You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Michael Prokop b73fea40fb MT#62249 Rework apt-key checks to support Debian/trixie ... apt-key is gone as of apt version 2.9.17, so rely on apt-key only for Debian bookworm, instead use our own tooling to verify the key situation on Debian/trixie (v13) and newer. Migrate our existing checks from templates/140_apt-keys.yaml.tt2 to our new helper script helper/check-apt-keyrings, so we have one single interface for all those checks. FTR: the checksums of the sipwise-archive-2015.gpg + sipwise-autobuilder-2011.gpg keyfiles differ between bookworm and trixie, because of the way we generate them during package builds (gnupg for bookworm vs. sequoia starting with trixie). Situation on bookworm / trunk: | root@spce:~# gpg /etc/apt/trusted.gpg.d/sipwise-archive-2015.gpg | gpg: WARNING: no command supplied. Trying to guess what you mean ... | pub rsa4096 2015-03-05 [SC] [expires: 2029-10-12] | 68A702B1FD8E422AAAA1ADA3773236EFF411A836 | uid Sipwise GmbH (Sipwise Repository Key) <support@sipwise.com> | sub rsa4096 2015-03-05 [E] [expires: 2029-10-12] | root@spce:~# gpg /etc/apt/trusted.gpg.d/sipwise-autobuilder-2011.gpg | gpg: WARNING: no command supplied. Trying to guess what you mean ... | pub rsa4096 2011-06-06 [SC] | F7B8A739CE638D719A078C9859104633EE5E097D | uid Sipwise autobuilder (Used to sign packages for autobuild) <development@sipwise.com> | sub rsa4096 2011-06-06 [E] | root@spce:~# sha256sum /etc/apt/trusted.gpg.d/sipwise-archive-2015.gpg /etc/apt/trusted.gpg.d/sipwise-autobuilder-2011.gpg | 811f878f5320fc8563a70b166d2c27ec060b4397ca021702f433bc4659336b9b /etc/apt/trusted.gpg.d/sipwise-archive-2015.gpg | f00aad42a76ddec341fb2c67b45b41e2d1c19d67bd239196cd52488c4b7da4a0 /etc/apt/trusted.gpg.d/sipwise-autobuilder-2011.gpg Situation on trixie / trunk: | root@spce:~# gpg /etc/apt/trusted.gpg.d/sipwise-archive-2015.gpg | gpg: WARNING: no command supplied. Trying to guess what you mean ... | pub rsa4096 2015-03-05 [SC] [expires: 2029-10-12] | 68A702B1FD8E422AAAA1ADA3773236EFF411A836 | uid Sipwise GmbH (Sipwise Repository Key) <support@sipwise.com> | sub rsa4096 2015-03-05 [E] [expires: 2029-10-12] | root@spce:~# gpg /etc/apt/trusted.gpg.d/sipwise-autobuilder-2011.gpg | gpg: WARNING: no command supplied. Trying to guess what you mean ... | pub rsa4096 2011-06-06 [SC] | F7B8A739CE638D719A078C9859104633EE5E097D | uid Sipwise autobuilder (Used to sign packages for autobuild) <development@sipwise.com> | sub rsa4096 2011-06-06 [E] | | root@spce:~# sha256sum /etc/apt/trusted.gpg.d/sipwise-archive-2015.gpg /etc/apt/trusted.gpg.d/sipwise-autobuilder-2011.gpg | 88d92e09810a13b5e749839bca89029fbbe73cca261a3a26712a560cc7b50e47 /etc/apt/trusted.gpg.d/sipwise-archive-2015.gpg | b64656d5f8fa0a636d46084bda74e16cef502d3d48e8ed101c6386ad8bbcacef /etc/apt/trusted.gpg.d/sipwise-autobuilder-2011.gpg NOTE: Once we switch our /etc/apt/sources.list* setup to the deb822.sources format (see sources.list(5) + deb822(5) for details), and neither our ngcp-archive-keyring nor Debian's debian-archive-keyring no longer installs any files inside /etc/apt/trusted.gpg.d, we can instead check for empty /etc/apt/trusted.gpg.d + /etc/apt/keyrings and expected files inside /usr/share/keyrings. Change-Id: I0ef7e1d8f0684f94c1e6ae0499f85080cdcd690a		2 months ago
..
check-apt-keyrings	MT#62249 Rework apt-key checks to support Debian/trixie	2 months ago
compare_dbs.pl	MT#58530 Add exceptions to compare_dbs.pl	1 year ago