Merge lp:~laney/debian-cd/focal into lp:~ubuntu-cdimage/debian-cd/ubun3

[Iain Lane]

Various fixes to make debian-cd work on focal (ancientminister, new cdimage host). I tried to retain compatibility with xenial (nusakan) - the changes have been tested there in isolation but I've not actually pulled an updated debian-cd to test them end-to-end.

Mainly gpg and some apt-related changes.

I could split this up into logical MPs if you want (but bzr...).

[Iain Lane (laney)]

This and https://code.launchpad.net/~ubuntu-cdimage/ubuntu-cdimage/focal/+merge/386317 depend on each other

[Iain Lane (laney)]

NO. Wrong target branch.

[Steve Langasek (vorlon)]

review: Needs Information

[lp:~laney/debian-cd/focal]

2072. By Iain Lane on 2020-06-25

Makefile: Handle the keyring being present in -security/-updates/-proposed

This is a bit involved, since we need to find the newest one and use that.

[Iain Lane (laney)]

Ok, now it handles updates/security/proposed if they're enabled.

(I'm just trying a build of xenial and will reply again if that fails.)

[lp:~laney/debian-cd/focal]

2073. By Iain Lane on 2020-06-25

Makefile: Print when extracting the keyring

Useful for debugging when reading the logs later

2074. By Iain Lane on 2020-06-25

Makefile: Make keyrings from /usr/share/keyrings/ available too

Old versions of ubuntu-keyring shipped keys here. In case of collisions, we
prefer ones from trusted.gpg.d.

[Steve Langasek (vorlon)]

Approved, provided it actually works :)

review: Approve

=== modified file 'CONF.sh'
--- CONF.sh	2020-05-28 18:25:34 +0000
+++ CONF.sh	2020-06-25 13:29:16 +0000
@@ -15,8 +15,7 @@
 #unset LOCAL             || true
 #unset LOCALDEBS         || true
 unset SECURED           || true
-unset SECRET_KEYRING    || true
-unset PUBLIC_KEYRING    || true
+unset GPG_HOMEDIR       || true
 unset SIGNING_KEYID     || true
 unset SECURITY          || true
 unset BOOTDIR           || true
@@ -408,13 +407,11 @@
 case $DIST in
   warty) ;;
   hoary|breezy|dapper|edgy|feisty|gutsy|hardy|intrepid|jaunty|karmic|lucid|maverick|natty|oneiric|precise|quantal|raring|saucy|trusty|utopic|vivid|wily)
-    export SECRET_KEYRING=$CDIMAGE_ROOT/secret/dot-gnupg/secring.gpg
-    export PUBLIC_KEYRING=$CDIMAGE_ROOT/secret/dot-gnupg/pubring.gpg
+    export GPG_HOMEDIR=$CDIMAGE_ROOT/secret/dot-gnupg/
     export SIGNING_KEYID=C5986B4F1257FFA86632CBA746181433FBB75451
     ;;
   *)
-    export SECRET_KEYRING=$CDIMAGE_ROOT/secret/dot-gnupg/secring.gpg
-    export PUBLIC_KEYRING=$CDIMAGE_ROOT/secret/dot-gnupg/pubring.gpg
+    export GPG_HOMEDIR=$CDIMAGE_ROOT/secret/dot-gnupg/
     export SIGNING_KEYID=843938DF228D22F7B3742BC0D94AA3F0EFE21092
     ;;
 esac

=== modified file 'Makefile'
--- Makefile	2020-04-14 08:35:21 +0000
+++ Makefile	2020-06-25 13:29:16 +0000
@@ -89,6 +89,9 @@
 ifndef HOOK
 HOOK=$(BASEDIR)/tools/$(CODENAME).hook
 endif
+ifndef ARCHIVE_KEYRING_PACKAGE
+ARCHIVE_KEYRING_PACKAGE=ubuntu-keyring
+endif
 ifneq "$(wildcard $(MIRROR)/dists/$(DI_CODENAME)/main/disks-$(ARCH))" ""
 ifndef BOOTDISKS
 export BOOTDISKS=$(MIRROR)/dists/$(DI_CODENAME)/main/disks-$(ARCH)
@@ -377,12 +380,88 @@
 
