* [PATCH v10 0/6] Fix usage of additional apt keys and repos
@ 2019-05-02 11:37 Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 1/6] Simplify and enhance apt-keyring generator Andreas J. Reichel
` (6 more replies)
0 siblings, 7 replies; 8+ messages in thread
From: Andreas J. Reichel @ 2019-05-02 11:37 UTC (permalink / raw)
To: isar-users; +Cc: Andreas Reichel
From: Andreas Reichel <andreas.reichel.ext@siemens.com>
Diff to v9: Tell debootstrap the keyring to use when
ISAR_USE_CACHED_BASE_REPO = 1. This was missing.
Andreas Reichel (6):
Simplify and enhance apt-keyring generator
Use apt-key to generate keyrings
If we use a custom keyring debootstrap may fall to https
raspbian-stretch: Use DISTRO_BOOTSTRAP_KEYS
docs: Update user_manual.md
Give keyring to debootstrap when using cached base repo
doc/user_manual.md | 41 +++++++-
meta-isar/conf/distro/raspbian-stretch.conf | 2 +-
.../conf/multiconfig/qemuamd64-buster.conf | 1 -
meta/conf/bitbake.conf | 1 +
.../isar-bootstrap/isar-bootstrap-host.bb | 4 +-
.../isar-bootstrap/isar-bootstrap-target.bb | 4 +-
.../isar-bootstrap/isar-bootstrap.inc | 96 +++++++++++++------
7 files changed, 115 insertions(+), 34 deletions(-)
--
2.21.0
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v10 1/6] Simplify and enhance apt-keyring generator
2019-05-02 11:37 [PATCH v10 0/6] Fix usage of additional apt keys and repos Andreas J. Reichel
@ 2019-05-02 11:37 ` Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 2/6] Use apt-key to generate keyrings Andreas J. Reichel
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Andreas J. Reichel @ 2019-05-02 11:37 UTC (permalink / raw)
To: isar-users; +Cc: Andreas Reichel
From: Andreas Reichel <andreas.reichel.ext@siemens.com>
* Remove duplicate code from apt-keyring generation
* Fix fetched key location in apt-keyring generator:
Use bb.fetch2.Fetch to retrieve the final filename after it is
downloaded. This way we don't have to guess (which may be wrong), and
also additional SRC_URI parameters like subdir or filename are usable
now.
Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
---
.../isar-bootstrap/isar-bootstrap.inc | 24 +++++++++----------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index c1b571a..90a0faa 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -33,23 +33,23 @@ DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org file:///${REPO_BA
inherit base-apt-helper
python () {
- from urllib.parse import urlparse
distro_apt_keys = d.getVar("DISTRO_APT_KEYS", False)
- wd = d.getVar("WORKDIR", True)
+ aptkeys = []
+
if distro_apt_keys:
- d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
- for key in distro_apt_keys.split():
- url = urlparse(key)
- d.appendVar("SRC_URI", " " + key)
- d.appendVar("APTKEYFILES", " " + wd + url.path)
+ aptkeys += distro_apt_keys.split()
+
if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')):
own_pub_key = d.getVar("BASE_REPO_KEY", False)
if own_pub_key:
- d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
- for key in own_pub_key.split():
- url = urlparse(key)
- d.appendVar("SRC_URI", " " + key)
- d.appendVar("APTKEYFILES", " " + wd + url.path)
+ aptkeys += own_pub_key.split()
+
+ d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
+ for key in aptkeys:
+ d.appendVar("SRC_URI", " %s" % key)
+ fetcher = bb.fetch2.Fetch([key], d)
+ filename = fetcher.localpath(key)
+ d.appendVar("APTKEYFILES", " %s" % filename)
}
def aggregate_files(d, file_list, file_out):
--
2.21.0
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v10 2/6] Use apt-key to generate keyrings
2019-05-02 11:37 [PATCH v10 0/6] Fix usage of additional apt keys and repos Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 1/6] Simplify and enhance apt-keyring generator Andreas J. Reichel
@ 2019-05-02 11:37 ` Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 3/6] If we use a custom keyring debootstrap may fall to https Andreas J. Reichel
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Andreas J. Reichel @ 2019-05-02 11:37 UTC (permalink / raw)
To: isar-users; +Cc: Andreas Reichel
From: Andreas Reichel <andreas.reichel.ext@siemens.com>
* Keyring names as well as variable names are now cleanly separated:
DISTRO_BOOTSTRAP_KEYS, DISTRO_BOOTSTRAP_KEYRING and
DISTRO_BOOTSTRAP_KEYFILES
for bootstrapping the distro.
