TT#36350 Remove downloading of gpg file

There is ngcp-keyring package in squashfs of grml-sipwise iso so no need
to add it manually.

Change-Id: Ifa22d3534f2180e6e97000d45041857074e8485f

templates/scripts/includes/deployment.sh

@@ -91,11 +91,7 @@ VIRTUALBOX_DIR="/usr/share/virtualbox"
 VIRTUALBOX_ISO="VBoxGuestAdditions_5.2.26.iso"
 VIRTUALBOX_ISO_CHECKSUM="b927c5d0d4c97a9da2522daad41fe96b616ed06bfb0c883f9c42aad2244f7c38" # sha256
 VIRTUALBOX_ISO_URL_PATH="/files/${VIRTUALBOX_ISO}"
-SIPWISE_APT_KEY_CHECKSUM="f4cdbe4994ae8ca6c4b24eb164e82a20579b335da4eca0907ecaace832e9a0a7" # sha256
-SIPWISE_APT_KEY_PATH="/etc/apt/trusted.gpg.d/sipwise.gpg"
-# overriden later, although since the checksum is the same we could use this URL
-# also for Pro/Carrier installations
-SIPWISE_APT_KEY_URL_PATH="/spce/sipwise.gpg"
+SIPWISE_APT_KEY_PATH="/etc/apt/trusted.gpg.d/sipwise-keyring.gpg"
 NGCP_PXE_INSTALL=false
 ADDITIONAL_PACKAGES=(git augeas-tools gdisk)
 
@@ -174,38 +170,15 @@ debootstrap_sipwise_key() {
   cat > /etc/debootstrap/pre-scripts/install-sipwise-key.sh << EOF
 #!/bin/bash
 # installed via deployment.sh
-cp ${SIPWISE_APT_KEY_PATH} "\${MNTPOINT}"/etc/apt/trusted.gpg.d/
+target_file=sipwise.gpg
+if [[ "${KEYRING}" =~ trusted.gpg\$ ]]; then
+  target_file=trusted.gpg
+fi
+cp ${KEYRING} "\${MNTPOINT}/etc/apt/trusted.gpg.d/\${target_file}"
 EOF
   chmod 775 /etc/debootstrap/pre-scripts/install-sipwise-key.sh
 }
 
-install_sipwise_key() {
-  local sipwise_key_checksum="invalid"
-  if [ -f "${SIPWISE_APT_KEY_PATH}" ]; then
-    sipwise_key_checksum=$(sha256sum "${SIPWISE_APT_KEY_PATH}" | awk '{print $1}')
-    echo "Sipwise keyring already installed (sha256sum: [${sipwise_key_checksum}]), debootstrap sipwise key"
-    debootstrap_sipwise_key
-    return
-  else
-    echo "Sipwise keyring not found, downloading."
-  fi
-
-  for try in 1 2 3; do
-    wget --retry-connrefused --no-verbose -O "${SIPWISE_APT_KEY_PATH}" "${SIPWISE_URL}${SIPWISE_APT_KEY_URL_PATH}"
-    sipwise_key_checksum=$(sha256sum "${SIPWISE_APT_KEY_PATH}" | awk '{print $1}')
-
-    if [ "${sipwise_key_checksum}" != "${SIPWISE_APT_KEY_CHECKSUM}" ] ; then
-      echo "Sipwise keyring downloaded has wrong checksum (expected: [${SIPWISE_APT_KEY_CHECKSUM}] - got: [${sipwise_key_checksum}]), retry $try" >&2
-    else
-      echo "Sipwise keyring downloaded with expected checksum (sha256sum: [${SIPWISE_APT_KEY_CHECKSUM}]), debootstrap sipwise key"
-      debootstrap_sipwise_key
-      return
-    fi
-  done
-
-  die "Error validating sipwise keyring for apt usage, aborting installation."
-}
-
 check_package_version() {
   if [ $# -lt 2 ] ; then
     die "Usage: package_upgrade <package> <version>" >&2
@@ -243,7 +216,7 @@ ensure_recent_package_versions() {
     -o dir::state="${TMPDIR}/statedir" \
     -o dir::etc::sourcelist="${debsrcfile}" \
     -o dir::etc::sourceparts=/dev/null \
-    -o dir::etc::trusted="${SIPWISE_APT_KEY_PATH}" \
+    -o dir::etc::trustedparts="/etc/apt/trusted.gpg.d/" \
     update
 
