From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6665315485307895808 X-Received: by 2002:a17:906:3744:: with SMTP id e4mr1814490ejc.3.1552913937273; Mon, 18 Mar 2019 05:58:57 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com Received: by 2002:a50:ee8a:: with SMTP id f10ls4401716edr.6.gmail; Mon, 18 Mar 2019 05:58:56 -0700 (PDT) X-Google-Smtp-Source: APXvYqxPsQP8t4X5BYNoyt0Z5px6n0RzjUl9etOggpXKUhtIM6tGDo7elBpHuna0qOSOFC+KTMnQ X-Received: by 2002:a50:addd:: with SMTP id b29mr2030729edd.11.1552913936802; Mon, 18 Mar 2019 05:58:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1552913936; cv=none; d=google.com; s=arc-20160816; b=kRGZFygdxzhzMbWqZDN9v3/IYy53AmoTkhINpM8840Dh+9hep1rp4DKI5xSbZOH3T7 npi7NmyWdAcmg+dbEcgHJGe9QOLEwDUSNBN8KZJXNCH0ggNGAIai8YnF2CFNk2EOwn4G 7L5HnmknWu01QFF+qGSrS1dQmvfwRBNazgESTVloaKUNnvfLxT/mRZXaIlJMtsvvQFkU 8CsuqPYYFLUhAps+EtIv6k0MlnB6Zvo9jiwu8dwevLbo/gNnR6EsaY0rOy6+MxwYrooX Cvr9nG+2gKgvdUjj+fUPwG7k9UwSoAJQ5BZWdrZ3Y+Zo6+KRC6ndtNXBXV1pjpg9gqHY q8tw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=user-agent:in-reply-to:content-disposition:content-description :mime-version:references:message-id:subject:cc:to:from:date; bh=VN5yMQB3zw7L8s8A8QP30zHQLTVeB3ExKlxfD/iPms4=; b=fqXir6cM2ECoE6/C/eJXhnoiA3z6sonRzcrIGuyTSXTgwbDl9apdpSH1da/HLgSBmR jrd9tBMZf4Wp39/oXGurLMQBDGBD+YuDXTDog1CtseOPbe95iFpwWjINuV1Lqw9pq6Bo r8/7lNRhXBZ5PLc5GBOKUrdf19E9BXVK8Uw63jqNxh2lTGgCb0mzvJiSzEocyS5DFqUL FIG3UPLweJezDUOAuSp0tlUgS+xuTCOBlNTzFdg/JTiGXDIgGefNCanYeOVsaT7aerLO HwpQOa+chL7k1dcW4Lns25rqnyoQBuvPKs61teXy0/thmdf5QptRyT/NWNiEK72IPJI/ Bzjw== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of andreas.reichel.ext@siemens.com designates 192.35.17.28 as permitted sender) smtp.mailfrom=andreas.reichel.ext@siemens.com Return-Path: Received: from goliath.siemens.de (goliath.siemens.de. [192.35.17.28]) by gmr-mx.google.com with ESMTPS id p25si326512eju.1.2019.03.18.05.58.56 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 Mar 2019 05:58:56 -0700 (PDT) Received-SPF: pass (google.com: domain of andreas.reichel.ext@siemens.com designates 192.35.17.28 as permitted sender) client-ip=192.35.17.28; Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of andreas.reichel.ext@siemens.com designates 192.35.17.28 as permitted sender) smtp.mailfrom=andreas.reichel.ext@siemens.com Received: from mail2.sbs.de (mail2.sbs.de [192.129.41.66]) by goliath.siemens.de (8.15.2/8.15.2) with ESMTPS id x2ICwuXW014425 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Mon, 18 Mar 2019 13:58:56 +0100 Received: from iiotirae (golem.ppmd.siemens.net [139.25.69.17]) by mail2.sbs.de (8.15.2/8.15.2) with SMTP id x2ICwu00021528; Mon, 18 Mar 2019 13:58:56 +0100 Date: Mon, 18 Mar 2019 13:57:02 +0100 From: Andreas Reichel To: Henning Schild Cc: isar-users@googlegroups.com Subject: Re: [PATCH v4 5/6] Use apt-key to generate apt-keyring Message-ID: <20190318125702.GA14476@iiotirae> References: <20190307142304.14508-1-andreas.reichel.ext@siemens.com> <20190307142304.14508-6-andreas.reichel.ext@siemens.com> <20190307155153.0ec58eb2@md1za8fc.ad001.siemens.