THIRD_PARTY_APT_KEYS, THIRD_PARTY_APT_KEYRING and
THIRD_PARTY_APT_KEYFILES
for installing packages after bootstrapping.
Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
---
meta/conf/bitbake.conf | 1 +
.../isar-bootstrap/isar-bootstrap-host.bb | 4 +-
.../isar-bootstrap/isar-bootstrap-target.bb | 4 +-
.../isar-bootstrap/isar-bootstrap.inc | 75 +++++++++++++------
4 files changed, 59 insertions(+), 25 deletions(-)
diff --git a/meta/conf/bitbake.conf b/meta/conf/bitbake.conf
index 0e521bb..3782e5c 100644
--- a/meta/conf/bitbake.conf
+++ b/meta/conf/bitbake.conf
@@ -62,6 +62,7 @@ DEBDISTRONAME = "isar"
# Isar apt repository paths
REPO_ISAR_DIR = "${DEPLOY_DIR}/isar-apt/apt"
REPO_ISAR_DB_DIR = "${DEPLOY_DIR}/isar-apt/db"
+THIRD_PARTY_APT_KEYRING = "/etc/apt/trusted.gpg.d/third_party.gpg"
# Base apt repository paths
REPO_BASE_DIR = "${DL_DIR}/base-apt/apt"
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb
index 08b068f..7ee4c61 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap-host.bb
@@ -14,7 +14,7 @@ ISAR_BOOTSTRAP_LOCK = "${DEPLOY_DIR_BOOTSTRAP}/${HOST_DISTRO}-${HOST_ARCH}.lock"
require isar-bootstrap.inc
inherit isar-bootstrap-helper
-do_generate_keyring[stamp-extra-info] = "${DISTRO}-${DISTRO_ARCH}"
+do_generate_keyrings[stamp-extra-info] = "${DISTRO}-${DISTRO_ARCH}"
do_apt_config_prepare[stamp-extra-info] = "${DISTRO}-${DISTRO_ARCH}"
do_apt_config_prepare[dirs] = "${WORKDIR}"
@@ -52,4 +52,4 @@ do_bootstrap[vardeps] += "HOST_DISTRO_APT_SOURCES"
do_bootstrap() {
isar_bootstrap --host
}
-addtask bootstrap before do_build after do_generate_keyring
+addtask bootstrap before do_build after do_generate_keyrings
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap-target.bb b/meta/recipes-core/isar-bootstrap/isar-bootstrap-target.bb
index 79f3e34..39f12b5 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap-target.bb
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap-target.bb
@@ -13,7 +13,7 @@ ISAR_BOOTSTRAP_LOCK = "${DEPLOY_DIR_BOOTSTRAP}/${DISTRO}-${DISTRO_ARCH}.lock"
require isar-bootstrap.inc
-do_generate_keyring[stamp-extra-info] = "${DISTRO}-${DISTRO_ARCH}"
+do_generate_keyrings[stamp-extra-info] = "${DISTRO}-${DISTRO_ARCH}"
do_apt_config_prepare[stamp-extra-info] = "${DISTRO}-${DISTRO_ARCH}"
do_apt_config_prepare[dirs] = "${WORKDIR}"
@@ -49,5 +49,5 @@ do_bootstrap[vardeps] += "DISTRO_APT_SOURCES"
do_bootstrap() {
isar_bootstrap
}
-addtask bootstrap before do_build after do_generate_keyring
+addtask bootstrap before do_build after do_generate_keyrings
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index 90a0faa..835ad52 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -22,34 +22,41 @@ APTPREFS = "${WORKDIR}/apt-preferences"
APTSRCS = "${WORKDIR}/apt-sources"
APTSRCS_INIT = "${WORKDIR}/apt-sources-init"
BASEAPTSRCS = "${WORKDIR}/base-apt-sources"
-APTKEYFILES = ""
-APTKEYRING = "${WORKDIR}/apt-keyring.gpg"
-DEBOOTSTRAP_KEYRING = ""
+DISTRO_BOOTSTRAP_KEYFILES = ""
+THIRD_PARTY_APT_KEYFILES = ""
DEPLOY_ISAR_BOOTSTRAP ?= ""
DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales"
+DISTRO_BOOTSTRAP_BASE_PACKAGES_append_gnupg = ",gnupg2"
DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org file:///${REPO_BASE_DIR} \n" if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) else "" }"
inherit base-apt-helper
python () {
- distro_apt_keys = d.getVar("DISTRO_APT_KEYS", False)
- aptkeys = []
+ distro_bootstrap_keys = (d.getVar("DISTRO_BOOTSTRAP_KEYS", False) or "").split()
- if distro_apt_keys:
- aptkeys += distro_apt_keys.split()
+ third_party_apt_keys = (d.getVar("THIRD_PARTY_APT_KEYS", False) or "").split()
+
+ # The cached repo key can be both for bootstrapping and apt package
+ # installation afterwards. However, debootstrap will include the key into
+ # the rootfs automatically thus the right place is distro_bootstrap_keys.
