busbey commented on a change in pull request #1620:
URL: https://github.com/apache/hbase/pull/1620#discussion_r439795903
##########
File path: dev-support/create-release/README.txt
##########
@@ -37,15 +47,53 @@ $ sudo add-apt-repository -y \
stable"
$ sudo apt-get update
$ sudo apt-get install -y docker-ce docker-ce-cli containerd.io
-$ sudo usermod -a -G docker $USERID
+# Follow the post installation steps:
https://docs.docker.com/engine/install/linux-postinstall/
+$ sudo usermod -aG docker $USER
# LOGOUT and then LOGIN again so $USERID shows as part of docker group
-# Copy up private key for $USERID export from laptop and import on gce.
-$ gpg --import stack.duboce.net.asc
-$ export GPG_TTY=$(tty) # https://github.com/keybase/keybase-issues/issues/2798
-$ eval $(gpg-agent --disable-scdaemon --daemon --no-grab
--allow-preset-passphrase --default-cache-ttl=86400 --max-cache-ttl=86400)
-$ export PROJECT="${PROJECT:-hbase}"
-$ git clone https://github.com/apache/${PROJECT}.git
-$ cd "${PROJECT}"
+# Test here by running docker's hello world as your build user
+$ docker run hello-world
+
+# Follow the GPG guide for forwarding your gpg-agent from your local machine
to the VM
+# https://wiki.gnupg.org/AgentForwarding
+# On the VM find out the location of the gpg agent socket and extra socket
+$ gpgconf --list-dir agent-socket
+/run/user/1000/gnupg/S.gpg-agent
+$ gpgconf --list-dir agent-extra-socket
+/run/user/1000/gnupg/S.gpg-agent.extra
+# On the VM configure sshd to remove stale sockets
+$ sudo bash -c 'echo "StreamLocalBindUnlink yes" >> /etc/ssh/sshd_config'
+$ sudo systemctl restart ssh
+# logout of the VM
+
+# Do these steps on your local machine.
+# Export your public key and copy it to the VM.
+# Assuming 'example.gce.host' maps to your VM's external IP (or use the IP)
+$ gpg --export [email protected] > ~/gpg.example.apache.pub
+$ scp ~/gpg.example.apache.pub example.gce.host:
+# ssh into the VM while forwarding the remote gpg socket locations found above
to your local
+# gpg-agent's extra socket (this will restrict what commands the remote node
is allowed to have
+# your agent handle. Note that the gpg guide above can help you set this up
in your ssh config
+# rather than typing it in ssh like this every time.
+$ ssh -i ~/.ssh/my_id \
+ -R "/run/user/1000/gnupg/S.gpg-agent:$(gpgconf --list-dir
agent-extra-socket)" \
+ -R "/run/user/1000/gnupg/S.gpg-agent.extra:$(gpgconf --list-dir
agent-extra-socket)" \
+ example.gce.host
Review comment:
yes your gpg agent has to be running on your local machine before hand.
The remote invocations of gpg have to use `--no-autostart` because if the gpg
agent starts on that machine it'll overwrite the socket that we forwarded.
I could add an example of forcing a clean start of the gpg-agent, e.g.
`gpgconf --kill all && gpg-connect-agent /bye`
The test signature at container launch should ensure the key is unlocked
prior to us building artifacts.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
