing the OVERRIDE seems like a good idea to avoid double adding > > the packages. So gnupg implies https but does not add the packages > > again. But i think i would do something like > > > > get_gnupg_overrides() > > ret = "gnupg" > > # blabla bug > > ret += " https-support" > > > Sure. That makes sense, but I would like to keep the https-support > part in the other function, because that is there to tell all cases > where the image needs https-support, no matter wether apt-keys or > https sources... > > Gnupg then should go into a new function analog to the other one like > 'get_distro_needs_gnupg_support' to enable a new gnupg OVERRIDE> Maybe one get_distro_overrides that just deals with the two cases we currently have? Maybe keeping in mind that i.e the packages that wic-img needs should maybe be an override as well. Henning > Andreas > > Henning > > > > > if get_distro_have_https_source(d, is_host): > > > return "https-support" > > > else: > > >