Skip to content

Enable GPG Check and Import of GPG Keys #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SARSOMA merged 1 commit into from
Aug 12, 2020
Merged

Enable GPG Check and Import of GPG Keys #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion SPECS/mariner-repos/MICROSOFT-METADATA-GPG-KEY
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,4 @@ KJt3bp3Ngn1vEYXwijGTa+FXz6GLHueJwF0I7ug34DgUkAFvAs8Hacr2DRYxL5RJ
XdNgj4Jd2/g6T9InmWT0hASljur+dJnzNiNCkbn9KbX7J/qK1IbR8y560yRmFsU+
NdCFTW7wY0Fb1fWJ+/KTsC4=
=J6gs
-----END PGP PUBLIC KEY BLOCK-----
-----END PGP PUBLIC KEY BLOCK-----
2 changes: 1 addition & 1 deletion SPECS/mariner-repos/MICROSOFT-RPM-GPG-KEY
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,4 @@ FIaVXm+gMAssaj+k52g/+CnY4KZUHrSkg48OoRB+2a6FqGS8BLeCa+v+zaJCk2fz
EI/NeJwL4Asz1F4AwkEu5X9y8eEGArCXoP0OpYpCxIBZ+7MiKKDOoNf0a/0nOhvs
29LIIOnG+x0/RDfRgFObrF9geKpVTpI=
=ZhFE
-----END PGP PUBLIC KEY BLOCK-----
-----END PGP PUBLIC KEY BLOCK-----
7 changes: 4 additions & 3 deletions SPECS/mariner-repos/mariner-official-base.repo
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
[mariner-official-base]
name=CBL-Mariner Official Base $releasever $basearch
baseurl=https://packages.microsoft.com/cbl-mariner/$releasever/prod/base/$basearch/rpms/
gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
baseurl=https://packages.microsoft.com/cbl-mariner/$releasever/prod/base/$basearch/rpms
gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY file:///etc/pki/rpm-gpg/MICROSOFT-METADATA-GPG-KEY
gpgcheck=1
repo_gpgcheck=1
enabled=1
gpgcheck=0
skip_if_unavailable=True
sslverify=1
7 changes: 4 additions & 3 deletions SPECS/mariner-repos/mariner-official-update.repo
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
[mariner-official-update]
name=CBL-Mariner Official Update $releasever $basearch
baseurl=https://packages.microsoft.com/cbl-mariner/$releasever/prod/update/$basearch/rpms/
gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
gpgcheck=0
baseurl=https://packages.microsoft.com/cbl-mariner/$releasever/prod/update/$basearch/rpms
gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY file:///etc/pki/rpm-gpg/MICROSOFT-METADATA-GPG-KEY
gpgcheck=1
repo_gpgcheck=1
enabled=1
skip_if_unavailable=True
sslverify=1
10 changes: 5 additions & 5 deletions SPECS/mariner-repos/mariner-repos.signatures.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
{
"Signatures": {
"MICROSOFT-RPM-GPG-KEY": "eb12973679a692551df1cd803cc99ce56a74d7357e24530ce003bd4846134a6c",
"MICROSOFT-METADATA-GPG-KEY": "c29e5709ec534383acf34a0da5ffce45313bc175a94f14b9f0414d376933e78f",
"mariner-official-base.repo": "56a5a8ef0b9008c0ada68ac61362501238bae433512f62c3e967849f9cf3c9ae",
"mariner-official-update.repo": "54e30c0cd07caf3513a6bbb4b0df70ea63e60475512199179135c36dd53562dd"
"MICROSOFT-RPM-GPG-KEY": "1092f37ec429e58bf9c7f898df17c3c32eb2ce3c4c037afb8ffe2d2b42e16e89",
"MICROSOFT-METADATA-GPG-KEY": "1824ecffeda90cfe4178a99bddde450f09fd40e8faf4f0124fba16ea79998c4c",
"mariner-official-base.repo": "af485f85c5c856536c6ec2f73f0afd1d9c424396fce1c9ae6f40745a5f41503d",
"mariner-official-update.repo": "d80ed87ba6cf1e535131a9a68499b832dc87fc9add29cbae0f6cc76ebc36fbf3"
}
}
}
18 changes: 17 additions & 1 deletion SPECS/mariner-repos/mariner-repos.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Summary: CBL-Mariner repo files, gpg keys
Name: mariner-repos
Version: 1.0
Release: 8%{?dist}
Release: 9%{?dist}
License: Apache License
Group: System Environment/Base
URL: https://aka.ms/mariner
Expand All @@ -12,6 +12,10 @@ Source3: mariner-official-update.repo
Vendor: Microsoft Corporation
Distribution: mariner
Provides: mariner-repos
Requires(post): gpgme
Requires(post): rpm
Requires(preun): gpgme
Requires(preun): rpm
BuildArch: noarch

%description
Expand All @@ -30,6 +34,16 @@ install -m 644 %{SOURCE1} $RPM_BUILD_ROOT/etc/pki/rpm-gpg
%clean
rm -rf $RPM_BUILD_ROOT