if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')):
own_pub_key = d.getVar("BASE_REPO_KEY", False)
if own_pub_key:
- aptkeys += own_pub_key.split()
+ distro_bootstrap_keys += own_pub_key.split()
+
+ for key in distro_bootstrap_keys:
+ d.appendVar("SRC_URI", " %s" % key)
+ fetcher = bb.fetch2.Fetch([key], d)
+ filename = fetcher.localpath(key)
+ d.appendVar("DISTRO_BOOTSTRAP_KEYFILES", " %s" % filename)
- d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
- for key in aptkeys:
+ for key in third_party_apt_keys:
d.appendVar("SRC_URI", " %s" % key)
fetcher = bb.fetch2.Fetch([key], d)
filename = fetcher.localpath(key)
- d.appendVar("APTKEYFILES", " %s" % filename)
+ d.appendVar("THIRD_PARTY_APT_KEYFILES", " %s" % filename)
}
def aggregate_files(d, file_list, file_out):
@@ -159,6 +166,14 @@ def get_distro_needs_https_support(d, is_host=False):
else:
return ""
+def get_distro_needs_gpg_support(d):
+ apt_keys = d.getVar("THIRD_PARTY_APT_KEYS", False)
+ if apt_keys and apt_keys != "":
+ return "gnupg"
+ return ""
+
+OVERRIDES_append = ":${@get_distro_needs_gpg_support(d)}"
+
def get_distro_source(d, is_host):
return get_distro_primary_source_entry(d, is_host)[0]
@@ -172,17 +187,26 @@ def get_distro_components_argument(d, is_host):
else:
return ""
-do_generate_keyring[dirs] = "${DL_DIR}"
-do_generate_keyring[vardeps] += "DISTRO_APT_KEYS"
-do_generate_keyring() {
- if [ -n "${@d.getVar("APTKEYFILES", True) or ""}" ]; then
- for keyfile in ${@d.getVar("APTKEYFILES", True)}; do
- gpg --no-default-keyring --keyring "${APTKEYRING}" \
- --no-tty --homedir "${DL_DIR}" --import "$keyfile"
+APT_KEYS_DIR := "${WORKDIR}/aptkeys"
+DISTRO_BOOTSTRAP_KEYRING := "${WORKDIR}/distro-keyring.gpg"
+
+do_generate_keyrings[cleandirs] = "${APT_KEYS_DIR}"
+do_generate_keyrings[dirs] = "${DL_DIR}"
+do_generate_keyrings[vardeps] += "DISTRO_BOOTSTRAP_KEYS THIRD_PARTY_APT_KEYS"
+do_generate_keyrings() {
+ if [ -n "${@d.getVar("THIRD_PARTY_APT_KEYFILES", True) or ""}" ]; then
+ chmod 777 "${APT_KEYS_DIR}"
+ for keyfile in ${@d.getVar("THIRD_PARTY_APT_KEYFILES", True)}; do
+ cp "$keyfile" "${APT_KEYS_DIR}"/"$(basename "$keyfile")"
+ done
+ fi
+ if [ -n "${@d.getVar("DISTRO_BOOTSTRAP_KEYFILES", True) or ""}" ]; then
+ for keyfile in ${@d.getVar("DISTRO_BOOTSTRAP_KEYFILES", True)}; do
+ sudo apt-key --keyring "${DISTRO_BOOTSTRAP_KEYRING}" add $keyfile
done
fi
}
-addtask generate_keyring before do_build after do_unpack
+addtask generate_keyrings before do_build after do_unpack
@@ -206,6 +230,9 @@ isar_bootstrap() {
shift
done
debootstrap_args="--verbose --variant=minbase --include=${DISTRO_BOOTSTRAP_BASE_PACKAGES}"
