Skip to content

Commit e4c5ae4

Browse files
tabrisnettabrisnet
authored
framework mmdebstrap, fetch_distro_keyring - use cached keyring pkgs from armbian.github.io (#8881)
followup to #8785, armbian/armbian.github.io#82 & armbian/armbian.github.io#85 Pull the latest keyring pkgs from armbian's github mirror
1 parent 7339b7e commit e4c5ae4

File tree

1 file changed

+26
-55
lines changed

1 file changed

+26
-55
lines changed

‎lib/functions/rootfs/distro-specific.sh‎

Lines changed: 26 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -85,75 +85,44 @@ function fetch_distro_keyring() {
8585
exit_with_error "fetch_distro_keyring failed" "unrecognized release: $release"
8686
esac
8787

88-
declare -a PROXY
89-
case "${MANAGE_ACNG}" in
90-
yes)
91-
PROXY+=('-x' 'http://localhost:3142/')
92-
;;
93-
no) ;& #fallthrough
94-
"")
95-
PROXY+=('') # don't use a proxy
96-
;; # stop falling
97-
*)
98-
PROXY+=('-x' "${MANAGE_ACNG}")
99-
;;
100-
esac
101-
10288
CACHEDIR="/armbian/cache/keyrings/$distro"
10389
mkdir -p "${CACHEDIR}"
10490
case $distro in
91+
#FIXME: there may be a point where we need an *older* keyring pkg
92+
# NOTE: this will be most likely an unsupported case like a user wanting to build using an ancient debian/ubuntu release
10593
debian)
10694
if [ -e "${CACHEDIR}/debian-archive-keyring.gpg" ]; then
10795
display_alert "fetch_distro_keyring($release)" "cache found, skipping" "info"
10896
else
109-
# FIXME: should this be a loop? might allow more parameterization and shorter lines to read.
110-
PKG_URL=$(curl --compressed -Ls 'https://packages.debian.org/sid/all/debian-archive-keyring/download' | \
111-
grep -oP 'http://(deb|ftp)\.debian\.org/debian/pool/main/d/debian-archive-keyring/debian-archive-keyring_[0-9.]*_[a-zA-Z0-9]*\.deb')
112-
[[ -z "${PKG_URL}" ]] && exit_with_error "fetch_distro_keyring failed" "unable to find newest debian-archive-keyring package"
113-
run_host_command_logged curl "${PROXY[@]}" -fLOJ --output-dir "${CACHEDIR}" "${PKG_URL}" || \
114-
exit_with_error "fetch_distro_keyring failed" "unable to download ${PKG_URL}"
115-
KEYRING_DEB=$(basename "${PKG_URL}")
116-
# We ignore the failures of unpacking b/c we cannot tell the difference between unpack failures and chmod/chgrp failures
117-
dpkg-deb -x "${CACHEDIR}/${KEYRING_DEB}" "${CACHEDIR}" || /bin/true # ignore failures, we'll check a few lines down
118-
if [[ -e "${CACHEDIR}/usr/share/keyrings/debian-archive-keyring.pgp" ]]; then
119-
# yes, for 2025.1, the canonical name is .pgp, but our tools expect .gpg.
120-
# the package contains the .pgp and a .gpg symlink to it.
121-
cp -l "${CACHEDIR}/usr/share/keyrings/debian-archive-keyring.pgp" "${CACHEDIR}/debian-archive-keyring.gpg"
122-
elif [[ -e "${CACHEDIR}/usr/share/keyrings/debian-archive-keyring.gpg" ]]; then
123-
cp -l "${CACHEDIR}/usr/share/keyrings/debian-archive-keyring.gpg" "${CACHEDIR}/debian-archive-keyring.gpg"
124-
else
125-
exit_with_error "fetch_distro_keyring" "unable to find debian-archive-keyring.gpg"
126-
fi
127-
128-
PKG_URL=$(curl --compressed -Ls 'https://packages.debian.org/sid/all/debian-ports-archive-keyring/download' | \
129-
grep -oP 'http://(deb|ftp)\.debian\.org/debian/pool/main/d/debian-ports-archive-keyring/debian-ports-archive-keyring_[0-9.]*_[a-zA-Z0-9]*\.deb')
130-
[[ -z "${PKG_URL}" ]] && exit_with_error "fetch_distro_keyring failed" "unable to find newest debian-ports-archive-keyring package"
131-
run_host_command_logged curl "${PROXY[@]}" -fLOJ --output-dir "${CACHEDIR}" "${PKG_URL}" || \
132-
exit_with_error "fetch_distro_keyring failed" "unable to download ${PKG_URL}"
133-
KEYRING_DEB=$(basename "${PKG_URL}")
134-
dpkg-deb -x "${CACHEDIR}/${KEYRING_DEB}" "${CACHEDIR}" || /bin/true # see above about ignoring errors
