From 8f6018cfd061c7d30c25ab6ad343f34570d56952 Mon Sep 17 00:00:00 2001 From: Saravanan Somasundaram Date: Tue, 11 Aug 2020 18:09:33 -0400 Subject: [PATCH] Enable GPG Check and Import of GPG Keys --- SPECS/mariner-repos/MICROSOFT-METADATA-GPG-KEY | 2 +- SPECS/mariner-repos/MICROSOFT-RPM-GPG-KEY | 2 +- SPECS/mariner-repos/mariner-official-base.repo | 7 ++++--- .../mariner-repos/mariner-official-update.repo | 7 ++++--- .../mariner-repos.signatures.json | 10 +++++----- SPECS/mariner-repos/mariner-repos.spec | 18 +++++++++++++++++- toolkit/imageconfigs/core-efi.json | 5 +++++ toolkit/imageconfigs/core-legacy.json | 5 +++++ toolkit/imageconfigs/core-ova.json | 5 +++++ .../mariner/import-keys-patch.sh | 7 +++++++ .../manifests/package/pkggen_core_aarch64.txt | 2 +- .../manifests/package/pkggen_core_x86_64.txt | 2 +- .../manifests/package/toolchain_aarch64.txt | 2 +- .../manifests/package/toolchain_x86_64.txt | 2 +- 14 files changed, 58 insertions(+), 18 deletions(-) create mode 100755 toolkit/imageconfigs/postinstallscripts/mariner/import-keys-patch.sh diff --git a/SPECS/mariner-repos/MICROSOFT-METADATA-GPG-KEY b/SPECS/mariner-repos/MICROSOFT-METADATA-GPG-KEY index dafecd3b9aa..2db37440f2f 100644 --- a/SPECS/mariner-repos/MICROSOFT-METADATA-GPG-KEY +++ b/SPECS/mariner-repos/MICROSOFT-METADATA-GPG-KEY @@ -16,4 +16,4 @@ KJt3bp3Ngn1vEYXwijGTa+FXz6GLHueJwF0I7ug34DgUkAFvAs8Hacr2DRYxL5RJ XdNgj4Jd2/g6T9InmWT0hASljur+dJnzNiNCkbn9KbX7J/qK1IbR8y560yRmFsU+ NdCFTW7wY0Fb1fWJ+/KTsC4= =J6gs ------END PGP PUBLIC KEY BLOCK----- \ No newline at end of file +-----END PGP PUBLIC KEY BLOCK----- diff --git a/SPECS/mariner-repos/MICROSOFT-RPM-GPG-KEY b/SPECS/mariner-repos/MICROSOFT-RPM-GPG-KEY index 7c6b5b14832..d062574ec70 100644 --- a/SPECS/mariner-repos/MICROSOFT-RPM-GPG-KEY +++ b/SPECS/mariner-repos/MICROSOFT-RPM-GPG-KEY @@ -16,4 +16,4 @@ FIaVXm+gMAssaj+k52g/+CnY4KZUHrSkg48OoRB+2a6FqGS8BLeCa+v+zaJCk2fz EI/NeJwL4Asz1F4AwkEu5X9y8eEGArCXoP0OpYpCxIBZ+7MiKKDOoNf0a/0nOhvs 29LIIOnG+x0/RDfRgFObrF9geKpVTpI= =ZhFE ------END PGP PUBLIC KEY BLOCK----- \ No newline at end of file +-----END PGP PUBLIC KEY BLOCK----- diff --git a/SPECS/mariner-repos/mariner-official-base.repo b/SPECS/mariner-repos/mariner-official-base.repo index 2f6e6770a9d..212ac025015 100755 --- a/SPECS/mariner-repos/mariner-official-base.repo +++ b/SPECS/mariner-repos/mariner-official-base.repo @@ -1,8 +1,9 @@ [mariner-official-base] name=CBL-Mariner Official Base $releasever $basearch -baseurl=https://packages.microsoft.com/cbl-mariner/$releasever/prod/base/$basearch/rpms/ -gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY +baseurl=https://packages.microsoft.com/cbl-mariner/$releasever/prod/base/$basearch/rpms +gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY file:///etc/pki/rpm-gpg/MICROSOFT-METADATA-GPG-KEY +gpgcheck=1 +repo_gpgcheck=1 enabled=1 -gpgcheck=0 skip_if_unavailable=True sslverify=1 diff --git a/SPECS/mariner-repos/mariner-official-update.repo b/SPECS/mariner-repos/mariner-official-update.repo index 160c866da03..0df1f91a1c6 100755 --- a/SPECS/mariner-repos/mariner-official-update.repo +++ b/SPECS/mariner-repos/mariner-official-update.repo @@ -1,8 +1,9 @@ [mariner-official-update] name=CBL-Mariner Official Update $releasever $basearch -baseurl=https://packages.microsoft.com/cbl-mariner/$releasever/prod/update/$basearch/rpms/ -gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY -gpgcheck=0 +baseurl=https://packages.microsoft.com/cbl-mariner/$releasever/prod/update/$basearch/rpms +gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY file:///etc/pki/rpm-gpg/MICROSOFT-METADATA-GPG-KEY +gpgcheck=1 +repo_gpgcheck=1 enabled=1 skip_if_unavailable=True sslverify=1 diff --git a/SPECS/mariner-repos/mariner-repos.signatures.json b/SPECS/mariner-repos/mariner-repos.signatures.json index 3823856e246..08456c98983 100644 --- a/SPECS/mariner-repos/mariner-repos.signatures.json +++ b/SPECS/mariner-repos/mariner-repos.signatures.json @@ -1,8 +1,8 @@ { "Signatures": { - "MICROSOFT-RPM-GPG-KEY": "eb12973679a692551df1cd803cc99ce56a74d7357e24530ce003bd4846134a6c", - "MICROSOFT-METADATA-GPG-KEY": "c29e5709ec534383acf34a0da5ffce45313bc175a94f14b9f0414d376933e78f", - "mariner-official-base.repo": "56a5a8ef0b9008c0ada68ac61362501238bae433512f62c3e967849f9cf3c9ae", - "mariner-official-update.repo": "54e30c0cd07caf3513a6bbb4b0df70ea63e60475512199179135c36dd53562dd" + "MICROSOFT-RPM-GPG-KEY": "1092f37ec429e58bf9c7f898df17c3c32eb2ce3c4c037afb8ffe2d2b42e16e89", + "MICROSOFT-METADATA-GPG-KEY": "1824ecffeda90cfe4178a99bddde450f09fd40e8faf4f0124fba16ea79998c4c", + "mariner-official-base.repo": "af485f85c5c856536c6ec2f73f0afd1d9c424396fce1c9ae6f40745a5f41503d", + "mariner-official-update.repo": "d80ed87ba6cf1e535131a9a68499b832dc87fc9add29cbae0f6cc76ebc36fbf3" } -} \ No newline at end of file +} diff --git a/SPECS/mariner-repos/mariner-repos.spec b/SPECS/mariner-repos/mariner-repos.spec index cf14c08a1f9..6f11555ed35 100644 --- a/SPECS/mariner-repos/mariner-repos.spec +++ b/SPECS/mariner-repos/mariner-repos.spec @@ -1,7 +1,7 @@ Summary: CBL-Mariner repo files, gpg keys Name: mariner-repos Version: 1.0 -Release: 8%{?dist} +Release: 9%{?dist} License: Apache License Group: System Environment/Base URL: https://aka.ms/mariner @@ -12,6 +12,10 @@ Source3: mariner-official-update.repo Vendor: Microsoft Corporation Distribution: mariner Provides: mariner-repos +Requires(post): gpgme +Requires(post): rpm +Requires(preun): gpgme +Requires(preun): rpm BuildArch: noarch %description @@ -30,6 +34,16 @@ install -m 644 %{SOURCE1} $RPM_BUILD_ROOT/etc/pki/rpm-gpg %clean rm -rf $RPM_BUILD_ROOT +%post +gpg --import /etc/pki/rpm-gpg/MICROSOFT-METADATA-GPG-KEY +gpg --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY + +%preun +# Remove the MICROSOFT-METADATA-GPG-KEY +gpg --batch --yes --delete-keys BC528686B50D79E339D3721CEB3E94ADBE1229CF +# Remove the MICROSOFT-RPM-GPG-KEY +gpg --batch --yes --delete-keys 2BC94FFF7015A5F28F1537AD0CD9FED33135CE90 + %files %defattr(-,root,root,-) %dir /etc/yum.repos.d @@ -39,6 +53,8 @@ rm -rf $RPM_BUILD_ROOT %config(noreplace) /etc/yum.repos.d/mariner-official-update.repo %changelog +* Tue Aug 11 2020 Saravanan Somasundaram - 1.0-9 +- Enable GPG Check and Import * Mon Aug 10 2020 Saravanan Somasundaram - 1.0-8 - Adding Metadata Key and Updating to Prod GPG Key. * Fri Jul 31 2020 Pawel Winogrodzki - 1.0-7 diff --git a/toolkit/imageconfigs/core-efi.json b/toolkit/imageconfigs/core-efi.json index d0aae1ba6ea..668ce2ce9b1 100644 --- a/toolkit/imageconfigs/core-efi.json +++ b/toolkit/imageconfigs/core-efi.json @@ -52,6 +52,11 @@ "KernelOptions": { "default": "kernel" }, + "PostInstallScripts":[ + { + "Path": "postinstallscripts/mariner/import-keys-patch.sh" + } + ], "Hostname": "cbl-mariner" } ] diff --git a/toolkit/imageconfigs/core-legacy.json b/toolkit/imageconfigs/core-legacy.json index 00538c17c59..bdc5759d3b7 100644 --- a/toolkit/imageconfigs/core-legacy.json +++ b/toolkit/imageconfigs/core-legacy.json @@ -50,6 +50,11 @@ "KernelOptions": { "default": "kernel" }, + "PostInstallScripts":[ + { + "Path": "postinstallscripts/mariner/import-keys-patch.sh" + } + ], "Hostname": "cbl-mariner" } ] diff --git a/toolkit/imageconfigs/core-ova.json b/toolkit/imageconfigs/core-ova.json index 7022a54e6b0..8ac4851af09 100644 --- a/toolkit/imageconfigs/core-ova.json +++ b/toolkit/imageconfigs/core-ova.json @@ -51,6 +51,11 @@ "KernelOptions": { "default": "kernel" }, + "PostInstallScripts":[ + { + "Path": "postinstallscripts/mariner/import-keys-patch.sh" + } + ], "Users": [ { "Name": "root", diff --git a/toolkit/imageconfigs/postinstallscripts/mariner/import-keys-patch.sh b/toolkit/imageconfigs/postinstallscripts/mariner/import-keys-patch.sh new file mode 100755 index 00000000000..39cae0101d0 --- /dev/null +++ b/toolkit/imageconfigs/postinstallscripts/mariner/import-keys-patch.sh @@ -0,0 +1,7 @@ +#!/bin/bash + +# Import the RPM Metadata Key +rpm --import /etc/pki/rpm-gpg/MICROSOFT-METADATA-GPG-KEY + +# Import the RPM GPG Key +rpm --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 7bdca11c5d0..bab51423139 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -146,7 +146,7 @@ krb5-1.17-3.cm1.aarch64.rpm lua-5.3.5-5.cm1.aarch64.rpm mariner-rpm-macros-1.0-3.cm1.noarch.rpm mariner-check-macros-1.0-3.cm1.noarch.rpm -mariner-repos-1.0-8.cm1.noarch.rpm +mariner-repos-1.0-9.cm1.noarch.rpm libffi-3.2.1-10.cm1.aarch64.rpm libtasn1-4.14-2.cm1.aarch64.rpm p11-kit-0.23.16.1-2.cm1.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 9b39531b239..dccb91d21a6 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -146,7 +146,7 @@ krb5-1.17-3.cm1.x86_64.rpm lua-5.3.5-5.cm1.x86_64.rpm mariner-rpm-macros-1.0-3.cm1.noarch.rpm mariner-check-macros-1.0-3.cm1.noarch.rpm -mariner-repos-1.0-8.cm1.noarch.rpm +mariner-repos-1.0-9.cm1.noarch.rpm libffi-3.2.1-10.cm1.x86_64.rpm libtasn1-4.14-2.cm1.x86_64.rpm p11-kit-0.23.16.1-2.cm1.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index aad44cba928..c4b25ed1bcb 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -236,7 +236,7 @@ make-4.2.1-4.cm1.aarch64.rpm make-debuginfo-4.2.1-4.cm1.aarch64.rpm mariner-check-macros-1.0-3.cm1.noarch.rpm mariner-release-1.0-6.cm1.noarch.rpm -mariner-repos-1.0-8.cm1.noarch.rpm +mariner-repos-1.0-9.cm1.noarch.rpm mariner-rpm-macros-1.0-3.cm1.noarch.rpm meson-0.49.2-1.cm1.noarch.rpm mpfr-4.0.1-3.cm1.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 94f06273cce..bb46cb763d5 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -236,7 +236,7 @@ make-4.2.1-4.cm1.x86_64.rpm make-debuginfo-4.2.1-4.cm1.x86_64.rpm mariner-check-macros-1.0-3.cm1.noarch.rpm mariner-release-1.0-6.cm1.noarch.rpm -mariner-repos-1.0-8.cm1.noarch.rpm +mariner-repos-1.0-9.cm1.noarch.rpm mariner-rpm-macros-1.0-3.cm1.noarch.rpm meson-0.49.2-1.cm1.noarch.rpm mpfr-4.0.1-3.cm1.x86_64.rpm