2 Commits (mr13.4)

Author	SHA1	Message	Date
Michael Prokop	3afd4c0e54	MT#60283 Fix puppetlabs repository situation with puppet.gpg key ... In jenkins-configs commit 765cbf270df321c8c08d567a9803064696c78028 AKA "TT#62000 Add puppet key to Grml-sipwise image" we included the puppetlabs upstream key into our deployment ISO. Updating the file is error prone and requires quite some effort (including changes to jenkins-configs!), whenever the file needs to be adjusted. In commit 8647b3d7b5 we went for usage of http://apt.puppetlabs.com/DEB-GPG-KEY-puppetlabs, which is the *expired* key though. :-/ | % gpg DEB-GPG-KEY-puppetlabs | gpg: WARNING: no command supplied. Trying to guess what you mean ... | pub rsa4096/1054B7A24BD6EC30 2010-07-10 [SC] [expired: 2017-01-05] | 47B320EB4C7C375AA9DAE1A01054B7A24BD6EC30 | uid Puppet Labs Release Key (Puppet Labs Release Key) <info@puppetlabs.com> | | % md5sum DEB-GPG-KEY-puppetlabs | 7b4ed31e1028f921b5c965df0a42e508 DEB-GPG-KEY-puppetlabs So let's check for the expired key, and if present then retrieve the *current* and proper repository key instead. But instead of using upstream infra http://apt.puppetlabs.com/pubkey.gpg (which we don't have under control on our own and might be unavailable during our deployments), we placed a copy of the key on our own infrastructure: | mprokop@jenkins1 ~www/files % wget --quiet -O puppetlabs-pubkey-2025.gpg http://apt.puppetlabs.com/pubkey.gpg | mprokop@jenkins1 ~www/files % ls -lah puppetlabs-pubkey-2025.gpg | -rw-r--r-- 1 mprokop sipwise 3.2K Apr 9 19:56 puppetlabs-pubkey-2025.gpg | mprokop@jenkins1 ~www/files % gpg puppetlabs-pubkey-2025.gpg | gpg: WARNING: no command supplied. Trying to guess what you mean ... | pub rsa4096 2019-04-08 [SC] | D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26 | uid Puppet, Inc. Release Key (Puppet, Inc. Release Key) <release@puppet.com> | sub rsa4096 2019-04-08 [E] | mprokop@jenkins1 ~www/files % md5sum puppetlabs-pubkey-2025.gpg | d6368c2df370ff2093831daad16d9eeb puppetlabs-pubkey-2025.gpg | mprokop@jenkins1 ~www/files % Given that the file puppet.gpg is also in the wrong format for direct usage with apt-key with its gpg file extension, let's copy it as puppet.asc then, as expected by apt. FTR: this used to work in the past only, as in jenkins-config's jobs/internal/grml/build_grml_image.sh we converted the key for usage as puppet.gpg within apt, via: | puppet_key='puppet.gpg' | gpg --export --no-default-keyring --keyring /etc/apt/trusted.gpg \ | --output "${puppet_key}" release@puppet.com Change-Id: I7fe7dd20d89ed638112638930f578b6bb3783a5c	8 months ago
Michael Prokop	8647b3d7b5	MT#60283 Update to grml-live version v0.53.2 + Debian/trixie ... grml-live had >410 commits since v0.47.7 (which we used so far), including getting rid of FAI (through our own so called minifai implementation), supporting mmdebstrap for bootstrapping (and using it by default nowadays), and usage inside non-privileged containers. Misc changes: * No longer run any docker containers with --privileged, now that this is handled all internally from within grml-live's build driver * Upgrade everything to Debian/trixie (given that we also switched our trunk/master branch towards trixie also) * Provide wrapper.sh script to avoid maintaining it also inside jenkins-configs' jobs/internal/grml/build_grml_image.sh (which meant going through yet another layer and every single change to it required a full jenkins-config change). Update README.txt accordingly to provide usage examples. * Set up keyring for custom bootstrapping using our own mirror, using grml_build/config/bootstrap-keyring/SIPWISE and deploying /usr/share/keyrings/sipwise-archive-keyring.gpg via updatebase hook script * Ship .gitignore files to ignore directories that are relevant for the build process, though we also don't need to explicitly create them on every single build any longer. * Update configuration layout for grml-live change as of upstream version v0.51.0 (see grml-live.git commit f1dc42a), moving from /etc/grml/fai/config into /usr/share/grml-live/config. * Update configuration layout for grml-live change as of upstream version 0.53.0 (see grml-live.git commit 3a4bd41), changing schema files/<path>/<CLASS> into files/<CLASS>/<path>, class/<CLASS>.var into env/<CLASS> and hooks/<hookname>.<CLASS> into hooks/<CLASS>/<hookname>. * Add memtest86+ + ipxe to SIPWISE class, so they are available for boot menu integration (grml-live uses addons from grml_chroot and no longer from host system). grml_build/Dockerfile related changes: * Adjust ENV usage (fixes `LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 9)`) * Add snippet for usage with debian:trixie-slim as base docker image (useful for debugging e.g. without access to Sipwise systems) * Install ca-certificates (needed for access to https://github.com/ with debian:trixie-slim) * Switch from grml-live v0.47.7 to v0.53.2 * Drop deprecated dependencies that are no longer relevant with recent grml-live versions (fai-client + fai-server get replaced by our own minifai implementation, mksh is no longer relevant for grml-live, and isolinux, ipxe, memtest86+ + syslinux are used from the grml_chroot instead of from the host system, also see above) * Instead install mmdebstrap (which is much faster for bootstrapping than debootstrap), now being supported and the default, thanks to our minifai implementation * Drop /root/.bash_history, as we switched towards our custom wrapper.sh script t/Dockerfile related changes: * Mark /code as safe directory for git, to not fail with "fatal: detected dubious ownership in repository at '/code'" * Adjust ENV usage (fixes `LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 8)`) Addendum: it's yet unclear why we need the `ulimit -n 1048576` workaround to fix an apt/apt-mark performance issue. It feels similar to what has been observed for fakeroot at https://bugs.debian.org/920913. Credits to Chris Hofstaedtler for review and working on grml-live's minifai, to support all our needs. Change-Id: I85111806a550f1aeffcb5263af2455ec8b90cc32	8 months ago