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Description: message Content-Disposition: inline In-Reply-To: <20190307155153.0ec58eb2@md1za8fc.ad001.siemens.net> User-Agent: Mutt/1.11.4 (2019-03-13) X-TUID: sGNJYv6Sta6t On Thu, Mar 07, 2019 at 03:51:53PM +0100, Henning Schild wrote: > Am Thu, 7 Mar 2019 15:23:03 +0100 > schrieb "[ext] Andreas J. Reichel" : > > > From: Andreas Reichel > > > > Use apt-key instead of manually calling gpg. > > > > Signed-off-by: Andreas Reichel > > --- > > meta/classes/isar-bootstrap-helper.bbclass | 2 ++ > > meta/classes/isar-image.bbclass | 1 + > > meta/conf/bitbake.conf | 1 + > > .../isar-bootstrap/isar-bootstrap.inc | 32 > > +++++++++++++++---- 4 files changed, 29 insertions(+), 7 deletions(-) > > > > diff --git a/meta/classes/isar-bootstrap-helper.bbclass > > b/meta/classes/isar-bootstrap-helper.bbclass index d780b85..c5e39e9 > > 100644 --- a/meta/classes/isar-bootstrap-helper.bbclass > > +++ b/meta/classes/isar-bootstrap-helper.bbclass > > @@ -119,6 +119,7 @@ setup_root_file_system() { > > export LANG=C > > export LANGUAGE=C > > export LC_ALL=C > > + > > sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update \ > > -o Dir::Etc::sourcelist="sources.list.d/isar-apt.list" \ > > -o Dir::Etc::sourceparts="-" \ > > @@ -128,6 +129,7 @@ setup_root_file_system() { > > sudo -E chroot "$ROOTFSDIR" /usr/bin/dpkg --add-architecture > > ${DISTRO_ARCH} sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-get update > > fi > > + sudo -E chroot "$ROOTFSDIR" /usr/bin/apt-key update > > sudo -E chroot "$ROOTFSDIR" \ > > /usr/bin/apt-get ${APT_ARGS} --download-only $PACKAGES \ > > ${IMAGE_TRANSIENT_PACKAGES} > > diff --git a/meta/classes/isar-image.bbclass > > b/meta/classes/isar-image.bbclass index cdd1651..4a89bd7 100644 > > --- a/meta/classes/isar-image.bbclass > > +++ b/meta/classes/isar-image.bbclass > > @@ -82,6 +82,7 @@ isar_image_cleanup() { > > fi > > rm -f "${IMAGE_ROOTFS}/etc/apt/sources-list" > > ' > > + sudo rm -f "${ISARKEYRING}" > > } > > > > do_rootfs() { > > diff --git a/meta/conf/bitbake.conf b/meta/conf/bitbake.conf > > index 0e521bb..769ec9a 100644 > > --- a/meta/conf/bitbake.conf > > +++ b/meta/conf/bitbake.conf > > @@ -62,6 +62,7 @@ DEBDISTRONAME = "isar" > > # Isar apt repository paths > > REPO_ISAR_DIR = "${DEPLOY_DIR}/isar-apt/apt" > > REPO_ISAR_DB_DIR = "${DEPLOY_DIR}/isar-apt/db" > > +ISARKEYRING = "/etc/apt/trusted.gpg.d/isar.gpg" > > > > # Base apt repository paths > > REPO_BASE_DIR = "${DL_DIR}/base-apt/apt" > > diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index > > dbc3938..2fb5c5b 100644 --- > > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++ > > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -23,10 +23,9 > > @@ APTSRCS = "${WORKDIR}/apt-sources" APTSRCS_INIT = > > "${WORKDIR}/apt-sources-init" BASEAPTSRCS = > > "${WORKDIR}/base-apt-sources" APTKEYFILES = "" > > -APTKEYRING = "${WORKDIR}/apt-keyring.gpg" > > -DEBOOTSTRAP_KEYRING = "" > > DEPLOY_ISAR_BOOTSTRAP ?