From a3d8d7c7555974a714de141f156ae57411d66e9f Mon Sep 17 00:00:00 2001 From: gdm85 Date: Sat, 7 Jun 2014 12:57:59 +0200 Subject: [PATCH] * added Debian Archive keyring * added questions to user about keyring differences/trust * added documentation notes about the Debian Archive keyring --- docker/gitian-host/README.md | 5 +++ docker/gitian-host/build-base-vms.sh | 4 ++- docker/keyrings/debian-archive-keyring.gpg | Bin 0 -> 13568 bytes docker/scripts/build-wheezy.sh | 39 +++++++++++++++++++-- docker/scripts/create-gitian-host.sh | 2 +- 5 files changed, 45 insertions(+), 5 deletions(-) create mode 100644 docker/keyrings/debian-archive-keyring.gpg diff --git a/docker/gitian-host/README.md b/docker/gitian-host/README.md index 804c96e..7472a9d 100644 --- a/docker/gitian-host/README.md +++ b/docker/gitian-host/README.md @@ -14,11 +14,16 @@ Preamble It is **necessary** that before you using these scripts you read them and understand what they do. Why? Because your goal is to create a gitian build (deterministic) that has not been tampered with, thus trust shall be correctly attributed during your process. +For example, in this repository I provide the [Debian Archive keyring](../keyrings/debian-archive-keyring.gpg) that is used for the original debootstrap, +however you **must** verify its authenticity and that it is exactly [as provided officially by Debian](https://packages.debian.org/wheezy/all/debian-archive-keyring/download) +in order to continue using a trusted chain of systems. + See also: - https://gitian.org/ - https://en.wikipedia.org/wiki/Web_of_trust - http://www.dwheeler.com/trusting-trust/ - https://www.debian.org/ +- https://wiki.debian.org/SecureApt - https://www.docker.io/ - http://www.ubuntu.com/ diff --git a/docker/gitian-host/build-base-vms.sh b/docker/gitian-host/build-base-vms.sh index d05546e..beec2c9 100755 --- a/docker/gitian-host/build-base-vms.sh +++ b/docker/gitian-host/build-base-vms.sh @@ -23,10 +23,12 @@ function ext_partition() { loop=`sudo kpartx -av $OUT.raw|sed -n '/loop.p1/{s/.*loop\(.\)p1.*/\1/;p}'` sudo cp --sparse=always /dev/mapper/loop${loop}p1 $OUT sudo chown $USER $OUT + ## following 2 lines are a sloppy hack to an unknown problem with kpartx sudo sync sleep 5 + ## these are silenced because if former fails, second doesn't and viceversa sudo kpartx -d /dev/loop$loop 2>/dev/null - sudo rm /dev/mapper/loop${loop}p1 + sudo rm /dev/mapper/loop${loop}p1 2>/dev/null rm -f $OUT.raw } diff --git a/docker/keyrings/debian-archive-keyring.gpg b/docker/keyrings/debian-archive-keyring.gpg new file mode 100644 index 0000000000000000000000000000000000000000..46d1f0e23f17522e0d4fb358b24d78b8c53add58 GIT binary patch literal 13568 zcmbW7V{m8f)~Elm-LdVYW81cE+qRSLxMSP4Z5!ROopg-p^mER6-+8NMYHGgj4{KNL zy7pSvx_@^nFdV3~cF{QyB4DytVuq8PuNSrP#J^d`7Ia<=#*|OHpW`KYMaR1kfj(IK z3Ku?hh8iHa0xgBD+ir&h#<<0oZHAT&W9yl{d_<(KL%_-F(XCg{?