Merge ~ebarretto/ubuntu-security-tools:apt-key into ubuntu-security-tools:master

[Eduardo Barretto]

This is a proposal on fixing umt compare-bin on systems that already don't use /etc/apt/trusted.gpg as apt-key was deprecated.
In this proposal we are using /etc/apt/keyrings, that is not an official directory but a recommendation for thirdparty keyrings:
"If future updates to the certificate will be managed by an apt/dpkg package as recommended below, then it SHOULD be downloaded into /usr/share/keyrings using the same filename that will be provided by the package. If it will be managed locally , it SHOULD be downloaded into /etc/apt/keyrings instead."
https://wiki.debian.org/DebianRepository/UseThirdParty

Also altered build-sources-list as it was setting the signed-by entry only for trusty, xenial and bionic, and for newer systems we should have the signed-by for all running releases.

Any feedbacks or suggestions are very much appreciated.

[Marc Deslauriers (mdeslaur)]

I thought /etc/apt/keyrings was untrusted by default, so we should still need the "signed-by=" in build-sources-list, but changed to the new path, no?

[Marc Deslauriers (mdeslaur)]

Oh, never mind my comment, I see you set it further down now.

[Paulo Flabiano Smorigo (pfsmorigo)]

LGTM

diff --git a/build-tools/build-sources-list b/build-tools/build-sources-list
index c944bb9..f4a20c6 100755
--- a/build-tools/build-sources-list
+++ b/build-tools/build-sources-list
@@ -143,10 +143,6 @@ EOM
         echo "# Requires gpg keyid DBB1FC89762BF6B96707C4059BC0A1A1622CF918 stored in ${ESM_PPA_KEYRING}"
     # normal ubuntu releases.
     else
-        keyring=""
-        if [ "$r" = "trusty" ] || [ "$r" = "xenial" ] || [ "$r" = "bionic" ]; then
-            keyring="[signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg]"
-        fi
         if [ "$r" = "precise" ] ; then
             # releases where the archive key is no longer trusted
             cat <<EOM
@@ -168,6 +164,20 @@ EOM
             # echo "deb-src http://archive.canonical.com/ubuntu $r partner"
         fi
 
+        sharedkeyring="/usr/share/keyrings"
+        keyringsdir="/etc/apt/keyrings"
+        keyringfile="ubuntu-archive-keyring.gpg"
+        keyring="[signed-by=$keyringsdir/$keyringfile]"
+
+        if [ ! -d "$keyringsdir" ]; then
+            mkdir "$keyringsdir"
+        fi
+        if [ ! -f "$sharedkeyring/$keyringfile" ]; then
+            echo "Make sure you install ubuntu-keyring!"
+            exit 1
+        else
+            sudo cp "$sharedkeyring/$keyringfile" "$keyringsdir"
+        fi
 
         if [ "$add_fallbacks" = "yes" ] && [ "$r" != "$release_devel" ]; then
             cat <<EOM
diff --git a/build-tools/umt b/build-tools/umt
index 4237ff4..ce02735 100755
--- a/build-tools/umt
+++ b/build-tools/umt
@@ -1370,6 +1370,7 @@ Dir "/"
   Etc "%s/" {
      trusted "/etc/apt/trusted.gpg";
      trustedparts "/etc/apt/trusted.gpg.d";
+     trustedparts "/etc/apt/keyrings";
   };
 
   // Location of the logfile