Re: Additional debian repo with different pgp key

["Maxim Yu. Osipov" <mosipov@ilbers.de>]

Hi Andreas.

This is known problem - I've faced it when tried to add signed repo
https://obs.linaro.org/project/show/linaro-overlay-stretch (this is not 
full debian repo - it just contains some linaro packages).

DISTRO_APT_KEYS doesn't fit this requirement as is used only as primary 
repo and passed directly to debootstrap overriding default keyring.

--keyring=KEYRING
         Override the default keyring for the distribution being 
bootstrapped, and use KEYRING to check signatures of retrieved Release 
files.

Patches are welcomed.

Maxim.

On 2/15/19 4:16 PM, Andreas Reichel wrote:
> Hi,
> 
> I have a problem with using a separate docker repository together with
> its key.
> 
> As far as I understood it, I have to do the following:
> 
> 1st, create a list file which mentions the docker repository:
> 
> So I created a docker-stretch.list, where I have the line
> 
> ----
> deb	http://download.docker.com/linux/debian	stretch	stable
> ----
> 
> This file is added via
> 
> ----
> DISTRO_APT_SOURCES_append = " conf/distro/docker-stretch.list"
> ----
> 
> which is working.
> 
> Then I add the `docker-ce` package to `IMAGE_PREINSTALL` which does not
> work because the package is untrusted. Therefore I have to import the
> pgp key, which I should be able to do with
> 
> 2nd: add the key to apt keys:
> 
> ----
> DISTRO_APT_KEYS_append = " https://download.docker.com/linux/debian/gpg;sha256sum=1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570"
> ----
> 
> However, then I get the following error:
> 
> ----
> | DEBUG: Executing shell function do_generate_keyring
> | gpg: WARNING: unsafe permissions on homedir '/build/build/downloads'
> | gpg: keybox '/build/build/tmp/work/debian-stretch-arm64/isar-bootstrap-target/apt-keyring.gpg' created
> | gpg: can't open '/build/build/tmp/work/debian-stretch-arm64/isar-bootstrap-target/linux/debian/gpg': No such file or directory
> | gpg: Total number processed: 0
> | WARNING: exit code 2 from a shell command.
> 
> ----
> 
> It seems, that the last part of the URL is appended to the working
> directory. But the resulting directory does not exist.  What is the
> intended course of action for this standard scenario to use another
> debian repo for image building?
> 
> Last patch I saw on next was about local keys. But standard should be
> remote keys with URI I think, because every repo that needs one should
> provide one this way... am I wrong?
> 
> vG
> Andreas
> 


-- 
Maxim Osipov
ilbers GmbH
Maria-Merian-Str. 8
85521 Ottobrunn
Germany
+49 (151) 6517 6917
mosipov@ilbers.de
http://ilbers.de/
Commercial register Munich, HRB 214197
General Manager: Baurzhan Ismagulov