= "" > > DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales" > > +DISTRO_BOOTSTRAP_BASE_PACKAGES_append_gnupg = ",gnupg2" > > > > DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org > > file:///${REPO_BASE_DIR} \n" if > > bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) else "" }" > > @@ -43,7 +42,6 @@ python () { if own_pub_key: > > aptkeys += own_pub_key.split() > > > > - d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}") > > for key in aptkeys: > > d.appendVar("SRC_URI", " %s" % key) > > fetcher = bb.fetch2.Fetch([key], d) > > @@ -158,6 +156,14 @@ def get_distro_needs_https_support(d, > > is_host=False): else: > > return "" > > > > +def get_distro_needs_gpg_support(d): > > + apt_keys = d.getVar("HAVE_CUSTOM_APT_KEYS", False) > > + if apt_keys: > > + return "gnupg" > > + return "" > > This will probably become DISTRO_APT_KEYS ... and in this series > HAVE_CUSTOM_APT_KEYS does not even exist yet. > This does not matter here, because I check if it exists... > Henning > > > +OVERRIDES_append = ":${@get_distro_needs_gpg_support(d)}" > > + > > def get_distro_source(d, is_host): > > return get_distro_primary_source_entry(d, is_host)[0] > > > > @@ -171,13 +177,17 @@ def get_distro_components_argument(d, is_host): > > else: > > return "" > > > > +APTKEYTMPDIR := "${TMPDIR}/aptkeys" > > + > > +do_generate_keyring[cleandirs] = "${APTKEYTMPDIR}" > > do_generate_keyring[dirs] = "${DL_DIR}" > > do_generate_keyring[vardeps] += "DISTRO_APT_KEYS" > > do_generate_keyring() { > > if [ -n "${@d.getVar("APTKEYFILES", True) or ""}" ]; then > > + chmod 777 "${APTKEYTMPDIR}" > > for keyfile in ${@d.getVar("APTKEYFILES", True)}; do > > - gpg --no-default-keyring --keyring "${APTKEYRING}" \ > > - --no-tty --homedir "${DL_DIR}" --import "$keyfile" > > + cp "$keyfile" "${APTKEYTMPDIR}"/"$(basename "$keyfile")" > > + sudo apt-key --keyring "${ISARKEYRING}" add "$keyfile" > > done > > fi > > } > > @@ -221,7 +231,6 @@ isar_bootstrap() { > > if [ ${IS_HOST} ]; then > > ${DEBOOTSTRAP} $debootstrap_args \ > > ${@get_distro_components_argument(d, > > True)} \ > > - ${DEBOOTSTRAP_KEYRING} \ > > "${@get_distro_suite(d, True)}" \ > > "${ROOTFSDIR}" \ > > "${@get_distro_source(d, True)}" > > @@ -230,7 +239,6 @@ isar_bootstrap() { > > "${DEBOOTSTRAP}" $debootstrap_args \ > > --arch="${DISTRO_ARCH}" \ > > ${@get_distro_components_argument(d, > > False)} \ > > - ${DEBOOTSTRAP_KEYRING} \ > > "${@get_distro_suite(d, False)}" \ > > "${ROOTFSDIR}" \ > > "${@get_distro_source(d, False)}" > > @@ -259,6 +267,16 @@ isar_bootstrap() { > > mkdir -p "${ROOTFSDIR}/etc/apt/apt.conf.d" > > install -v -m644 "${WORKDIR}/isar-apt.conf" \ > > "${ROOTFSDIR}/etc/apt/apt.conf.d/50isar.conf" > > + if [ -d ${TMPDIR}/aptkeys ]; then > > + for keyfile in ${TMPDIR}/aptkeys/* > > + do > > + kfn="$(basename $keyfile)" > > + cp $keyfile "${ROOTFSDIR}/tmp/$kfn" > > + sudo -E chroot "${ROOTFSDIR}" /usr/bin/apt-key \ > > + --keyring ${ISARKEYRING} add "/tmp/$kfn" > > + rm "${ROOTFSDIR}/tmp/$kfn" > > + done > > + fi > > > > if [ "${@get_distro_suite(d, True)}" = "stretch" ] && > > [ "${@get_host_release().split('.')[0]}" -lt "4" ]; then install -v > > -m644 "${WORKDIR}/isar-apt-fallback.conf" \ > -- Andreas Reichel Dipl.-Phys. (Univ.) Software Consultant Andreas.Reichel@tngtech.com, +49-174-3180074 TNG Technology Consulting GmbH, Betastr. 13a, 85774 Unterfoehring Geschaeftsfuehrer: Henrik Klagges, Dr. Robert Dahlke, Gerhard Mueller Sitz: Unterfoehring * Amtsgericht Muenchen * HRB 135082