From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6665315485614080000 X-Received: by 2002:a7b:c40e:: with SMTP id k14mr1016149wmi.12.1551966218507; Thu, 07 Mar 2019 05:43:38 -0800 (PST) X-BeenThere: isar-users@googlegroups.com Received: by 2002:a1c:f107:: with SMTP id p7ls28704wmh.6.canary-gmail; Thu, 07 Mar 2019 05:43:38 -0800 (PST) X-Google-Smtp-Source: APXvYqw1xJUBZQ5RsjNLMNuTKnF5jhWFxRFWJzkredgyJDQfjK3boT6NCnZC/yp4VmrhClC5V6r5 X-Received: by 2002:a1c:a741:: with SMTP id q62mr1081752wme.7.1551966218076; Thu, 07 Mar 2019 05:43:38 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1551966218; cv=none; d=google.com; s=arc-20160816; b=YXlnjfzW4VQ0JnxKEJnj2qbdvcjYZurJbnS+dTyJMGUu09wQQdYXP9qZIL8H75V+2+ 2TNjg4K0VzoAKYi1+Yx/dVPk2yrMYBGNEfQlvNS+oJ9RysGm0+pHYfE/iHH6CecpBluS pvcJEx1lh9MB/iWa04RpGyIKpJkcyThFxAWYnx0L9gLeeSQFsBJMWhJ/UeX4P3VxUcB2 urD/pYaaz2dCTl8YUPATK6maHSBRoKhoMmj7YlD5FweC5xkFRzkmVE40UDo3GGLN68RE cD7//yAg+zQGuO0UtZ+Cow+pNCWTUqZnOvKXsW2XQ9dA/R+a2hY01777qGrKb1IR4Ar+ wT1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date; bh=OCWeh+9QDpLRSUUTFGX4QjErl2DCFCJ4JtOCcFF3Y5Q=; b=1HlvkpIqzJViuR6swB74uwOkA+XFtkr8/y/WcF7hhe/SQ3XoebGs4H+mG3QP8qRi3j CScVuvdrQoBQZiKE4WiOhR5TywM9pA47PaJlLgkqWHQv14gOcTN6UsUwM4p5haSkRjCt ssZZ10HwO/Tp7jzf8silTJ+Wso8G9EGdHjGCX8PR9JKvXAM81aoQHlQVHFK7ff2c8rCK xOUZutssab0zaMPAAB21KTcYO1zMfzSq6duJnLCOiCt9ilfjQCzEYtCHgKi3GpZg5NTc MkDA4aZMjVeup/DK7L/6GlJRGFsJRbi/tJcYIA9FGITgGKQc3/hAMPkEriasuMfMxPfc HI9A== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.14 as permitted sender) smtp.mailfrom=henning.schild@siemens.com Return-Path: Received: from david.siemens.de (david.siemens.de. [192.35.17.14]) by gmr-mx.google.com with ESMTPS id v189si179522wma.2.2019.03.07.05.43.37 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 07 Mar 2019 05:43:38 -0800 (PST) Received-SPF: pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.14 as permitted sender) client-ip=192.35.17.14; Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of henning.schild@siemens.com designates 192.35.17.14 as permitted sender) smtp.mailfrom=henning.schild@siemens.com Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by david.siemens.de (8.15.2/8.15.2) with ESMTPS id x27DhbZC015878 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 7 Mar 2019 14:43:37 +0100 Received: from md1za8fc.ad001.siemens.net ([139.25.69.211]) by mail1.sbs.de (8.15.2/8.15.2) with ESMTP id x27DhbL0021064; Thu, 7 Mar 2019 14:43:37 +0100 Date: Thu, 7 Mar 2019 14:43:36 +0100 From: Henning Schild To: Andreas Reichel Cc: Subject: Re: [PATCH v3 4/6] Use apt-key to generate apt-keyring Message-ID: <20190307144336.6080fbfa@md1za8fc.ad001.siemens.net> In-Reply-To: <20190307090616.GA10773@iiotirae> References: <20190306162619.826-1-andreas.reichel.ext@siemens.com> <20190306162619.826-5-andreas.reichel.ext@siemens.com> <20190306183312.644b9069@md1za8fc.ad001.siemens.net> <20190307090616.GA10773@iiotirae> X-Mailer: Claws Mail 3.17.3 (GTK+ 2.24.32; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-TUID: HI+fN8lG11NR Am Thu, 7 Mar 2019 10:06:17 +0100 schrieb Andreas Reichel : > On Wed, Mar 06, 2019 at 06:33:12PM +0100, Henning Schild wrote: > > Am Wed, 6 Mar 2019 17:26:16 +0100 > > schrieb "[ext] Andreas J. Reichel" > > : > > > From: Andreas Reichel > > > > > > Use apt-key instead of manually calling gpg. > > > > > > Signed-off-by: Andreas Reichel > > > --- > > > meta/classes/isar-bootstrap-helper.bbclass | 12 > > > ++++++++++++ meta/classes/isar-image.bbclass | > > > 1 + .../isar-bootstrap/isar-bootstrap-host.bb | 2 +- > > > .../isar-bootstrap/isar-bootstrap.inc | 15 > > > +++++++-------- 4 files changed, 21 insertions(+), 9 deletions(-) > > > > > > diff --git a/meta/classes/isar-bootstrap-helper.bbclass > > > b/meta/classes/isar-bootstrap-helper.bbclass index > > > d780b85..1f24037 100644 --- > > > a/meta/classes/isar-bootstrap-helper.bbclass +++ > > > b/meta/classes/isar-bootstrap-helper.bbclass @@ -22,6 +22,7 @@ > > > HOST_DISTRO ?= "debian-stretch" HOST_ARCH ?= > > > "${@get_deb_host_arch()}" > > > HOST_DISTRO_APT_SOURCES += "conf/distro/${HOST_DISTRO}.list" > > > +ISARKEYRING = "/etc/apt/trusted.gpg.d/isar.gpg" > > > > > > def reverse_bb_array(d, varname): > > > array = d.getVar(varname, True) > > > @@ -119,6 +120,16 @@ setup_root_file_system() { > > > export LANG=C > > > export LANGUAGE=C > > > export LC_ALL=C > > > + > > > + if [ -d ${TMPDIR}/aptkeys ]; then > > > + for keyfile in ${TMPDIR}/aptkeys/* > > > + do > > > + kfn="$(basename $keyfile)" > > > + cp $keyfile "$ROOTFSDIR/tmp/$kfn" > > > + sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key add > > > "/tmp/$kfn" > > > + rm "$ROOTFSDIR/tmp/$kfn" > > > + done > > > + fi > > > sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update \ > > > -o Dir::Etc::sourcelist="sources.list.d/isar-apt.list" \ > > > -o Dir::Etc::sourceparts="-" \ > > > @@ -128,6 +139,7 @@ setup_root_file_system() { > > > sudo -E chroot "$ROOTFSDIR" /usr/bin/dpkg > > > --add-architecture ${DISTRO_ARCH} sudo -E chroot > > > "$ROOTFSDIR" /usr/bin/apt-get update fi > > > + sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key update > > > sudo -E chroot "$ROOTFSDIR" \ > > > /usr/bin/apt-get ${APT_ARGS} --download-only $PACKAGES \ > > > ${IMAGE_TRANSIENT_PACKAGES} > > > diff --git a/meta/classes/isar-image.bbclass > > > b/meta/classes/isar-image.bbclass index cdd1651..4a89bd7 100644 > > > --- a/meta/classes/isar-image.bbclass > > > +++ b/meta/classes/isar-image.bbclass > > > @@ -82,6 +82,7 @@ isar_image_cleanup() { > > > fi > > > rm -f "${IMAGE_ROOTFS}/etc/apt/sources-list" > > > ' > > > + sudo rm -f "${ISARKEYRING}" > > > } > > > > > > do_rootfs() { > > > diff --git > > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb > > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb index > > > a793585..b70d2a8 100644 --- > > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb +++ > > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb @@ > > > -11,8 +11,8 @@ WORKDIR = > > > "${TMPDIR}/work/${DISTRO}-${DISTRO_ARCH}/${PN}-${HOST_DISTRO}-${HOST_A > > > DEPLOY_ISAR_BOOTSTRAP = > > > "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}" > > > ISAR_BOOTSTRAP_LOCK = > > > "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}.lock" > > > -require isar-bootstrap.inc inherit isar-bootstrap-helper > > > +require isar-bootstrap.inc do_generate_keyring[stamp-extra-info] > > > = "${DISTRO}-${DISTRO_ARCH}" diff --git > > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc > > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index > > > 98c5c6b..8002a53 100644 --- > > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++ > > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -23,10 > > > +23,8 @@ APTSRCS = "${WORKDIR}/apt-sources" APTSRCS_INIT = > > > "${WORKDIR}/apt-sources-init" BASEAPTSRCS = > > > "${WORKDIR}/base-apt-sources" APTKEYFILES = "" -APTKEYRING = > > > "${WORKDIR}/apt-keyring.gpg" -DEBOOTSTRAP_KEYRING = "" > > > DEPLOY_ISAR_BOOTSTRAP ?