+ if [ ! "x${DISTRO_BOOTSTRAP_KEYS}" = "x" ]; then
+ debootstrap_args="$debootstrap_args --keyring=${DISTRO_BOOTSTRAP_KEYRING}"
+ fi
if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
if [ -z "${BASE_REPO_KEY}" ] ; then
debootstrap_args="$debootstrap_args --no-check-gpg"
@@ -222,7 +249,6 @@ isar_bootstrap() {
if [ ${IS_HOST} ]; then
${DEBOOTSTRAP} $debootstrap_args \
${@get_distro_components_argument(d, True)} \
- ${DEBOOTSTRAP_KEYRING} \
"${@get_distro_suite(d, True)}" \
"${ROOTFSDIR}" \
"${@get_distro_source(d, True)}"
@@ -231,7 +257,6 @@ isar_bootstrap() {
"${DEBOOTSTRAP}" $debootstrap_args \
--arch="${DISTRO_ARCH}" \
${@get_distro_components_argument(d, False)} \
- ${DEBOOTSTRAP_KEYRING} \
"${@get_distro_suite(d, False)}" \
"${ROOTFSDIR}" \
"${@get_distro_source(d, False)}"
@@ -260,6 +285,14 @@ isar_bootstrap() {
mkdir -p "${ROOTFSDIR}/etc/apt/apt.conf.d"
install -v -m644 "${WORKDIR}/isar-apt.conf" \
"${ROOTFSDIR}/etc/apt/apt.conf.d/50isar.conf"
+ find ${APT_KEYS_DIR}/ -type f | while read keyfile
+ do
+ kfn="$(basename $keyfile)"
+ cp $keyfile "${ROOTFSDIR}/tmp/$kfn"
+ sudo -E chroot "${ROOTFSDIR}" /usr/bin/apt-key \
+ --keyring ${THIRD_PARTY_APT_KEYRING} add "/tmp/$kfn"
+ rm "${ROOTFSDIR}/tmp/$kfn"
+ done
if [ "${@get_distro_suite(d, True)}" = "stretch" ] && [ "${@get_host_release().split('.')[0]}" -lt "4" ]; then
install -v -m644 "${WORKDIR}/isar-apt-fallback.conf" \
--
2.21.0
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v10 3/6] If we use a custom keyring debootstrap may fall to https
2019-05-02 11:37 [PATCH v10 0/6] Fix usage of additional apt keys and repos Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 1/6] Simplify and enhance apt-keyring generator Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 2/6] Use apt-key to generate keyrings Andreas J. Reichel
@ 2019-05-02 11:37 ` Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 4/6] raspbian-stretch: Use DISTRO_BOOTSTRAP_KEYS Andreas J. Reichel
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Andreas J. Reichel @ 2019-05-02 11:37 UTC (permalink / raw)
To: isar-users; +Cc: Andreas Reichel
From: Andreas Reichel <andreas.reichel.ext@siemens.com>
See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891009
So if we have something in the distro bootstrap keyring, append
https-support to OVERRIDES.
Furthermore, the conditional append for https-support was missing
in qemuamd64-stretch.conf, thus, remove this from all the distros
and put it into the isar-bootstrap.inc.
Furthermore, packages are comma-, not space-separated.
Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
---
meta-isar/conf/multiconfig/qemuamd64-buster.conf | 1 -
meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 8 ++++++++
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/meta-isar/conf/multiconfig/qemuamd64-buster.conf b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
index 63df75c..da90993 100644
--- a/meta-isar/conf/multiconfig/qemuamd64-buster.conf
+++ b/meta-isar/conf/multiconfig/qemuamd64-buster.conf
@@ -18,4 +18,3 @@ QEMU_MACHINE ?= "q35"
QEMU_CPU ?= ""
QEMU_DISK_ARGS ?= "-hda ##ROOTFS_IMAGE## -bios /usr/local/share/ovmf/OVMF.fd"
-DISTRO_BOOTSTRAP_BASE_PACKAGES_append_https-support = " apt-transport-https ca-certificates"
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index 835ad52..c6c3cde 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -27,6 +27,7 @@ THIRD_PARTY_APT_KEYFILES = ""
DEPLOY_ISAR_BOOTSTRAP ?= ""
DISTRO_BOOTSTRAP_BASE_PACKAGES = "locales"
DISTRO_BOOTSTRAP_BASE_PACKAGES_append_gnupg = ",gnupg2"
+DISTRO_BOOTSTRAP_BASE_PACKAGES_append_https-support = ",apt-transport-https,ca-certificates"
DISTRO_APT_PREMIRRORS ?= "${@ "http://ftp\.(\S+\.)?debian.org file:///${REPO_BASE_DIR} \n" if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) else "" }"
@@ -161,6 +162,13 @@ def get_distro_have_https_source(d, is_host=False):
return any(source[2].startswith("https://") for source in generate_distro_sources(d, is_host))
def get_distro_needs_https_support(d, is_host=False):
+ distro_bootstrap_keys = d.getVar("DISTRO_BOOTSTRAP_KEYS", False)
+ if distro_bootstrap_keys and distro_bootstrap_keys != "":
+ # debootstrap falls back to https if there is no
+ # 'reliable' keyring, whatever that means, but it happened
+ # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891009
+ return "https-support"
+
if get_distro_have_https_source(d, is_host):
return "https-support"
else:
--
2.21.0
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v10 4/6] raspbian-stretch: Use DISTRO_BOOTSTRAP_KEYS
2019-05-02 11:37 [PATCH v10 0/6] Fix usage of additional apt keys and repos Andreas J. Reichel
` (2 preceding siblings ...)
2019-05-02 11:37 ` [PATCH v10 3/6] If we use a custom keyring debootstrap may fall to https Andreas J. Reichel
@ 2019-05-02 11:37 ` Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 5/6] docs: Update user_manual.md Andreas J. Reichel
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Andreas J. Reichel @ 2019-05-02 11:37 UTC (permalink / raw)
To: isar-users; +Cc: Andreas Reichel
From: Andreas Reichel <andreas.reichel.ext@siemens.com>
Use new DISTRO_BOOTSTRAP_KEYS instead of DISTRO_APT_KEYS
Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
---
meta-isar/conf/distro/raspbian-stretch.conf | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta-isar/conf/distro/raspbian-stretch.conf b/meta-isar/conf/distro/raspbian-stretch.conf
index c6f215b..4c47376 100644
--- a/meta-isar/conf/distro/raspbian-stretch.conf
+++ b/meta-isar/conf/distro/raspbian-stretch.conf
@@ -7,6 +7,6 @@ BASE_DISTRO = "raspbian"
BASE_DISTRO_CODENAME = "stretch"
DISTRO_APT_SOURCES += "conf/distro/raspbian-stretch.list"
-DISTRO_APT_KEYS += "https://archive.raspbian.org/raspbian.public.key;sha256sum=ca59cd4f2bcbc3a1d41ba6815a02a8dc5c175467a59bd87edeac458f4a5345de"
+DISTRO_BOOTSTRAP_KEYS += "https://archive.raspbian.org/raspbian.public.key;sha256sum=ca59cd4f2bcbc3a1d41ba6815a02a8dc5c175467a59bd87edeac458f4a5345de"
DISTRO_CONFIG_SCRIPT ?= "${LAYERDIR_isar}/conf/distro/raspbian-configscript.sh"
DISTRO_KERNELS ?= "rpi rpi2 rpi-rpfv rpi2-rpfv"
--
2.21.0
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v10 5/6] docs: Update user_manual.md
2019-05-02 11:37 [PATCH v10 0/6] Fix usage of additional apt keys and repos Andreas J. Reichel
` (3 preceding siblings ...)
