[PATCH v2 0/1] Update expired debian ports signing key

[PATCH v2 0/1] Update expired debian ports signing key

[Uladzimir Bely]

On Feb 01 we got debootstrap error for debian-sid-ports-riscv64:
E: Release signed by unknown key (key id E852514F5DF312F6)

It looks like this repo every year changes the key to sign releases.
Also, once a year a new key is generated to be used for signing
in the future:

year       : --2021----|----2022----|----2023----|----2024--
key created: ---------C|-*---------D|-----------E|----------
signing key: AAAAAAAAAA ABBBBBBBBBBB BCCCCCCCCCCC CDDDDDDDDD

This change allows to have 2 keys for debian-sid-ports: one is
currently used, and another is for smooth transition through
the date of signing key change.

Changes since v1:
- Added a key for 2023 year in advance

Uladzimir Bely (1):
  meta: Update debian ports signing key

 meta/conf/distro/debian-sid-ports.conf | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

-- 
2.20.1

[PATCH v2 1/1] meta: Update debian ports signing key

[Uladzimir Bely]

Replace expired Debian Ports Archive Automatic Signing Key (2021)
(ID:5A88D659DCB811BB) by new Debian Ports Archive Automatic Signing Key
(2022) (ID: E852514F5DF312F6) to make debian-sid-ports targets work.

Also added Debian Ports Archive Automatic Signing Key (2023)
(ID:B523E5F3FC4E5F2C) in advance. It will be used for signing
starting from 2023 Feb 01.

Signed-off-by: Uladzimir Bely <ubely@ilbers.de>
---
 meta/conf/distro/debian-sid-ports.conf | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/meta/conf/distro/debian-sid-ports.conf b/meta/conf/distro/debian-sid-ports.conf
index 32bd32f3..e71a467d 100644
--- a/meta/conf/distro/debian-sid-ports.conf
+++ b/meta/conf/distro/debian-sid-ports.conf
@@ -10,15 +10,16 @@ BASE_DISTRO_CODENAME = "sid"
 
 HOST_DISTRO ?= "debian-sid"
 
-DEBIAN_PORTS_KEY = "https://www.ports.debian.org/archive_2021.key;sha256sum=44a0c59cac5385cd0a1506f695fbd2381fb71a04d8afc05248ad00a0ec6052aa"
+DEBIAN_PORTS_KEYS += "https://www.ports.debian.org/archive_2022.key;sha256sum=213531906f80d79a5dbc8573f57f2a2831b71383cc2d568feba97bb4db94adcc"
+DEBIAN_PORTS_KEYS += "https://www.ports.debian.org/archive_2023.key;sha256sum=cd29cb45654c2d31e8c56c6215838bd7e2d29612021ab04486109e82175a0a98"
 
 DISTRO_APT_SOURCES = "conf/distro/debian-${BASE_DISTRO_CODENAME}-ports.list"
-DISTRO_BOOTSTRAP_KEYS += "${DEBIAN_PORTS_KEY}"
+DISTRO_BOOTSTRAP_KEYS += "${DEBIAN_PORTS_KEYS}"
 DISTRO_CONFIG_SCRIPT ?= "debian-configscript.sh"
 DISTRO_KERNELS ?= "riscv64"
 
 HOST_DISTRO_APT_SOURCES += "${DISTRO_APT_SOURCES}"
-THIRD_PARTY_APT_KEYS += "${DEBIAN_PORTS_KEY}"
+THIRD_PARTY_APT_KEYS += "${DEBIAN_PORTS_KEYS}"
 
 IMAGE_PREINSTALL += "init"
 
-- 
2.20.1

Re: [PATCH v2 0/1] Update expired debian ports signing key

[Anton Mikanovich]

04.02.2022 12:15, Uladzimir Bely wrote:
> On Feb 01 we got debootstrap error for debian-sid-ports-riscv64:
> E: Release signed by unknown key (key id E852514F5DF312F6)
>
> It looks like this repo every year changes the key to sign releases.
> Also, once a year a new key is generated to be used for signing
> in the future:
>
> year       : --2021----|----2022----|----2023----|----2024--
> key created: ---------C|-*---------D|-----------E|----------
> signing key: AAAAAAAAAA ABBBBBBBBBBB BCCCCCCCCCCC CDDDDDDDDD
>
> This change allows to have 2 keys for debian-sid-ports: one is
> currently used, and another is for smooth transition through
> the date of signing key change.
>
> Changes since v1:
> - Added a key for 2023 year in advance
>
> Uladzimir Bely (1):
>    meta: Update debian ports signing key
>
>   meta/conf/distro/debian-sid-ports.conf | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)
>
Applied to next, thanks.