[PATCH v2 0/2] Fix gpg-agent management

[PATCH v2 0/2] Fix gpg-agent management

[Anton Mikanovich]

Management logic of starting and stopping gpg-agent in isar-bootstrap
was still not working properly. Starting of gpg-agent happened for every
bitbake run, and stopping did not happen at all. This is not a big issue
when building Isar inside kas, but should be fixed for chroot
environment.
---
Changes since v1:
- Simplify conditions.

Anton Mikanovich (2):
  isar-bootstrap: Fix GPG need check function
  isar-bootstrap: Do not let gpg-agent to stay running

 .../isar-bootstrap/isar-bootstrap.inc         | 20 +++++++++----------
 1 file changed, 9 insertions(+), 11 deletions(-)

-- 
2.25.1

[PATCH v2 1/2] isar-bootstrap: Fix GPG need check function

[Anton Mikanovich]

After adding BASE_REPO_KEY in 3895266 this check was broken.

Signed-off-by: Anton Mikanovich <amikan@ilbers.de>
---
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index c65f2cb..e87c091 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -187,12 +187,12 @@ def get_distro_needs_https_support(d):
 OVERRIDES_append = ":${@get_distro_needs_https_support(d)}"
 
 def get_distro_needs_gpg_support(d):
-    apt_keys = d.getVar("DISTRO_BOOTSTRAP_KEYS") or ""
-    apt_keys += " " + (d.getVar("THIRD_PARTY_APT_KEYS") or "")
-    apt_keys += " " + (d.getVar("BASE_REPO_KEY") or "")
-    if apt_keys != " ":
+    if d.getVar("DISTRO_BOOTSTRAP_KEYS") or \
+       d.getVar("THIRD_PARTY_APT_KEYS") or \
+       d.getVar("BASE_REPO_KEY"):
         return "gnupg"
-    return ""
+    else:
+        return ""
 
 OVERRIDES_append = ":${@get_distro_needs_gpg_support(d)}"
 
-- 
2.25.1

[PATCH v2 2/2] isar-bootstrap: Do not let gpg-agent to stay running

[Anton Mikanovich]

If running gpg-agent as a daemon we make it to run apt-key as a child
of gpg-agent. After the finish of apt-key parent gpg-agent will be also
finished in that mode.
This will allow us not to control start-stop of gpg-agent (which was
actually broken before this commit) and get rid of any possible issues
caused by left gpg-agent processes.

Signed-off-by: Anton Mikanovich <amikan@ilbers.de>
---
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index e87c091..b8af676 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -331,24 +331,22 @@ do_bootstrap() {
         mkdir -p "${ROOTFSDIR}/etc/apt/apt.conf.d"
         install -v -m644 "${WORKDIR}/isar-apt.conf" \
                          "${ROOTFSDIR}/etc/apt/apt.conf.d/50isar.conf"
-        if [ "${@get_distro_needs_gpg_support(d)}" = "gnupg" ]; then
+        if [ -n "${@get_distro_needs_gpg_support(d)}" ]; then
             MY_GPGHOME="$(chroot "${ROOTFSDIR}" mktemp -d /tmp/gpghomeXXXXXXXXXX)"
             echo "Created temporary directory ${MY_GPGHOME} for gpg-agent"
             export GNUPGHOME="${MY_GPGHOME}"
-            chroot "${ROOTFSDIR}" gpg-agent --daemon
             APT_KEY_APPEND="--homedir ${MY_GPGHOME}"
         fi
         find ${APT_KEYS_DIR}/ -type f | while read keyfile
         do
             kfn="$(basename $keyfile)"
             cp $keyfile "${ROOTFSDIR}/tmp/$kfn"
-            chroot "${ROOTFSDIR}" /usr/bin/apt-key \
+            chroot "${ROOTFSDIR}" /usr/bin/gpg-agent --daemon -- /usr/bin/apt-key \
                 --keyring ${THIRD_PARTY_APT_KEYRING} ${APT_KEY_APPEND} add "/tmp/$kfn"
             rm "${ROOTFSDIR}/tmp/$kfn"
         done
-        if [ -d "${MY_GPGHOME}" ]; then
-            echo "Killing gpg-agent for ${MY_GPGHOME}"
-            chroot "${ROOTFSDIR}" gpgconf --kill gpg-agent && /bin/rm -rf "${MY_GPGHOME}"
+        if [ -n "${MY_GPGHOME}" ]; then
+            rm -rf "${ROOTFSDIR}${MY_GPGHOME}"
         fi
 
         if [ "${@get_distro_suite(d)}" = "stretch" ] && [ "${@get_host_release().split('.')[0]}" -lt "4" ]; then
-- 
2.25.1

Re: [PATCH v2 0/2] Fix gpg-agent management

[Anton Mikanovich]

On 13.09.21 17:31, Anton Mikanovich wrote:
> Management logic of starting and stopping gpg-agent in isar-bootstrap
> was still not working properly. Starting of gpg-agent happened for every
> bitbake run, and stopping did not happen at all. This is not a big issue
> when building Isar inside kas, but should be fixed for chroot
> environment.
> ---
> Changes since v1:
> - Simplify conditions.
>
> Anton Mikanovich (2):
>    isar-bootstrap: Fix GPG need check function
>    isar-bootstrap: Do not let gpg-agent to stay running
>
>   .../isar-bootstrap/isar-bootstrap.inc         | 20 +++++++++----------
>   1 file changed, 9 insertions(+), 11 deletions(-)
>
Applied to next.

-- 
Anton Mikanovich
Promwad Ltd.
External service provider of ilbers GmbH
Maria-Merian-Str. 8
85521 Ottobrunn, Germany
+49 (89) 122 67 24-0
Commercial register Munich, HRB 214197
General Manager: Baurzhan Ismagulov