135-
if [[ -e "${CACHEDIR}/usr/share/keyrings/debian-ports-archive-keyring.pgp" ]]; then
136-
# see above comment re .pgp vs .gpg
137-
cp -l "${CACHEDIR}/usr/share/keyrings/debian-ports-archive-keyring.pgp" "${CACHEDIR}/debian-ports-archive-keyring.gpg"
138-
elif [[ -e "${CACHEDIR}/usr/share/keyrings/debian-ports-archive-keyring.gpg" ]]; then
139-
cp -l "${CACHEDIR}/usr/share/keyrings/debian-ports-archive-keyring.gpg" "${CACHEDIR}/debian-ports-archive-keyring.gpg"
140-
else
141-
exit_with_error "fetch_distro_keyring" "unable to find debian-ports-archive-keyring.gpg"
142-
fi
97+
# for details of how this gets into this mirror, see
98+
# github.com/armbian/armbian.github.io/ .github/workflows/generate-keyring-data.yaml
99+
for p in debian-archive-keyring debian-ports-archive-keyring; do
100+
# if we use http://, we'll get a 301 to https://, but this means we can't use a caching proxy like ACNG
101+
PKG_URL="https://github.armbian.com/keyrings/latest-${p}.deb"
102+
run_host_command_logged curl -fLOJ --output-dir "${CACHEDIR}" "${PKG_URL}" || \
103+
exit_with_error "fetch_distro_keyring failed" "unable to download ${PKG_URL}"
104+
KEYRING_DEB=$(basename "${PKG_URL}")
105+
# We ignore errors from dpkg-deb/tar b/c we cannot tell the difference between unpack failures and chmod/chgrp failures
106+
dpkg-deb -x "${CACHEDIR}/${KEYRING_DEB}" "${CACHEDIR}" || /bin/true # ignore failures, we'll check a few lines down
107+
if [[ -e "${CACHEDIR}/usr/share/keyrings/${p}.pgp" ]]; then
108+
# yes, the canonical name is .pgp, but our tools expect .gpg.
109+
# the package contains the .pgp and a .gpg symlink to it.
110+
cp -l "${CACHEDIR}/usr/share/keyrings/${p}.pgp" "${CACHEDIR}/${p}.gpg"
111+
elif [[ -e "${CACHEDIR}/usr/share/keyrings/${p}.gpg" ]]; then
112+
cp -l "${CACHEDIR}/usr/share/keyrings/${p}.gpg" "${CACHEDIR}/${p}.gpg"
113+
else
114+
exit_with_error "fetch_distro_keyring" "unable to find ${p}.gpg"
115+
fi
116+
done
143117
display_alert "fetch_distro_keyring($release)" "extracted" "info"
144118
fi
145119
;;
146120
ubuntu)
147121
if [ -e "${CACHEDIR}/ubuntu-archive-keyring.gpg" ]; then
148122
display_alert "fetch_distro_keyring($release)" "cache found, skipping" "info"
149123
else
150-
NEWEST_SUITE=$(curl --compressed -Ls https://changelogs.ubuntu.com/meta-release | grep 'Dist:'|tail -n 1 | awk '{print $NF}')
151-
PKG_URL=$(curl --compressed -Ls "https://packages.ubuntu.com/${NEWEST_SUITE}/all/ubuntu-keyring/download" | \
152-
grep -oP 'http://\S+\.deb' |grep archive.ubuntu.com|tail -n 1)
153-
[[ -z "${PKG_URL}" ]] && exit_with_error "fetch_distro_keyring failed" "unable to find newest ubuntu-keyring package"
154-
# ubuntu gives a long list of regional mirrors, we want as generic as possible
155-
PKG_URL=$(echo "${PKG_URL}" | sed -E 's/[a-z0-9]+\.archive/archive/')
156-
run_host_command_logged curl "${PROXY[@]}" -fLOJ --output-dir "${CACHEDIR}" "${PKG_URL}" || \
124+
PKG_URL="https://github.armbian.com/keyrings/latest-ubuntu-keyring.deb"
125+
run_host_command_logged curl -fLOJ --output-dir "${CACHEDIR}" "${PKG_URL}" || \
157126
exit_with_error "fetch_distro_keyring failed" "unable to download ${PKG_URL}"
158127
KEYRING_DEB=$(basename "${PKG_URL}")
159128
dpkg-deb -x "${CACHEDIR}/${KEYRING_DEB}" "${CACHEDIR}" || /bin/true # see above in debian block about ignoring errors
@@ -165,6 +134,8 @@ function fetch_distro_keyring() {
165134
fi
166135
debootstrap_arguments+=("--keyring=/usr/share/keyrings/ubuntu-archive-keyring.gpg")
167136
;;
137+
*)
138+
exit_with_error "fetch_distro_keyring" "unrecognized distro: $distro"
168139
esac
169140
# cp -l may break here if it's cross-filesystem
170141
# copy everything to the "host" inside the container

0 commit comments

Comments
 (0)