   DEBIAN_FRONTEND='noninteractive' apt-get \
@@ -251,7 +224,7 @@ ensure_recent_package_versions() {
     -o dir::state="${TMPDIR}/statedir" \
     -o dir::etc::sourcelist="${debsrcfile}" \
     -o dir::etc::sourceparts=/dev/null \
-    -o dir::etc::trusted="${SIPWISE_APT_KEY_PATH}" \
+    -o dir::etc::trustedparts="/etc/apt/trusted.gpg.d/" \
     -y --no-install-recommends install "${UPGRADE_PACKAGES[@]}"
 
   for pkg in "${UPGRADE_PACKAGES[@]}"; do
@@ -516,11 +489,9 @@ fi
 if checkBootParam ngcpce ; then
   CE_EDITION=true
   NGCP_INSTALLER_EDITION_STR="Sipwise C5:        CE"
-  SIPWISE_APT_KEY_URL_PATH="/spce/sipwise.gpg"
 elif checkBootParam ngcppro || checkBootParam ngcpsp1 || checkBootParam ngcpsp2 ; then
   PRO_EDITION=true
   NGCP_INSTALLER_EDITION_STR="Sipwise C5:        PRO"
-  SIPWISE_APT_KEY_URL_PATH="/sppro/sipwise.gpg"
   if checkBootParam ngcpsp2 ; then
     ROLE=sp2
   else
@@ -529,7 +500,6 @@ elif checkBootParam ngcppro || checkBootParam ngcpsp1 || checkBootParam ngcpsp2
 elif checkBootParam "nongcp" ; then
   # installing plain debian without NGCP
   NGCP_INSTALLER_EDITION_STR=""
-  SIPWISE_APT_KEY_URL_PATH="/spce/sipwise.gpg"
 elif checkBootParam "puppetenv=" ; then
   # will be determined later
   :
@@ -803,8 +773,6 @@ for param in "$@" ; do
   shift
 done
 
-set_deploy_status "installing_sipwise_keys"
-install_sipwise_key
 ensure_packages_installed
 
 case "${DEBIAN_RELEASE}" in
@@ -1458,6 +1426,9 @@ if [[ -n "${EFI_PARTITION}" ]] ; then
   fi
 fi
 
+# Add sipwise key into chroot
+debootstrap_sipwise_key
+
 # install Debian
 # shellcheck disable=SC2086
 echo y | grml-debootstrap \

templates/scripts/main.sh

@@ -7,7 +7,6 @@ export LC_ALL=C
 
 working_dir="$(dirname "$0")"
 scripts_dir="${working_dir}/includes/"
-keys_dir="${working_dir}/keys/"
 
 RC=0
 
@@ -19,15 +18,6 @@ NORMAL="$(tput op)"
 einfo "Executing grml-sipwise specific checks..."
 eindent
 
-install_sipwise_keyring() {
-  if [ -f "${keys_dir}/sipwise.gpg" ]; then
-    einfo "Installing sipwise keyring to '/etc/apt/trusted.gpg.d/sipwise.gpg'..."; eend 0
-    cp "${keys_dir}/sipwise.gpg" /etc/apt/trusted.gpg.d/sipwise.gpg
-  else
-    ewarn "Sipwise keyring '${keys_dir}/sipwise.gpg' not found, continuing anyway." ; eend 0
-  fi
-}
-
 report_ssh_password() {
   local rootpwd=$(grep -Eo '\<ssh=[^ ]+' /proc/cmdline || true)
 
@@ -108,7 +98,6 @@ deploy() {
 }
 
 "${scripts_dir}/verify_iso_image.sh"
-install_sipwise_keyring
 "${scripts_dir}/network_configuration.sh"
 "${scripts_dir}/check_installing_version.sh"
 "${scripts_dir}/disk_selection.sh"