Re: [PATCH v3 4/6] Use apt-key to generate apt-keyring

[Henning Schild <henning.schild@siemens.com>]

Am Thu, 7 Mar 2019 10:06:17 +0100
schrieb Andreas Reichel <andreas.reichel.ext@siemens.com>:

> On Wed, Mar 06, 2019 at 06:33:12PM +0100, Henning Schild wrote:
> > Am Wed, 6 Mar 2019 17:26:16 +0100
> > schrieb "[ext] Andreas J. Reichel"
> > <andreas.reichel.ext@siemens.com>: 
> > > From: Andreas Reichel <andreas.reichel.ext@siemens.com>
> > > 
> > > Use apt-key instead of manually calling gpg.
> > > 
> > > Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
> > > ---
> > >  meta/classes/isar-bootstrap-helper.bbclass        | 12
> > > ++++++++++++ meta/classes/isar-image.bbclass                   |
> > > 1 + .../isar-bootstrap/isar-bootstrap-host.bb         |  2 +-
> > >  .../isar-bootstrap/isar-bootstrap.inc             | 15
> > > +++++++-------- 4 files changed, 21 insertions(+), 9 deletions(-)
> > > 
> > > diff --git a/meta/classes/isar-bootstrap-helper.bbclass
> > > b/meta/classes/isar-bootstrap-helper.bbclass index
> > > d780b85..1f24037 100644 ---
> > > a/meta/classes/isar-bootstrap-helper.bbclass +++
> > > b/meta/classes/isar-bootstrap-helper.bbclass @@ -22,6 +22,7 @@
> > > HOST_DISTRO ?= "debian-stretch" HOST_ARCH ?=
> > > "${@get_deb_host_arch()}" 
> > >  HOST_DISTRO_APT_SOURCES += "conf/distro/${HOST_DISTRO}.list"
> > > +ISARKEYRING = "/etc/apt/trusted.gpg.d/isar.gpg"
> > >  
> > >  def reverse_bb_array(d, varname):
> > >      array = d.getVar(varname, True)
> > > @@ -119,6 +120,16 @@ setup_root_file_system() {
> > >      export LANG=C
> > >      export LANGUAGE=C
> > >      export LC_ALL=C
> > > +
> > > +    if [ -d ${TMPDIR}/aptkeys ]; then
> > > +        for keyfile in ${TMPDIR}/aptkeys/*
> > > +        do
> > > +            kfn="$(basename $keyfile)"
> > > +            cp $keyfile "$ROOTFSDIR/tmp/$kfn"
> > > +            sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key add
> > > "/tmp/$kfn"
> > > +            rm "$ROOTFSDIR/tmp/$kfn"
> > > +        done
> > > +    fi
> > >      sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update \
> > >          -o Dir::Etc::sourcelist="sources.list.d/isar-apt.list" \
> > >          -o Dir::Etc::sourceparts="-" \
> > > @@ -128,6 +139,7 @@ setup_root_file_system() {
> > >          sudo -E chroot "$ROOTFSDIR" /usr/bin/dpkg
> > > --add-architecture ${DISTRO_ARCH} sudo -E chroot
> > > "$ROOTFSDIR" /usr/bin/apt-get update fi
> > > +    sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key update
> > >      sudo -E chroot "$ROOTFSDIR" \
> > >          /usr/bin/apt-get ${APT_ARGS} --download-only $PACKAGES \
> > >              ${IMAGE_TRANSIENT_PACKAGES}
> > > diff --git a/meta/classes/isar-image.bbclass
> > > b/meta/classes/isar-image.bbclass index cdd1651..4a89bd7 100644
> > > --- a/meta/classes/isar-image.bbclass
> > > +++ b/meta/classes/isar-image.bbclass
> > > @@ -82,6 +82,7 @@ isar_image_cleanup() {
> > >          fi
> > >          rm -f "${IMAGE_ROOTFS}/etc/apt/sources-list"
> > >      '
> > > +    sudo rm -f "${ISARKEYRING}"
> > >  }
> > >  
> > >  do_rootfs() {
> > > diff --git
> > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb
> > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb index
> > > a793585..b70d2a8 100644 ---
> > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb +++
> > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb @@
> > > -11,8 +11,8 @@ WORKDIR =
> > > "${TMPDIR}/work/${DISTRO}-${DISTRO_ARCH}/${PN}-${HOST_DISTRO}-${HOST_A
> > > DEPLOY_ISAR_BOOTSTRAP =
> > > "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}"
> > > ISAR_BOOTSTRAP_LOCK =
> > > "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}.lock"
> > > -require isar-bootstrap.inc inherit isar-bootstrap-helper
> > > +require isar-bootstrap.inc do_generate_keyring[stamp-extra-info]
> > > = "${DISTRO}-${DISTRO_ARCH}" diff --git
> > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index
> > > 98c5c6b..8002a53 100644 ---
> > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++
> > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -23,10
> > > +23,8 @@ APTSRCS = "${WORKDIR}/apt-sources" APTSRCS_INIT =
> > > "${WORKDIR}/apt-sources-init" BASEAPTSRCS =
> > > "${WORKDIR}/base-apt-sources" APTKEYFILES = "" -APTKEYRING =
> > > "${WORKDIR}/apt-keyring.gpg" -DEBOOTSTRAP_KEYRING = ""
> > >  DEPLOY_ISAR_BOOTSTRAP ?= ""
> > > -DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales"
> > > +DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales gnupg2"  
> > 
> > When i talked about the OVERRIDES i meant also adding gnupg2
> > depending on a condition. And that condition would probably be, if
> > DISTRO_APT_KEYS is non-empty.
> >   
> Pardon, my fault...
> 
> 
> > DISTRO_APT_KEYS != "" && OVERRIDES += "gnupg-support"
> > DISTRO_BOOTSTRAP_BASE_PACKAGES_append_gnupg-support = " gnupg2"
> >    
> > >  DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org
> > > file:///${REPO_BASE_DIR} \n" if
> > > bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) else
> > > "" }" @@ -43,7 +41,6 @@ python () { if own_pub_key:
> > >              aptkeys += own_pub_key.split()
> > >  
> > > -    d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
> > >      for key in aptkeys:
> > >          d.appendVar("SRC_URI", " %s" % key)
> > >          fetcher = bb.fetch2.Fetch([key], d)
> > > @@ -171,13 +168,17 @@ def get_distro_components_argument(d,
> > > is_host): else:
> > >          return ""
> > >  
> > > +APTKEYTMPDIR := "${TMPDIR}/aptkeys"
> > > +
> > > +do_generate_keyring[cleandirs] = "${APTKEYTMPDIR}"
> > >  do_generate_keyring[dirs] = "${DL_DIR}"
> > >  do_generate_keyring[vardeps] += "DISTRO_APT_KEYS"
> > >  do_generate_keyring() {
> > >      if [ -n "${@d.getVar("APTKEYFILES", True) or ""}" ]; then
> > > +        chmod 777 "${APTKEYTMPDIR}"
> > >          for keyfile in ${@d.getVar("APTKEYFILES", True)}; do
> > > -           gpg --no-default-keyring --keyring "${APTKEYRING}" \
> > > -               --no-tty --homedir "${DL_DIR}"  --import
> > > "$keyfile"
> > > +           cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename
> > > "$keyfile")"
> > > +           sudo apt-key --keyring "${ISARKEYRING}" add
> > > "$keyfile"  
> > 
> > This whole switching from gpg to "sudo chroot apt-key" would make a
> > nice stand-alone patch, but i do not feel strong about that.
> >   
> I argue against that because I have a use case where I need all of
> this. And I don't like small patches wandering around the mailing
> lists without being merged.

Well one in the same queue/series of cause, which would express the
order/need while being small and focused.

Henning

> Andreas
> > Henning
> >   
> > >          done
> > >      fi
> > >  }
> > > @@ -219,7 +220,6 @@ isar_bootstrap() {
> > >              if [ ${IS_HOST} ]; then
> > >                  ${DEBOOTSTRAP} $debootstrap_args \
> > >                                 ${@get_distro_components_argument(d,
> > > True)} \
> > > -                               ${DEBOOTSTRAP_KEYRING} \
> > >                                 "${@get_distro_suite(d, True)}" \
> > >                                 "${ROOTFSDIR}" \
> > >                                 "${@get_distro_source(d, True)}"
> > > @@ -228,7 +228,6 @@ isar_bootstrap() {
> > >                   "${DEBOOTSTRAP}" $debootstrap_args \
> > >                                    --arch="${DISTRO_ARCH}" \
> > >                                    ${@get_distro_components_argument(d,
> > > False)} \
> > > -                                  ${DEBOOTSTRAP_KEYRING} \
> > >                                    "${@get_distro_suite(d,
> > > False)}" \ "${ROOTFSDIR}" \
> > >                                    "${@get_distro_source(d,
> > > False)}"  
> >   
>