}M9bQ+ynEC79er z5LRo1lGGW@0WI8`k<&_`Sx{Rd+_pID&!rdB(I}BYT?Gu?&X~=dPVv3Mcv@ClaKM#A#?-RM%QzcMnCd zkqi}mQ@wYH4Mr*ex}xA4D$Nf*40G+2T2))d#fG(N`WU*Za`a~u($f&VmC0;Y8&}P@ zUTJ{=IxWmL*9F>6HJ$eI#PPT$UB-cjhr6?z6!eN$wTlOW!n>+RlO=4d3v!8};qbcJ zeE**Ps<8&S`3g>OIKuDOzfCqU2GJa(xlL$`(*{Lc`$No(){u(i2hZ9G5%N&75{<*Z z#BGVNqF1;{&mtjny_c7?;5+Oo7U{4DdJpp!MWd{ zQHkilN6L$&7Qy#JrZvx9eQ_}(KCY=Pj6?}CzS}Q~v<0+=4k>y$c8Ymh;D%R5d085G z#E<75lzvn0kv|N81OxzT;8t>QF){HpAy9HQFtj!yP&BbNF>o>=kTUTg;5Iffv@o!x zb^PZUzqN&vvlHDv59#b2&3Ge#c|lQtfB_U>z@Jb7V}pP}!BLp|gTp{ULVy5+qe22h zLBoKe0fPVm;{gGq`vah%5RJuA<646VpQx`80Ub{Qi4kpytwXd7dmRk=7U`*67@>$M z{3<_RcS#wdF@-DIj@1N2nKrveHj1>HzT*6Lhf-~>J=Wg7lF>(@-R`=csJ7ID(5xN| zff>0Nb#&nU?NL(L?;;eZXl+3{RZF_)I*WpVgp_u zwK2-noA%I3dn7JtM97*IjREq~nHrGMSH8-?j=ybGRsMOaDXOrMQ+ML*uG%v1d)>1yJ3smnv<@(v%w^ zE*}$QFu_K&{$h4(tX#SnBz-uKP^C4%0FVe!98g3cNC5aJL<2gXh{*RF$#7EQJWY<` ze`qAF309?tD(;HHK8Zcsv>V^~I=M}X9(&M?M5aS8)prF|`>2>+H#hN?x6?kavXzE( z9}VxCeO*st?9*esw_EduKg(~80e_++1%)rDcGm(=8FgSeFB|h-aAae2D~`g`Rbro` z<*O{&6XsuG`KjmCRE#-tbE;n+*|6;XdJKYFk1o*!3vqQaq-p&-8LXTM@Jh5^?M!p- zGNneGM?;Zydy1YocQgN-NEpmn%-4Qlnak^NAxVD-d#pm9F_=r%{nD#x-`d_@S)bDY`w6cSLb`VKwmXQxg7XW#NklmUCp)aG z$C63$3q={FM=*1%7JCMAp4xnj^U(7>H)+3}(MT$=#T%U0NBecs))c?}M@=DJP{slv z5yIX^w>`Kx9Q||K^9m^{x@xTt!71gDI4Oy-i6vtq-*P>IJ7gxQ*^++m4eu%W9g@LE z@pcu&adWQjwOr0l74}q!@fC2=>IT$dtlE}Z&d9HH-S)Mu7;e+(GQ}@x`GMd1#$E$u ze1d(v%IpO5E=gd%s17hP!wu2G!6buEQl7J!ikLxJz%~xujJGR2LFp0ZI;t|X$7r|v z2XnfQSN36z^cWV$GAZm7=~)k_qi6(t6iZLMpwQ**r-Vt(eVc~Y9e8Cn@3in?Us~ub zRHWQ_5rv2)5|pa7zxB+Al{1C5p(uh5N5_>_O#+$c)?D6S`9V0#kl=WfSP}y@hWyo~ z$n-*dG9?Js<9Abo7}hDP)hW!x`@a9ZpCmU-e~rza3l@a&hC|j`vH=Ek(WD)`UtN1Y z=<_{q!VVw3J(d|!a<;QXma+*-4n4m}Q)ko&sX(?otik?M9Fpn8^Wm4vQ8!i{xu>9m z^kwSg<^@b+nCwUV%wtT(wlU;RGy`RE1;}(8L9w4HY-~1Lkreo977Jm`0jR=6+5@Ut zw9R?>sCi<)o2u>78&Y;=mokD84-<_ZDX`I&=Md1NAvc}g_7Y*{)k=33w;9PZ>6D|S zzmqV|GBI;)`|f`WZ4hLKe?b5BGEEHea+W`Sw@aRMT8B`;opVX>jtw2jbh+Z$cF7yj zFktg5m||e~UDQ!jkgJ%oIvso9N7%N8lR;!SPxnQ9<<20p49S*M{&$~~v|91`(lLpz#RX4^!-b3mm=B7u0T;x0#_y5^M^ zG3rSptMbm!5e+BKiJoymuek1nX{i-~^mBnbAd#mhN_`S4+I7kgI&O^mes8?l%%2F( zwD@e=YM`yGw`v*9kVp3mijaY05XIchonYM!;`Q@J)Ai@<{Am$@a8Xc1qW-LH$AyRq6o-2RaK@M+_p*;Hfj;C4_iff_y*ko$RZz{!