Re: [PATCHv3 8/9] bootstrap: fix debootstrap gpg issue when base-apt is not signed

[Henning Schild <henning.schild@siemens.com>]

On Thu, 14 Nov 2019 21:11:23 +0100
Jan Kiszka <jan.kiszka@siemens.com> wrote:

> On 07.11.19 19:56, Henning Schild wrote:
> > From: Henning Schild <henning.schild@siemens.com>
> > 
> > DISTRO_BOOTSTRAP_KEYRING will not exist if
> > DISTRO_BOOTSTRAP_KEYFILES is empty. So the debootstrap argument
> > will not work. Simplify the logic to depend on the existance of the
> > keyring-file.
> > 
> > Signed-off-by: Henning Schild <henning.schild@siemens.com>
> > ---
> >   meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 10
> > +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
> > 
> > diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index
> > 203a557..b506f30 100644 ---
> > a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++
> > b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -231,14
> > +231,10 @@ isar_bootstrap() { shift
> >       done
> >       debootstrap_args="--verbose --variant=minbase
> > --include=${DISTRO_BOOTSTRAP_BASE_PACKAGES}"
> > -    if [ ! "x${DISTRO_BOOTSTRAP_KEYS}" = "x" ] || \
> > -       [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
> > +    if [ -f "${DISTRO_BOOTSTRAP_KEYRING}" ]; then
> >           debootstrap_args="$debootstrap_args
> > --keyring=${DISTRO_BOOTSTRAP_KEYRING}"
> > -    fi
> > -    if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
> > -        if [ -z "${BASE_REPO_KEY}" ] ; then
> > -            debootstrap_args="$debootstrap_args --no-check-gpg"
> > -        fi
> > +    else
> > +        debootstrap_args="$debootstrap_args --no-check-gpg"
> >       fi
> >       E="${@ isar_export_proxies(d)}"
> >       export IS_HOST debootstrap_args E
> >   
> 
> Breaks with non-empty DISTRO_BOOTSTRAP_KEYS and a non-signed base-apt.

Thanks. I will come up with a fix ASAP.

The key problem is that ci_build.sh has too many knobs and does not
test the repo build in all its beauty. In fact this fix should have
come with a test that shows the problem it fixed in the first place.

So i guess my fix will come with another change that simplifies the
build script and reduces the number of knobs. Maybe in the end just one,
fast|full. Where full would do the offline build signed, unsigned, with
other keys and without, and with+out any other variation i find on the
way.

Henning

> Jan
>