 ## STATUS and APT ##
 
+# Some series (< xenial) don't have xz indices
+INDEX_EXTENSION=xz
+INDEX_DECOMPRESSOR=xzcat
+INDICES=$(wildcard $(MIRROR)/dists/$(CODENAME)*/*/binary-$(ARCH)/Packages.$(INDEX_EXTENSION))
+
+ifeq (,$(INDICES))
+INDEX_EXTENSION=gz
+INDEX_DECOMPRESSOR=zcat
+endif # $(INDICES)
+
+FIND_VERSION_FILENAME=$(shell $(INDEX_DECOMPRESSOR) $(MIRROR)/dists/$(CODENAME)$(1)/main/binary-$(ARCH)/Packages.$(INDEX_EXTENSION) | grep-dctrl -n -X -FPackage -sVersion,Filename $(ARCHIVE_KEYRING_PACKAGE))
+VERSION_GT=$(shell dpkg --compare-version $(1) gt $(2) && echo yes)
+
+ifeq (1,$(PROPOSED))
+PROPOSED_VERSION_FILENAME=$(call FIND_VERSION_FILENAME,-proposed)
+KEYRING_VERSION=$(firstword $(PROPOSED_VERSION_FILENAME))
+KEYRING_FILENAME=$(lastword $(PROPOSED_VERSION_FILENAME))
+endif # $(PROPOSED)
+
+ifeq (1,$(UPDATES))
+UPDATES_VERSION_FILENAME=$(call FIND_VERSION_FILENAME,-updates)
+UPDATES_VERSION=$(firstword $(UPDATES_VERSION_FILENAME))
+
+ifneq (,$(UPDATES_VERSION))
+ifneq (,$(KEYRING_VERSION))
+ifeq (yes,$(call VERSION_GT,$(UPDATES_VERSION),$(KEYRING_VERSION)))
+KEYRING_VERSION=$(UPDATES_VERSION)
+KEYRING_FILENAME=$(lastword $(UPDATES_VERSION_FILENAME))
+endif # $(VERSION_GT)
+else # $(KEYRING_VERSION)
+KEYRING_VERSION=$(UPDATES_VERSION)
+KEYRING_FILENAME=$(lastword $(UPDATES_VERSION_FILENAME))
+endif # $(KEYRING_VERSION)
+endif # $(UPDATES_VERSION)
+
+endif # $(UPDATES)
+
+# SECURITY isn't a bool, it's a string pointing to the security mirror
+ifneq (,$(SECURITY))
+SECURITY_VERSION_FILENAME=$(call FIND_VERSION_FILENAME,-security)
+SECURITY_VERSION=$(firstword $(SECURITY_VERSION_FILENAME))
+
+ifneq (,$(SECURITY_VERSION))
+ifneq (,$(KEYRING_VERSION))
+ifeq (yes,$(call VERSION_GT,$(SECURITY_VERSION),$(KEYRING_VERSION)))
+KEYRING_VERSION=$(SECURITY_VERSION)
+KEYRING_FILENAME=$(lastword $(SECURITY_VERSION_FILENAME))
+endif # $(VERSION_GT)
+else # $(KEYRING_VERSION)
+KEYRING_VERSION=$(SECURITY_VERSION)
+KEYRING_FILENAME=$(lastword $(SECURITY_VERSION_FILENAME))
+endif # $(KEYRING_VERSION)
+endif # $(SECURITY_VERSION)
+
+endif # $(SECURITY)
+
+# We don't have a -security, -proposed or -updates keyring. Use the one in release.
+ifeq ($(KEYRING_FILENAME),)
+KEYRING_FILENAME=$(lastword $(call FIND_VERSION_FILENAME))
+endif # $(KEYRING_FILENAME)
+
 # Regenerate the status file with only packages that
 # are of priority standard or higher
 status: init $(ADIR)/status
 $(ADIR)/status:
 	@echo "Generating a fake status file for apt-get and apt-cache..."
 	:> $(ADIR)/status
+	@echo "Setting up archive-keyring"
+	$(Q)mkdir -p $(TDIR)/archive-keyring
+	@echo "Will extract $(MIRROR)/$(KEYRING_FILENAME) to $(TDIR)/archive-keyring"
+	$(Q)dpkg -x $(MIRROR)/$(KEYRING_FILENAME) $(TDIR)/archive-keyring
+	$(Q)mkdir -p $(ADIR)/apt/trusted.gpg.d
+	$(Q)for file in $(TDIR)/archive-keyring/etc/apt/trusted.gpg.d/*; do \
+		if [ -e $$file ]; then \
+			ln -s $$file $(ADIR)/apt/trusted.gpg.d/$$(basename $$file); \
+		fi; \
+	done
+	$(Q)for file in $(TDIR)/archive-keyring/usr/share/keyrings/*; do \
+		if [ -e $$file ] && ! [ -e $(ADIR)/apt/trusted.gpg.d/$$(basename $$file) ]; then \
+			ln -s $$file $(ADIR)/apt/trusted.gpg.d/$$(basename $$file); \
+		fi; \
+	done
 	# Updating the apt database
 	$(Q)$(apt) update
 	#

=== modified file 'tools/add_secured'
--- tools/add_secured	2020-06-21 00:34:07 +0000
+++ tools/add_secured	2020-06-25 13:29:16 +0000
@@ -8,11 +8,8 @@
 # Complete the "Release" file if it exists
 
 sign_release () {
-    if [ "$SECRET_KEYRING" ] && [ "$SIGNING_KEYID" ]; then
-	GPGKEYRINGOPTS="--secret-keyring $SECRET_KEYRING"
-	if [ "$PUBLIC_KEYRING" ]; then
-	    GPGKEYRINGOPTS="$GPGKEYRINGOPTS --keyring $PUBLIC_KEYRING"
-	fi
+    if [ "$GPG_HOMEDIR" ] && [ "$SIGNING_KEYID" ]; then
+	GPGKEYRINGOPTS="--homedir $GPG_HOMEDIR"
 	gpg $GPGKEYRINGOPTS --default-key "$SIGNING_KEYID" \
 	    --no-options --batch --no-tty --armour \
 	    --digest-algo SHA512 --detach-sign < "$1" > "$1.gpg"