2019-05-02 11:37 ` [PATCH v10 4/6] raspbian-stretch: Use DISTRO_BOOTSTRAP_KEYS Andreas J. Reichel
@ 2019-05-02 11:37 ` Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 6/6] Give keyring to debootstrap when using cached base repo Andreas J. Reichel
2019-05-13 4:57 ` [PATCH v10 0/6] Fix usage of additional apt keys and repos Maxim Yu. Osipov
6 siblings, 0 replies; 8+ messages in thread
From: Andreas J. Reichel @ 2019-05-02 11:37 UTC (permalink / raw)
To: isar-users; +Cc: Andreas Reichel
From: Andreas Reichel <andreas.reichel.ext@siemens.com>
Explain DISTRO_BOOTSTRAP_KEYS and THIRD_PARTY_APT_KEYS.
Give an example on how to use the variables to include docker-ce.
Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
---
doc/user_manual.md | 41 ++++++++++++++++++++++++++++++++++++++++-
1 file changed, 40 insertions(+), 1 deletion(-)
diff --git a/doc/user_manual.md b/doc/user_manual.md
index ba57319..eb877b1 100644
--- a/doc/user_manual.md
+++ b/doc/user_manual.md
@@ -321,6 +321,7 @@ Some other variables include:
- `HOST_DISTRO_APT_SOURCES` - List of apt source files for SDK root filesystem. This variable is optional.
- `HOST_DISTRO_APT_PREFERENCES` - List of apt preference files for SDK root filesystem. This variable is optional.
- `DISTRO_APT_PREMIRRORS` - The preferred mirror (append it to the default URI in the format `ftp.debian.org my.preferred.mirror`. This variable is optional.
+ - `THIRD_PARTY_APT_KEYS` - List of gpg key URIs used to verify apt repos for apt installation after bootstrapping
- `CFG_ROOT_PW` - The encrypted root password to be set. To encrypt password use `mkpasswd`. You find `mkpasswd` in the `whois` package of Debian. If the variable is empty, root login is passwordless.
- `CFG_ROOT_LOCKED` - If set to `1` the root account will be locked.
@@ -368,10 +369,12 @@ Isar can generate various images types for specific machine. The type of the ima
The distro is defined by the set of the following variables:
- `DISTRO_APT_SOURCES` - List of apt source files
- - `DISTRO_APT_KEYS` - List of gpg key URIs used to verify apt repos
+ - `DISTRO_BOOTSTRAP_KEYS` - List of gpg key URIs used to verify apt bootstrap repo
- `DISTRO_APT_PREFERENCES` - List of apt preference files
- `DISTRO_KERNELS` - List of supported kernel suffixes
+The first entry of DISTRO_APT_SOURCES is used for bootstrapping.
+
Below is an example for Raspbian Stretch:
```
DISTRO_APT_SOURCES += "conf/distro/raspbian-stretch.list"
@@ -783,3 +786,39 @@ bitbake multiconfig:qemuarm-stretch:isar-image-base
### Limitation
Files fetched with the `SRC_URI` protocol "apt://" are not yet cached.
+
+## Add foreign packages from other repositories to the generated image
+
+### Motivation
+
+When building embedded systems with Isar, one might want to include packages that are not provided by debian by default. One example is docker-ce.
+
+### Approach/Solution
+
+Add a new sources list entry to fetch the package from, i.e. include a new apt source mirror. Then add the needed apt key for the third party repository. Add the wanted package to the IMAGE_PREINSTALL variable.
+
+### Example
+
+Add docker-ce from arm64:
+
+Create a new layer containing `conf/distro/docker-stretch.list` with the following content:
+
+```
+deb [arch=arm64] https://download.docker.com/linux/debian stretch stable
+```
+
+Include the layer in your project.
+
+To the local.conf add:
+
+```
+IMAGE_PREINSTALL += "docker-ce"
+THIRD_PARTY_APT_KEYS_append = " https://download.docker.com/linux/debian/gpg;md5sum=1afae06b34a13c1b3d9cb61a26285a15"
+DISTRO_APT_SOURCES_append = " conf/distro/docker-stretch.list"
+```
+
+And build the corresponding image target:
+
+```
+bitbake multiconfig:qemuarm64-stretch:isar-image-base
+```
--
2.21.0
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v10 6/6] Give keyring to debootstrap when using cached base repo
2019-05-02 11:37 [PATCH v10 0/6] Fix usage of additional apt keys and repos Andreas J. Reichel
` (4 preceding siblings ...)
