Merge ~bdrung/ddeb-retriever/+git/main:fix-2002833 into ddeb-retriever:main

[Steve Langasek]

[Steve Langasek (vorlon)]

review: Needs Fixing

[Benjamin Drung (bdrung)]

Good point. Implemented atomic file replacement.

The import sorting is correct, because imports are grouped by standard library, third-party, and own libraries. apt_pkg is the only third-party library.

[Steve Langasek (vorlon)]

review: Approve

diff --git a/archive_tools.py b/archive_tools.py
index 656b27b..c8cf1aa 100644
--- a/archive_tools.py
+++ b/archive_tools.py
@@ -10,22 +10,25 @@ option) any later version.  See http://www.gnu.org/copyleft/gpl.html for
 the full text of the license.
 '''
 
-import apt_pkg
-import urllib
-import os
-import gzip
 import bz2
+import contextlib
+import glob
+import gzip
+import logging
 import lzma
-import tempfile
+import os
 import os.path
 import shutil
+import subprocess
 import tarfile
+import tempfile
 import time
-import subprocess
-import glob
-import logging
+import typing
+import urllib
 from io import StringIO
 
+import apt_pkg
+
 apt_pkg.init_system()
 
 
@@ -191,6 +194,32 @@ def install_pool(archive_root, file_path, component, source):
     return True
 
 
+def _generate_release_signatures(gpg_keyid: typing.Optional[str], stderr: int) -> None:
+    gpg = ["gpg", "-as", "--batch", "--personal-digest-preferences", "SHA512,SHA256,SHA1"]
+    if gpg_keyid:
+        gpg += ["--default-key", gpg_keyid]
+
+    with contextlib.suppress(FileNotFoundError):
+        os.unlink(".InRelease.new")
+    subprocess.run(
+        gpg + ["--clearsign", "-o", ".InRelease.new", "Release"],
+        check=True,
+        stdout=subprocess.PIPE,
+        stderr=stderr,
+    )
+    os.rename(".InRelease.new", "InRelease")
+
+    with contextlib.suppress(FileNotFoundError):
+        os.unlink(".Release.gpg.new")
+    subprocess.run(
+        gpg + ["-b", "-o", ".Release.gpg.new", "Release"],
+        check=True,
+        stdout=subprocess.PIPE,
+        stderr=stderr,
+    )
+    os.rename(".Release.gpg.new", "Release.gpg")
+
+
 def create_indexes(archive_root, pocket, components, archs, ext='.deb',
                    stderr=subprocess.PIPE, ref_archive=None, gpg_sign=False,
                    gpg_keyid=None):
@@ -309,16 +338,7 @@ Tree "dists/%s" {
         with open('Release', 'wb') as r:
             r.write(out)
         if gpg_sign:
-            try:
-                os.unlink('Release.gpg')
-            except OSError:
-                pass
-            gpg = ['gpg', '-abs', '--batch',
-                   '--personal-digest-preferences', 'SHA512,SHA256,SHA1']
-            if gpg_keyid:
-                gpg += ['--default-key', gpg_keyid]
-            gpg += ['-o', 'Release.gpg', 'Release']
-            assert subprocess.call(gpg, stdout=subprocess.PIPE, stderr=stderr) == 0
+            _generate_release_signatures(gpg_keyid, stderr)
     finally:
         os.chdir(old_cwd)
         if os.path.isdir(os.path.join(archive_root, 'lists')):
@@ -550,8 +570,8 @@ Description: dummy package
 # Test suite
 #
 
-import unittest
 import sys
+import unittest
 
 
 class _DebcontrolMapTest(unittest.TestCase):
diff --git a/ddeb_retriever.py b/ddeb_retriever.py
index f7b30be..2f1ac4d 100644
--- a/ddeb_retriever.py
+++ b/ddeb_retriever.py
@@ -1,16 +1,16 @@
 #!/usr/bin/python3
-import os
-import logging
-import urllib
 import argparse
-import fcntl
 import datetime
+import fcntl
+import logging
+import os
+import urllib
 
 import requests
 import wadllib.iso_strptime
 
-import lpinfo
 import archive_tools
+import lpinfo
 
 
 def parse_args(args=None):