[Bug 1881278] Re: Ship 2018 Archive key in xenial's ubuntu-keyring
Brian Murray
1881278 at bugs.launchpad.net
Wed Jun 3 16:40:09 UTC 2020
Hello Dimitri, or anyone else affected,
Accepted ubuntu-keyring into xenial-proposed. The package will build now
and be available at https://launchpad.net/ubuntu/+source/ubuntu-
keyring/2012.05.19.1 in a few hours, and then in the -proposed
repository.
Please help us by testing this new package. See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed. Your feedback will aid us getting this
update out to other Ubuntu users.
If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
xenial to verification-done-xenial. If it does not fix the bug for you,
please add a comment stating that, and change the tag to verification-
failed-xenial. In either case, without details of your testing we will
not be able to proceed.
Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in
advance for helping!
N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.
** Changed in: ubuntu-keyring (Ubuntu Xenial)
Status: In Progress => Fix Committed
** Tags added: verification-needed verification-needed-xenial
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to ubuntu-keyring in Ubuntu.
https://bugs.launchpad.net/bugs/1881278
Title:
Ship 2018 Archive key in xenial's ubuntu-keyring
Status in ubuntu-keyring package in Ubuntu:
Invalid
Status in ubuntu-keyring source package in Xenial:
Fix Committed
Bug description:
[Impact]
* Xenial systems will not be able to debootstrap Groovy archives when
it finally switches to be signed by single 2018 key. To have support
for xenial to operate against Groovy+ archives it needs access to 2018
archive key. Ship it.
[Test Case]
* Start xenial chroot or lxd container.
* Observe that 4 keys are trusted - the original 2004 archive & cdimage, 2012 archive & cdimage
# apt-key list --fingerprint
/etc/apt/trusted.gpg
--------------------
pub 1024D/437D05B5 2004-09-12
Key fingerprint = 6302 39CC 130E 1A7F D81A 27B1 4097 6EAF 437D 05B5
uid Ubuntu Archive Automatic Signing Key <ftpmaster at ubuntu.com>
sub 2048g/79164387 2004-09-12
pub 4096R/C0B21F32 2012-05-11
Key fingerprint = 790B C727 7767 219C 42C8 6F93 3B4F E6AC C0B2 1F32
uid Ubuntu Archive Automatic Signing Key (2012) <ftpmaster at ubuntu.com>
pub 4096R/EFE21092 2012-05-11
Key fingerprint = 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092
uid Ubuntu CD Image Automatic Signing Key (2012) <cdimage at ubuntu.com>
pub 1024D/FBB75451 2004-12-30
Key fingerprint = C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451
uid Ubuntu CD Image Automatic Signing Key <cdimage at ubuntu.com>
* Install the new ubuntu-keyring package
* Observe that 5 keys are now trusted, including the 2018 archive key
# apt-key list --fingerprint
/etc/apt/trusted.gpg
--------------------
pub 1024D/437D05B5 2004-09-12
Key fingerprint = 6302 39CC 130E 1A7F D81A 27B1 4097 6EAF 437D 05B5
uid Ubuntu Archive Automatic Signing Key <ftpmaster at ubuntu.com>
sub 2048g/79164387 2004-09-12
pub 4096R/C0B21F32 2012-05-11
Key fingerprint = 790B C727 7767 219C 42C8 6F93 3B4F E6AC C0B2 1F32
uid Ubuntu Archive Automatic Signing Key (2012) <ftpmaster at ubuntu.com>
pub 4096R/EFE21092 2012-05-11
Key fingerprint = 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092
uid Ubuntu CD Image Automatic Signing Key (2012) <cdimage at ubuntu.com>
pub 1024D/FBB75451 2004-12-30
Key fingerprint = C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451
uid Ubuntu CD Image Automatic Signing Key <cdimage at ubuntu.com>
pub 4096R/991BC93C 2018-09-17
Key fingerprint = F6EC B376 2474 EDA9 D21B 7022 8719 20D1 991B C93C
uid Ubuntu Archive Automatic Signing Key (2018) <ftpmaster at ubuntu.com>
* Dist upgrade to bionic
* Observe that only 3 keys are trusted the 2012 cdimage&archive + 2018 key, and that none of them are in /etc/apt/trusted.gpg but are key snippets in /etc/apt/trusted.gpg.d/
# apt-key list
/etc/apt/trusted.gpg.d/ubuntu-keyring-2012-archive.gpg
------------------------------------------------------
pub rsa4096 2012-05-11 [SC]
790B C727 7767 219C 42C8 6F93 3B4F E6AC C0B2 1F32
uid [ unknown] Ubuntu Archive Automatic Signing Key (2012) <ftpmaster at ubuntu.com>
/etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg
------------------------------------------------------
pub rsa4096 2012-05-11 [SC]
8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092
uid [ unknown] Ubuntu CD Image Automatic Signing Key (2012) <cdimage at ubuntu.com>
/etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg
------------------------------------------------------
pub rsa4096 2018-09-17 [SC]
F6EC B376 2474 EDA9 D21B 7022 8719 20D1 991B C93C
uid [ unknown] Ubuntu Archive Automatic Signing Key (2018) <ftpmaster at ubuntu.com>
[Regression Potential]
* Adding additional new trust key can trigger support request (aka
why are you adding this key on xenial). The reason to add this key on
xenial, is for xenial to allow securely debootstrap and operate on
Groovy+ repositories which are about to drop 2012 key signatures.
[Other Info]
* Bionic switched from shipping keys in /etc/apt/trusted.gpg keyring, to individual snippets. Thus xenial's upload that adds the future key to /etc/apt/trusted.gpg should also remove it, during upgrade to bionic. To ensure that the systems upgraded from xenial to bionic, look the same as those that are fresh bionic installations.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-keyring/+bug/1881278/+subscriptions
More information about the foundations-bugs
mailing list