Re: Discussion: Base-apt features

[Baurzhan Ismagulov <ibr@radix50.net>]

Hello Vijai Kumar,

thanks for summarizing.

On Wed, Sep 25, 2019 at 01:11:22PM +0530, Vijai Kumar K wrote:
> 1. Support for adding source packages.
> 2. Support for using password protected keys.

Yes, I think those are necessary use cases.


> 3. Support for specifying the signing key.
> 
> Right now, the signing mechanism uses the default gpg key of the system.
> This is problematic in many ways. Especially for CI. In the current
> implementation, eventhough we specify the key, we are not really using it.

This is what I'm currently wondering. What do we need to cover signed base-apt?
Is the following enough?

1. debootstrap succeeds.
2. apt-get update in the rootfs succeeds.

IIUC, (1) should be covered as of next 006a6ed "u-boot-custom: Add control for
u-boot-tools package build". (2) seems to be covered in ibr/next fb61019
"scripts: Enable gnupg in ci_build.sh" (subject to rebasing). This has to be
verified, though (feedback welcome). If proven correct, would we be "really
using it"?


> 4. Support for adding packages only to base-apt.
> 
> Sometimes, we might need a package to be present in base-apt but not in
> the target yet. Things like dev & dbg packages. It would be good if we
> have something like BASE_APT_INSTALL which contains the list which would
> be populated only in base-apt.

Sounds useful, also for stuff like strace, optional gcc libs, etc.
Additionally, we may want to download all binary packages of the source
packages we need (for the requested arches and distros only). That would cover
dev and dbg.


> 5. Refactoring code to consolidate reprepro calls.

I'd suggest to evaluate other tools and libs like python-apt and / or aptly.
After looking at Acquire::By-Hash use cases in more detail, I've seen that we
do need it. According to Jan, it isn't supported by reprepro. I think in the
long term, we'll have to use python-apt and touch bitbake to get everything
right.


With kind regards,
Baurzhan.