From f16fb156bb2ac6ff288900b8cc3b374d06fa80e8 Mon Sep 17 00:00:00 2001 From: Virgil Dupras Date: Mon, 9 Nov 2015 21:23:51 -0500 Subject: [PATCH] Fetch Debian archive GPG keyrings when they're not available When running the debian template on a non-debian host, it's usual not to have debian-archive-keyring.gpg. When that happens, we skip the signature checking of the release, which is dangerous because it's made over HTTP. This commit adds automatic fetching of Debian release keys. Strongly related to #409 Signed-off-by: Virgil Dupras --- templates/lxc-debian.in | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in index c887cc18c..3ae996599 100644 --- a/templates/lxc-debian.in +++ b/templates/lxc-debian.in @@ -248,6 +248,24 @@ openssh-server release=$3 trap cleanup EXIT SIGHUP SIGINT SIGTERM + # If debian-archive-keyring isn't installed, fetch GPG keys directly + releasekeyring=/usr/share/keyrings/debian-archive-keyring.gpg + if [ ! -f $releasekeyring ]; then + releasekeyring="$cache/archive-key.gpg" + case $release in + "squeeze") + gpgkeyname="archive-key-6.0" + ;; + "wheezy") + gpgkeyname="archive-key-7.0" + ;; + *) + gpgkeyname="archive-key-8" + ;; + esac + wget https://ftp-master.debian.org/keys/${gpgkeyname}.asc -O - --quiet \ + | gpg --import --no-default-keyring --keyring=${releasekeyring} + fi # check the mini debian was not already downloaded mkdir -p "$cache/partial-$release-$arch" if [ $? -ne 0 ]; then @@ -258,7 +276,7 @@ openssh-server # download a mini debian into a cache echo "Downloading debian minimal ..." debootstrap --verbose --variant=minbase --arch=$arch \ - --include=$packages \ + --include=$packages --keyring=${releasekeyring} \ "$release" "$cache/partial-$release-$arch" $MIRROR if [ $? -ne 0 ]; then echo "Failed to download the rootfs, aborting." -- 2.47.2