Re: [PATCH] export GNUGPHOME for reprepro

[Vijai Kumar K <vijaikumar.kanagarajan@gmail.com>]

On Thu, Jul 25, 2019 at 09:25:43AM +0200, Henning Schild wrote:
> Hi Vijai Kumar,
> 
> this patch looks good on its own. But again the context is missing. A
> series that enables proper GPG signing would be more helpful than tiny
> steps that might not be going in the right direction.
> 
> That said you already did a lot of research on the topic and did send
> several good proposals and the full thing might be still far away. This
> one combined with the one from Maxim would make a step that is very
> likely going in the right direction. And could be merged if we are in a
> hurry to merge intermediate steps.
> 

Hi Henning,

Thank you for the feedback. Yes, I agree that it would be more helpful
to have the complete patchset. However, adding support for passphrase
protected keys might take some time and might involve some significant
changes to the code.

Hence I would like to break it into the below steps
1. Making GNUPGHOME available to reprepro
2. Providing mechansim to choose a key for signing
3. Handle password protected keys.

I am planning to address and propose patchsets for points 1 & 2, so that
atleast passwordless keys will have support for situations described
in my previous thread. Addressing these would inturn ease the CI &
docker use cases which we currently need now.

I will start work on password protected keys in parallel and start an
RFC for that.

Thanks,
Vijai Kumar K

> Henning
> 
> Am Thu, 25 Jul 2019 12:45:04 +0530
> schrieb <vijaikumar.kanagarajan@gmail.com>:
> 
> > From: Vijai Kumar K <Vijaikumar_Kanagarajan@mentor.com>
> > 
> > reprepro doesnot know about GNUPGHOME. If you trigger package feed
> > creation in a machine that has GNUPGHOME set, reprepro would not
> > know that it should use the new location and might use the keys it
> > find in the default ~/.gnupg directory.
> > 
> > Make GNUPGHOME available for reprepro.
> > 
> > Signed-off-by: Vijai Kumar K <Vijaikumar_Kanagarajan@mentor.com>
> > ---
> >  meta/classes/base-apt-helper.bbclass       | 4 ++++
> >  meta/classes/dpkg-base.bbclass             | 3 +++
> >  meta/recipes-devtools/base-apt/base-apt.bb | 3 +++
> >  meta/recipes-devtools/isar-apt/isar-apt.bb | 3 +++
> >  scripts/isar-buildenv-internal             | 3 +++
> >  5 files changed, 16 insertions(+)
> > 
> > diff --git a/meta/classes/base-apt-helper.bbclass
> > b/meta/classes/base-apt-helper.bbclass index ba768da..a8f2a41 100644
> > --- a/meta/classes/base-apt-helper.bbclass
> > +++ b/meta/classes/base-apt-helper.bbclass
> > @@ -30,6 +30,10 @@ populate_base_apt() {
> >              compare_pkg_md5sums "$package" "$isar_package" &&
> > continue fi
> >  
> > +        if [ ! -z ${GNUPGHOME} ]; then
> > +            export GNUPGHOME=${GNUPGHOME}
> > +        fi
> > +
> >          # Check if this package is already in base-apt
> >          isar_package=$(find ${REPO_BASE_DIR}/${BASE_DISTRO} -name
> > $base_name) if [ -n "$isar_package" ]; then
> > diff --git a/meta/classes/dpkg-base.bbclass
> > b/meta/classes/dpkg-base.bbclass index 3e6ba8c..da13f86 100644
> > --- a/meta/classes/dpkg-base.bbclass
> > +++ b/meta/classes/dpkg-base.bbclass
> > @@ -120,6 +120,9 @@ repo_clean() {
> >  
> >  # Install package to Isar-apt
> >  do_deploy_deb() {
> > +    if [ ! -z ${GNUPGHOME} ]; then
> > +        export GNUPGHOME=${GNUPGHOME}
> > +    fi
> >      repo_clean
> >      reprepro -b ${REPO_ISAR_DIR}/${DISTRO} \
> >               --dbdir ${REPO_ISAR_DB_DIR}/${DISTRO} \
> > diff --git a/meta/recipes-devtools/base-apt/base-apt.bb
> > b/meta/recipes-devtools/base-apt/base-apt.bb index 1c0b4c6..ca40b6c
> > 100644 --- a/meta/recipes-devtools/base-apt/base-apt.bb
> > +++ b/meta/recipes-devtools/base-apt/base-apt.bb
> > @@ -28,6 +28,9 @@ do_cache_config() {
> >      path_databases="${REPO_BASE_DB_DIR}/${BASE_DISTRO}"
> >  
> >      if [ ! -d "${path_databases}" ]; then
> > +        if [ ! -z ${GNUPGHOME} ]; then
> > +            export GNUPGHOME=${GNUPGHOME}
> > +        fi
> >          reprepro -b ${path_cache} \
> >                   --dbdir ${path_databases} \
> >                   export ${BASE_DISTRO_CODENAME}
> > diff --git a/meta/recipes-devtools/isar-apt/isar-apt.bb
> > b/meta/recipes-devtools/isar-apt/isar-apt.bb index a959691..8f517fe
> > 100644 --- a/meta/recipes-devtools/isar-apt/isar-apt.bb
> > +++ b/meta/recipes-devtools/isar-apt/isar-apt.bb
> > @@ -20,6 +20,9 @@ do_cache_config() {
> >      path_databases="${REPO_ISAR_DB_DIR}/${DISTRO}"
> >  
> >      if [ ! -d "${path_databases}" ]; then
> > +        if [ ! -z ${GNUPGHOME} ]; then
> > +            export GNUPGHOME=${GNUPGHOME}
> > +        fi
> >          reprepro -b ${path_cache} \
> >                   --dbdir ${path_databases} \
> >                   export ${DEBDISTRONAME}
> > diff --git a/scripts/isar-buildenv-internal
> > b/scripts/isar-buildenv-internal index 2476d90..7637d41 100755
> > --- a/scripts/isar-buildenv-internal
> > +++ b/scripts/isar-buildenv-internal
> > @@ -67,4 +67,7 @@ BBPATH="${BUILDDIR}"
> >  export BBPATH
> >  
> >  BB_ENV_EXTRAWHITE="BUILDDIR ISARROOT http_proxy https_proxy
> > ftp_proxy no_proxy" +if [ ! -z ${GNUPGHOME} ]; then
> > +	BB_ENV_EXTRAWHITE="${BB_ENV_EXTRAWHITE} GNUPGHOME"
> > +fi
> >  export BB_ENV_EXTRAWHITE
>