[Bug 1754075] Re: apt-setup uses apt-key but probably should not anymore

[Lars Kollstedt]

Hi,

by the way apt-key belongs to the package apt:

root at bionic-test:/home/kollstedt# apt-file search apt-key                                                          
[...]
apt: /usr/bin/apt-key
[...]

It is installed when the error occurs and is exitting with the error mentioned 
above.


But there is indeed another way to add the public key without using "apt-key 
add".
 
They can simply be copied to /etc/apt/trusted.gpg.d, with the ending *.gpg if 
it's binary format. With the ending *.asc for ASCII-amored format.

Please find a patch attached that use this way to add instead of the old way 
with apt-key.


The two following Debian Bugs for this lead me tho this:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851774

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=886473

I also sent this message to the first one I considered to be the main
one.


For the ones reading the debian bug, this was mainly send to 

https://bugs.launchpad.net/ubuntu/+source/gnupg/+bug/1754075

Since this also found it's way to Ubunut 18.4 bionic (unreleased LTS).


But there is some (more or less) usefull disscussion but as far as I can see 
no patch, yet. So I prepared one. Thanks to Marga Manterola and Philipp Kern 
for the idea.

One of the most important errors in stuff discussed there is IMHO the lack of 
"-- " which is necessary to prevent grep from interpreding the leading --. I 
also decided not to filter for things that are not relevant. Since comments 
describing the Publickey or it's origin might be placed above the -----BEGIN 
PGP PUBLIC KEY BLOCK----- (without hitting gpgv), and we would not be able to 
prevent all possible syntax evil here, without having gpg to import and export 
the public key to and from a temporary keyring.
I'm also trying to assign a useful name to the key added this way. 

This patch should IMHO work, but I have no opportunity to test it without your 
help, since we're in udeb and testing preseed issues. ;-)

Kind regards,
	Lars

-- 
Lars Kollstedt

Telefon: +49 6151 16-71027
E-Mail:  lk at man-da.de

man-da.de GmbH
Dolivostraße 11
64293 Darmstadt

Sitz der man-da.de GmbH: Darmstadt
Amtsgericht Darmstadt, HRB 9484
Geschäftsführer: Andreas Ebert


** Bug watch added: Debian Bug tracker #851774
   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851774

** Bug watch added: Debian Bug tracker #886473
   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=886473

** Patch added: "replace_apt_key_add.patch"
   https://bugs.launchpad.net/bugs/1754075/+attachment/5107719/+files/replace_apt_key_add.patch

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to gnupg in Ubuntu.
https://bugs.launchpad.net/bugs/1754075

Title:
  apt-setup uses apt-key but probably should not anymore

Status in apt-setup package in Ubuntu:
  Confirmed
Status in gnupg package in Ubuntu:
  New
Status in gnupg2 package in Ubuntu:
  New

Bug description:
  In di if the kernel is in a private PPA we seed di using

  d-i apt-setup/local0/key string
  http://keyserver.ubuntu.com:11371/pks/lookup?op=get&search=<key>

  this used to work in xenial, but in bionic this fails and therefore
  apt update fails in base-installer. May be because add-apt-key is not
  installed.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt-setup/+bug/1754075/+subscriptions