Fixes for config_default_repository_key_check()

Currently we assume fetching is not required if the host distribution
is not ubuntu, but this is wrong. If the host distribution is not ubuntu
but a ubuntu tools tree is used to build rpm based or Arch images, then
we still need key fetching.

Additionally, make RepositoryKeyFetch= a universal setting so that the
tools tree can have it enabled without enabling it for the main and subimages.
We then also drop the condition from config_default_repository_key_fetch()
that checks whether we need key fetching to build the tools tree distribution
because this will be determined automatically now when parsing the tools tree
config.

diff --git a/mkosi/config.py b/mkosi/config.py
index 3c99671c50e4b2318ab076a7010504749e6be918..0116e625be15fd517f48b1388171b5f77c27419e 100644 (file)
--- a/mkosi/config.py
+++ b/mkosi/config.py
@@ -1006,22 +1006,15 @@ def config_default_repository_key_fetch(namespace: dict[str, Any]) -> bool:
     def needs_repository_key_fetch(distribution: Distribution) -> bool:
         return distribution == Distribution.arch or distribution.is_rpm_distribution()
 
-    if detect_distribution()[0] != Distribution.ubuntu:
-        return False
-
-    if namespace["tools_tree"] is None:
-        return needs_repository_key_fetch(namespace["distribution"])
-
     if namespace["tools_tree"] != Path("default"):
         return (
-            detect_distribution(namespace["tools_tree"])[0] == Distribution.ubuntu
+            detect_distribution(namespace["tools_tree"] or Path("/"))[0] == Distribution.ubuntu
             and needs_repository_key_fetch(namespace["distribution"])
         )  # fmt: skip
 
-    return (
-        namespace["tools_tree_distribution"] == Distribution.ubuntu
-        and needs_repository_key_fetch(namespace["distribution"])
-    ) or needs_repository_key_fetch(namespace["tools_tree_distribution"])
+    return namespace["tools_tree_distribution"] == Distribution.ubuntu and needs_repository_key_fetch(
+        namespace["distribution"]
+    )
 
 
 def config_default_source_date_epoch(namespace: dict[str, Any]) -> Optional[int]:
@@ -2627,7 +2620,8 @@ SETTINGS: list[ConfigSetting[Any]] = [
         default_factory=config_default_repository_key_fetch,
         parse=config_parse_boolean,
         help="Controls whether distribution GPG keys can be fetched remotely",
-        scope=SettingScope.multiversal,
+        scope=SettingScope.universal,
+        tools=True,
     ),
     ConfigSetting(
         dest="repositories",