Hi,
Op 24-03-2022 om 09:12 schreef Richard Purdie:
On Wed, 2022-03-23 at 19:34 +0100, Ferry Toth wrote:
Hi Richard,
I forgot to add a cover letter, sorry for that. The 2 patches together
implement DEB repository signing.
This is necessary since Gatesgarth |apt| (1.8.2) has become more strict
and doesn’t allow unsigned repositories by default.
It is possible to override this behavior |but||| is more work then to
enable signed DEB repositories. These patches makes DEB a first class
citizen as IPK and RPM.
Patches have been in use in meta-intel-edison since Gatesgarth, see
https://edison-fw.github.io/meta-intel-edison/5.0-Creating-a-deb-repository.html\
What puzzles me is that we can build root filesystems using apt, we test this on
the autobuilder. Saying repositories are broken since gatesgarth therefore seems
confusing in the commit message.
Good question. When I (meta-intel-edison) build the rootfs using DEB's
it just works.
Could it be that during rootfs build dpkg is used and not apt? I think I
have seen that in the logs.
Of course apt uses dpkg to install a package as well, but it refuses to
download the package from a repo when it's not signed.
I guess we must configure apt to override that during the rootfs process and
likely an end user with a remote feed could do the same, possibly with a warning
from apt?
I believe there is no issue during rootfs generation.
I'm also worried that there isn't any automated testing of this change. The
reason I worry is that since we don't show any testing failures right now, there
is clearly a hole in our automated testing coverage and there is no guarantee
that this feature will keep working. It is these smaller corner case issues
which tend to make or break the project's experience as if a feature is present,
people expect it to work. Can we improve the testing situation?
It doesn't seem to be a particularly volatile area in the code. I
refreshed Xavier's patches for Gatesgarth, and am actively using
unchanged patch on Honisiter.
I don't know how the automated testing is working but I guess for RPM a
repo is generated using a small layer? And then tested on a qemu running
the rootfs?
Should be almost same for deb/apt, maybe could be modified from rpm test?
Point is: currently deb is documented as a feasible package format to
generate a repo. But it really is not without these signing patches. So
we could either deprecate deb's (no, no please don't) or fix it.
These patches fix it. With or without automated testing, it is already
better then the current situation.
Cheers,
Richard
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#163604):
https://lists.openembedded.org/g/openembedded-core/message/163604
Mute This Topic: https://lists.openembedded.org/mt/89962631/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
