[PATCH 0/2] Restore bootstrapping of raspios on trixie host

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

When bootstrapping from a trixie host, mmdebstrap uses the host apt for the
first part of the bootstrapping. In Debian trixie, the default apt gpgv
backend is sqv, which blocks SHA1 signed keys from 01.02.2026 on [1] (this
is configured in /usr/share/apt/default-sequoia.config). As a workaround,
we provide variables to instruct mmdebstrap to not check the expiry date,
which internally switches the gpgv backend to gpg which also does not have
a check for the SHA1 deprecation. Unfortunately it is not possible to
instruct apt / sqv to just disable the SHA1 check (except by replacing the
whole config file) [2].

This fixes [3], unblocks the TestCross CI and is release critical.

[1] https://wiki.debian.org/Teams/Apt/Sha1Removal
[2] https://bugs-devel.debian.org/cgi-bin/bugreport.cgi?bug=1092747
[3] https://groups.google.com/g/isar-users/c/D5NaB_TdioY

Best regards,
Felix Moessbauer
Siemens AG

Felix Moessbauer (2):
  add variables to inject config into mmdebstrap
  work around bootstrapping issue of raspios due to SHA1 key removal

 RECIPE-API-CHANGELOG.md                                | 10 ++++++++++
 meta-isar/conf/distro/raspios-bookworm.conf            |  2 ++
 meta-isar/conf/distro/raspios-bullseye.conf            |  2 ++
 .../isar-mmdebstrap/isar-mmdebstrap-target.bb          |  1 +
 meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc  |  7 +++++++
 5 files changed, 22 insertions(+)

-- 
2.53.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260306160255.1017503-1-felix.moessbauer%40siemens.com.