Hi,

On Wed, 2022-03-23 at 19:34 +0100, Ferry Toth wrote:

Hi Richard,

I forgot to add a cover letter, sorry for that. The 2 patches  together 
implement DEB repository signing.

This is necessary since Gatesgarth |apt| (1.8.2) has become more strict 
and doesn’t allow unsigned repositories by default.

It is possible to override this behavior |but||| is more work then to 
enable signed DEB repositories. These patches makes DEB a first class 
citizen as IPK and RPM.

Patches have been in use in meta-intel-edison since Gatesgarth, see 
https://edison-fw.github.io/meta-intel-edison/5.0-Creating-a-deb-repository.html\

What puzzles me is that we can build root filesystems using apt, we test this on
the autobuilder. Saying repositories are broken since gatesgarth therefore seems
confusing in the commit message.

Good question. When I (meta-intel-edison) build the rootfs using DEB's it just works.

Could it be that during rootfs build dpkg is used and not apt? I think I have seen that in the logs.

Of course apt uses dpkg to install a package as well, but it refuses to download the package from a repo when it's not signed.

I guess we must configure apt to override that during the rootfs process and
likely an end user with a remote feed could do the same, possibly with a warning
from apt?

I'm also worried that there isn't any automated testing of this change. The
reason I worry is that since we don't show any testing failures right now, there
is clearly a hole in our automated testing coverage and there is no guarantee
that this feature will keep working. It is these smaller corner case issues
which tend to make or break the project's experience as if a feature is present,
people expect it to work. Can we improve the testing situation?

It doesn't seem to be a particularly volatile area in the code. I refreshed Xavier's patches for Gatesgarth, and am actively using unchanged patch on Honisiter.

I don't know how the automated testing is working but I guess for RPM a repo is generated using a small layer? And then tested on a qemu running the rootfs?

Should be almost same for deb/apt, maybe could be modified from rpm test?

Point is: currently deb is documented as a feasible package format to generate a repo. But it really is not without these signing patches. So we could either deprecate deb's (no, no please don't) or fix it.

These patches fix it. With or without automated testing, it is already better then the current situation.

Cheers,

Richard