2019-05-02 11:37 ` [PATCH v10 5/6] docs: Update user_manual.md Andreas J. Reichel
@ 2019-05-02 11:37 ` Andreas J. Reichel
2019-05-13 4:57 ` [PATCH v10 0/6] Fix usage of additional apt keys and repos Maxim Yu. Osipov
6 siblings, 0 replies; 8+ messages in thread
From: Andreas J. Reichel @ 2019-05-02 11:37 UTC (permalink / raw)
To: isar-users; +Cc: Andreas Reichel
From: Andreas Reichel <andreas.reichel.ext@siemens.com>
When using ISAR_USE_CACHED_BASE_REPO = 1, the keyring for debootstrap
has to be specified to which the user key for signing was added.
Signed-off-by: Andreas Reichel <andreas.reichel.ext@siemens.com>
---
meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index c6c3cde..09aed83 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -238,7 +238,8 @@ isar_bootstrap() {
shift
done
debootstrap_args="--verbose --variant=minbase --include=${DISTRO_BOOTSTRAP_BASE_PACKAGES}"
- if [ ! "x${DISTRO_BOOTSTRAP_KEYS}" = "x" ]; then
+ if [ ! "x${DISTRO_BOOTSTRAP_KEYS}" = "x" ] || \
+ [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
debootstrap_args="$debootstrap_args --keyring=${DISTRO_BOOTSTRAP_KEYRING}"
fi
if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
--
2.21.0
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v10 0/6] Fix usage of additional apt keys and repos
2019-05-02 11:37 [PATCH v10 0/6] Fix usage of additional apt keys and repos Andreas J. Reichel
` (5 preceding siblings ...)
2019-05-02 11:37 ` [PATCH v10 6/6] Give keyring to debootstrap when using cached base repo Andreas J. Reichel
@ 2019-05-13 4:57 ` Maxim Yu. Osipov
6 siblings, 0 replies; 8+ messages in thread
From: Maxim Yu. Osipov @ 2019-05-13 4:57 UTC (permalink / raw)
To: Andreas J. Reichel, isar-users
On 5/2/19 1:37 PM, Andreas J. Reichel wrote:
> From: Andreas Reichel <andreas.reichel.ext@siemens.com>
Applied to the 'next',
Thanks,
Maxim.
> Diff to v9: Tell debootstrap the keyring to use when
> ISAR_USE_CACHED_BASE_REPO = 1. This was missing.
>
> Andreas Reichel (6):
> Simplify and enhance apt-keyring generator
> Use apt-key to generate keyrings
> If we use a custom keyring debootstrap may fall to https
> raspbian-stretch: Use DISTRO_BOOTSTRAP_KEYS
> docs: Update user_manual.md
> Give keyring to debootstrap when using cached base repo
>
> doc/user_manual.md | 41 +++++++-
> meta-isar/conf/distro/raspbian-stretch.conf | 2 +-
> .../conf/multiconfig/qemuamd64-buster.conf | 1 -
> meta/conf/bitbake.conf | 1 +
> .../isar-bootstrap/isar-bootstrap-host.bb | 4 +-
> .../isar-bootstrap/isar-bootstrap-target.bb | 4 +-
> .../isar-bootstrap/isar-bootstrap.inc | 96 +++++++++++++------
> 7 files changed, 115 insertions(+), 34 deletions(-)
>
--
Maxim Osipov
ilbers GmbH
Maria-Merian-Str. 8
85521 Ottobrunn
Germany
+49 (151) 6517 6917
mosipov@ilbers.de
http://ilbers.de/
Commercial register Munich, HRB 214197
General Manager: Baurzhan Ismagulov
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2019-05-13 4:57 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-02 11:37 [PATCH v10 0/6] Fix usage of additional apt keys and repos Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 1/6] Simplify and enhance apt-keyring generator Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 2/6] Use apt-key to generate keyrings Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 3/6] If we use a custom keyring debootstrap may fall to https Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 4/6] raspbian-stretch: Use DISTRO_BOOTSTRAP_KEYS Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 5/6] docs: Update user_manual.md Andreas J. Reichel
2019-05-02 11:37 ` [PATCH v10 6/6] Give keyring to debootstrap when using cached base repo Andreas J. Reichel
2019-05-13 4:57 ` [PATCH v10 0/6] Fix usage of additional apt keys and repos Maxim Yu. Osipov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox