From ffaf102fecc20510513de4898ce85b5b119e1795 Mon Sep 17 00:00:00 2001 From: Marcin Juszkiewicz Date: Tue, 6 Apr 2021 13:14:49 +0200 Subject: Debian/Ubuntu: handle APT keys in proper way apt-key is deprecated and in Debian 'bullseye' it complain when we use it the way we did. The right way is to store key files in separate directory and then, for each repo source file, point to proper key. And this is what this patch does. Both distros use the same keys now. More info: https://michael-prokop.at/blog/2021/02/16/how-to-properly-use-3rd-party-debian-repository-signing-keys-with-apt/ Change-Id: Ie19bf46236907d79cb42a5e94cd1067e952b8cbb --- docker/base/Dockerfile.j2 | 63 +++++++++++++---------------------------------- 1 file changed, 17 insertions(+), 46 deletions(-) (limited to 'docker') diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2 index 4d426c6c9..0e2e14bbb 100644 --- a/docker/base/Dockerfile.j2 +++ b/docker/base/Dockerfile.j2 @@ -252,13 +252,11 @@ ENV DEBIAN_FRONTEND noninteractive COPY dpkg_reducing_disk_footprint /etc/dpkg/dpkg.cfg.d/dpkg_reducing_disk_footprint {% block base_ubuntu_package_pre %} -# Need apt-transport-https and ca-certificates before replacing sources.list or -# apt-get update will not work if any repositories are accessed via HTTPS +# curl and ca-certificates to fetch remote keys via http +# gnupg to fetch keys directly from keyserver {% set base_ubuntu_package_pre_packages = [ - 'apt-transport-https', 'ca-certificates', 'curl', - 'dirmngr', 'gnupg' ] %} {{ macros.install_packages(base_ubuntu_package_pre_packages | customizable("base_ubuntu_package_pre_packages")) }} @@ -294,7 +292,6 @@ COPY apt_preferences /etc/apt/preferences.d/kolla-custom {% set base_apt_packages = [ 'apt-utils', - 'curl', 'dumb-init', 'gawk', 'iproute2', @@ -311,55 +308,29 @@ COPY apt_preferences /etc/apt/preferences.d/kolla-custom 'tgt' ] %} -{% if base_distro == 'ubuntu' %} - {# 391A9AA2147192839E9DB0315EDB1B62EC4926EA -- Canonical Cloud Archive Signing Key #} - {# 46095ACC8548582C1A2699A9D27D666CD88E42B4 -- Elasticsearch (Elasticsearch Signing Key) #} - {# 58118E89F3A912897C070ADBF76221572C52609D -- Docker Release Tool (releasedocker) #} - {# 4D8EB5FDA37AB55F41A135203BF88A0C6A770882 -- Apache Qpid PPA Signing Key #} - {# 901F9177AB97ACBE -- Treasure Data, Inc (Treasure Agent Official Signing key) #} - {# A20F259AEB9C94BB -- Sensuapp (Freight) #} - {# F1656F24C74CD1D8 -- MariaDB Signing Key #} - {# F77F1EDA57EBB1CC -- Launchpad RabbitMQ Erlang PPA key #} - {# F6609E60DC62814E -- PackageCloud RabbitMQ repository key #} - {% set base_apt_keys = [ - '391A9AA2147192839E9DB0315EDB1B62EC4926EA', - '46095ACC8548582C1A2699A9D27D666CD88E42B4', - '49B07274951063870A8B7EAE7B8AA1A344C05248', - '58118E89F3A912897C070ADBF76221572C52609D', - '4D8EB5FDA37AB55F41A135203BF88A0C6A770882', - '901F9177AB97ACBE', - 'A20F259AEB9C94BB', - 'F1656F24C74CD1D8', - 'F77F1EDA57EBB1CC', - 'F6609E60DC62814E', - ] %} - {% set remote_apt_keys = [ - 'https://packages.grafana.com/gpg.key', - 'https://repos.influxdata.com/influxdb.key', - ] %} -{% elif base_distro == 'debian' %} - {% set base_apt_keys = [ - '46095ACC8548582C1A2699A9D27D666CD88E42B4', - 'F77F1EDA57EBB1CC', - 'F6609E60DC62814E', - ] %} - {% set remote_apt_keys = [ - 'https://download.docker.com/linux/debian/gpg', - 'https://packages.grafana.com/gpg.key', - 'https://packages.treasuredata.com/GPG-KEY-td-agent', - 'https://repos.influxdata.com/influxdb.key', - ] %} -{% endif %} +{% set base_apt_keys = [ + {'name': 'erlang', 'keyid': 'F77F1EDA57EBB1CC'}, + {'name': 'rabbitmq', 'keyid': 'F6609E60DC62814E'}, +] %} + +{# NOTE(hrw): type field defaults to 'asc' which is used for single keys #} +{% set remote_apt_keys = [ + {'name': 'elasticsearch', 'url': 'https://artifacts.elastic.co/GPG-KEY-elasticsearch'}, + {'name': 'grafana', 'url': 'https://packages.grafana.com/gpg.key'}, + {'name': 'influxdb', 'url': 'https://repos.influxdata.com/influxdb.key'}, + {'name': 'mariadb', 'url': 'https://downloads.mariadb.com/MariaDB/mariadb-keyring-2019.gpg', 'type': 'gpg'}, + {'name': 'treasuredata', 'url': 'https://packages.treasuredata.com/GPG-KEY-td-agent'}, +] %} {% block base_ubuntu_package_installation %} {%- block base_ubuntu_package_key_installation %} {% for key in base_apt_keys | customizable('apt_keys') %} - {%- if loop.first %}RUN {% else %} && {% endif %}apt-key adv --no-tty --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 {{ key }} + {%- if loop.first %}RUN mkdir -p /etc/kolla/apt-keys/{% endif %} && gpg --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 {{ key.keyid }} && gpg --export {{ key.keyid }} >/etc/kolla/apt-keys/{{ key.name }}.gpg {%- if not loop.last %} \ {% endif -%} {% endfor %} {% for key in remote_apt_keys | customizable('remote_apt_keys') %} - {%- if loop.first %} RUN {% else %} && {% endif %}curl {{ key }} | apt-key add - + {%- if loop.first %} RUN mkdir -p /etc/kolla/apt-keys/ {% endif %} && curl {{ key.url }} -o /etc/kolla/apt-keys/{{ key.name }}.{{ key.type | default('asc') }} {%- if not loop.last %} \ {% endif -%} {% endfor %} -- cgit v1.2.3