= "" > > > -DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales" > > > +DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales gnupg2" > > > > When i talked about the OVERRIDES i meant also adding gnupg2 > > depending on a condition. And that condition would probably be, if > > DISTRO_APT_KEYS is non-empty. > > > Pardon, my fault... > > > > DISTRO_APT_KEYS != "" && OVERRIDES += "gnupg-support" > > DISTRO_BOOTSTRAP_BASE_PACKAGES_append_gnupg-support = " gnupg2" > > > > > DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org > > > file:///${REPO_BASE_DIR} \n" if > > > bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) else > > > "" }" @@ -43,7 +41,6 @@ python () { if own_pub_key: > > > aptkeys += own_pub_key.split() > > > > > > - d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}") > > > for key in aptkeys: > > > d.appendVar("SRC_URI", " %s" % key) > > > fetcher = bb.fetch2.Fetch([key], d) > > > @@ -171,13 +168,17 @@ def get_distro_components_argument(d, > > > is_host): else: > > > return "" > > > > > > +APTKEYTMPDIR := "${TMPDIR}/aptkeys" > > > + > > > +do_generate_keyring[cleandirs] = "${APTKEYTMPDIR}" > > > do_generate_keyring[dirs] = "${DL_DIR}" > > > do_generate_keyring[vardeps] += "DISTRO_APT_KEYS" > > > do_generate_keyring() { > > > if [ -n "${@d.getVar("APTKEYFILES", True) or ""}" ]; then > > > + chmod 777 "${APTKEYTMPDIR}" > > > for keyfile in ${@d.getVar("APTKEYFILES", True)}; do > > > - gpg --no-default-keyring --keyring "${APTKEYRING}" \ > > > - --no-tty --homedir "${DL_DIR}" --import > > > "$keyfile" > > > + cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename > > > "$keyfile")" > > > + sudo apt-key --keyring "${ISARKEYRING}" add > > > "$keyfile" > > > > This whole switching from gpg to "sudo chroot apt-key" would make a > > nice stand-alone patch, but i do not feel strong about that. > > > I argue against that because I have a use case where I need all of > this. And I don't like small patches wandering around the mailing > lists without being merged. Well one in the same queue/series of cause, which would express the order/need while being small and focused. Henning > Andreas > > Henning > > > > > done > > > fi > > > } > > > @@ -219,7 +220,6 @@ isar_bootstrap() { > > > if [ ${IS_HOST} ]; then > > > ${DEBOOTSTRAP} $debootstrap_args \ > > > ${@get_distro_components_argument(d, > > > True)} \ > > > - ${DEBOOTSTRAP_KEYRING} \ > > > "${@get_distro_suite(d, True)}" \ > > > "${ROOTFSDIR}" \ > > > "${@get_distro_source(d, True)}" > > > @@ -228,7 +228,6 @@ isar_bootstrap() { > > > "${DEBOOTSTRAP}" $debootstrap_args \ > > > --arch="${DISTRO_ARCH}" \ > > > ${@get_distro_components_argument(d, > > > False)} \ > > > - ${DEBOOTSTRAP_KEYRING} \ > > > "${@get_distro_suite(d, > > > False)}" \ "${ROOTFSDIR}" \ > > > "${@get_distro_source(d, > > > False)}" > > >