%post
gpg --import /etc/pki/rpm-gpg/MICROSOFT-METADATA-GPG-KEY
gpg --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY

%preun
# Remove the MICROSOFT-METADATA-GPG-KEY
gpg --batch --yes --delete-keys BC528686B50D79E339D3721CEB3E94ADBE1229CF
Comment thread
PawelWMS marked this conversation as resolved.
Outdated
Comment thread
SARSOMA marked this conversation as resolved.
Outdated
# Remove the MICROSOFT-RPM-GPG-KEY
gpg --batch --yes --delete-keys 2BC94FFF7015A5F28F1537AD0CD9FED33135CE90

%files
%defattr(-,root,root,-)
%dir /etc/yum.repos.d
Expand All @@ -39,6 +53,8 @@ rm -rf $RPM_BUILD_ROOT
%config(noreplace) /etc/yum.repos.d/mariner-official-update.repo

%changelog
* Tue Aug 11 2020 Saravanan Somasundaram <sarsoma@microsoft.com> - 1.0-9
- Enable GPG Check and Import
* Mon Aug 10 2020 Saravanan Somasundaram <sarsoma@microsoft.com> - 1.0-8
- Adding Metadata Key and Updating to Prod GPG Key.
* Fri Jul 31 2020 Pawel Winogrodzki <pawelwi@microsoft.com> - 1.0-7
Expand Down
5 changes: 5 additions & 0 deletions toolkit/imageconfigs/core-efi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,11 @@
"KernelOptions": {
"default": "kernel"
},
"PostInstallScripts":[
{
"Path": "postinstallscripts/mariner/import-keys-patch.sh"
Comment thread
PawelWMS marked this conversation as resolved.
Outdated
}
],
"Hostname": "cbl-mariner"
}
]
Expand Down
5 changes: 5 additions & 0 deletions toolkit/imageconfigs/core-legacy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,11 @@
"KernelOptions": {
"default": "kernel"
},
"PostInstallScripts":[
{
"Path": "postinstallscripts/mariner/import-keys-patch.sh"
}
],
"Hostname": "cbl-mariner"
}
]
Expand Down
5 changes: 5 additions & 0 deletions toolkit/imageconfigs/core-ova.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,11 @@
"KernelOptions": {
"default": "kernel"
},
"PostInstallScripts":[
{
"Path": "postinstallscripts/mariner/import-keys-patch.sh"
}
],
"Users": [
{
"Name": "root",
Expand Down
7 changes: 7 additions & 0 deletions toolkit/imageconfigs/postinstallscripts/mariner/import-keys-patch.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
#!/bin/bash

# Import the RPM Metadata Key
rpm --import /etc/pki/rpm-gpg/MICROSOFT-METADATA-GPG-KEY

# Import the RPM GPG Key
rpm --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/pkggen_core_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ krb5-1.17-3.cm1.aarch64.rpm
lua-5.3.5-5.cm1.aarch64.rpm
mariner-rpm-macros-1.0-3.cm1.noarch.rpm
mariner-check-macros-1.0-3.cm1.noarch.rpm
mariner-repos-1.0-8.cm1.noarch.rpm
mariner-repos-1.0-9.cm1.noarch.rpm
libffi-3.2.1-10.cm1.aarch64.rpm
libtasn1-4.14-2.cm1.aarch64.rpm
p11-kit-0.23.16.1-2.cm1.aarch64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/pkggen_core_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ krb5-1.17-3.cm1.x86_64.rpm
lua-5.3.5-5.cm1.x86_64.rpm
mariner-rpm-macros-1.0-3.cm1.noarch.rpm
mariner-check-macros-1.0-3.cm1.noarch.rpm
mariner-repos-1.0-8.cm1.noarch.rpm
mariner-repos-1.0-9.cm1.noarch.rpm
libffi-3.2.1-10.cm1.x86_64.rpm
libtasn1-4.14-2.cm1.x86_64.rpm
p11-kit-0.23.16.1-2.cm1.x86_64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,7 +236,7 @@ make-4.2.1-4.cm1.aarch64.rpm
make-debuginfo-4.2.1-4.cm1.aarch64.rpm
mariner-check-macros-1.0-3.cm1.noarch.rpm
mariner-release-1.0-6.cm1.noarch.rpm
mariner-repos-1.0-8.cm1.noarch.rpm
mariner-repos-1.0-9.cm1.noarch.rpm
mariner-rpm-macros-1.0-3.cm1.noarch.rpm
meson-0.49.2-1.cm1.noarch.rpm
mpfr-4.0.1-3.cm1.aarch64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,7 +236,7 @@ make-4.2.1-4.cm1.x86_64.rpm
make-debuginfo-4.2.1-4.cm1.x86_64.rpm
mariner-check-macros-1.0-3.cm1.noarch.rpm
mariner-release-1.0-6.cm1.noarch.rpm
mariner-repos-1.0-8.cm1.noarch.rpm
mariner-repos-1.0-9.cm1.noarch.rpm
mariner-rpm-macros-1.0-3.cm1.noarch.rpm
meson-0.49.2-1.cm1.noarch.rpm
mpfr-4.0.1-3.cm1.x86_64.rpm
Expand Down