@cfNX`$0oa_!5$ z&SotS#`~-l0sPwzCpoBjUH-*SLlbMJ5$FOFpddo=W9*^s!cWVk}@|9 z6A)`&==qpgvY36{@2;YQO|EI%Nu%ZtN5w6fM#UGLNWHs@&pH=KT)pJ#FZQR$zG*QZWq zH+--eZb>uU$j*&VO4+AAbZ{awnwcJJQAqd#d1UW0IVn^d4&LvWUZDtS$Zt2F46}Wag<;m`m$)%*ry@5%b{KZ{rtt-6aIcMdRF*07ZvTx+c{;2% zYGY9fFx8+Arry~3m6tgAJTVB#bwKCI6&2O>dxz26uN_hJzzrQ;D=Fl;D5W~=-@MaT z-tj%%QL90;rdX{~B`e7=@2)9vj4Zn%u+`;PyBkaVCd&L5O=xhU=6%;c$6-S~6l{WY z84y73z<72OHd=sy;B*7*qnUq?0f~GflKLsh?s(IGB>BMCj1fA?;rgQ?=|RMBPwHHL z(lslsSAy2)Cd%;4FPN5GNkz;>puW=-^|0FnjRTTyxflCVwbUC6&8c)3i;bm;e^TLW zE?UO3@$i67M<9d82250?8GAN#rfwP^3|g{N^apwH(Rco-^IlPzWdU%dRVLF^NL)T# z%iF;(XyLTgcf;C5ft{=1ebX1n+W^L^<(vq_9v{c2=L`_{I!8IZ&BGQ}`JDMW^tJH& zY|Tl|4M}VVXsGIld&HT*Z-joi(%g7cHW0#FIhpkc(qFYnG=@ct9lbS=W0k8CKES#X z!{7)4Cw}ASAIUaweG5XY_gwtaZ@~h}p7`S7K#RC8;cF(k8F-D%8x_k_t|cL-XLt&I zu@dkaPVb}{t<~?Ppa_g{kL&C3@og`{VVd4DJjMYBPmF)@t@a0bfRoyWlR(|L#^^Wy zurnTaw&hgklKS6r2?9zfoQ|+-hJkRFq>1} z;%}MTjkEY@{3ZGu6!QI^D_AR(Y!0K!e>Q{=up>r?vE_jv_^2S8dPO+GLrmByV|H=C zdZ#~HT!`U$=|GlluES^sKA!F7VNnrT1Q8;t#ETF~WLK2K{tWnXCDI5|&4FAa{&qWH zCU)7#CjAr39)^oWjFeFoFdHiWw6_*DQkE$2k0eV7{}o{Z0Y@Wq3s(~Y0T*XG8v|zx zBLXE0Gg}K=v%k7b!Akd)-svBmrX=7tb+)%LaB?hl!+eUpS0)cbp!%lq5vT|U}8dV zq(X#aUekAuecI0E$+lbe+h5x0UubRXm5`=4huwEhc{hmETsJk z<)orWG#Lpw65Dr3fznL5Z-KPf6w?w_g9g?3c`2=BLjtZIgY>twOPO4lExrni4F!0y zUFqf;>7x9=OWI^7zH17aocy3}qZzhsmguE`u$bp}RzbN1XSg5q{F=#0q7I1;s-_mv z!-yYkD!~a^&voE{^gXel%qew0F}4yuI9sjGw~s-#-vJEzHsASOCpg=uEpO!QN68Im z`J<3rvhYjiRByXiP(8|m#$_@`f9n#F5js7VMUF?_D~03Yu5S8b^|)*q$dOHKsAlDD ztAw%&i%!ncqYSLyfKS*c5rhmS9P{sj-n|O%Wwu1*U=i0I@SGx_Mq9W}*-JZ5$Vf|d zEN+(${AIgM{%!b(-QxMm=~6U zWl@y_Y?r52rMUO$3Hw1VwpQT+jG*>o7tPunHkvHnwXmYS^Vhj?W`?~Jm{R=oj+f@jyA1T zOG-MRFNO%1L*keY|KWb{ItikpWv9gKFby6<$|NkbNANp?sNM~m+SNtHs&_UH`U zrx9}IJbH+i^@P7-r6>3orUDHU-En(f>w|u`tZGBh^9;TxZw7!H(q`hf_LwON?n0H1 zdq6TG#2d%BT@W(^U(@^+&8>Hl#W=P-s7PLy@-<%}^*G zR*^INwlhSx5~F6i@{mmLc6h(IQsE)2qyKP5rNRqsKg}RBHWsVAa=W=;#ELDj)w zX+n8BDY;6@xe5S)e3&2xEdYlN+|gd7dd?_E@LLb59F9S%l^))}l4z9S?|LhG8;{d9 zA2Dv+({WjFf#;?~f|7b5drauS&n+3u$ixPYXux|ak*HYTz1P4A8lYhl4SKJz$}87yUI z*iUkSO+hwB0dTR9%ijGemnP|eJX7=E+~Jq>D6uIxwh!NX`pYm#aq`SYRKH`DF4wv< zv9N^Y*uq}j8|?}d_;5?I^<^<+miOwl!mG<4Rj_SEt zPW)Dxy~sy)1~n^!Z96*F+X5Y7$EMS(KX2Gi4kG70#EU_bi~2GQNe)~%KxyP%>|5GE z=_k>o!rMQ{(;-(ffom*TZNkrO!v6a&{?}JUq zj~?jra&hxCh^)2g;`WIC;QgfRY>D_grlY#e9f5$=PiHB#*$8)w5^?G4@${;p5Y=$+ zwF;H%hpb=o!JSS4#CpQ&SZ(}cog$26jSb@V%?ODl2sAOlq2^Q9U?V==$mT7uAGNqz zNVHg#A1_+=#xcM1S(+tyaUaHn^s{>s)cl%A9CB%4*l}}UX1JK(g)BsSNsVWa^?ZXr z?Z%?ryrO!EI+TjzyEd6nvt7>!HSfHoS$f3u-d+FN`AmKb;?OP7W7@i9@I1w$uax?RP5dr#dh^U!=BBDF?0?4ltE||cA_;7M@ zRHa+s^gqXlfPQsMVJ_V}Tqe0aMCO*sSWEhlj1q*7VH;;e7|?Pqzf|NeORl=lsWqp3 z_5AHlF93GBoWL6&oYny>Z@%2P33hSyGIm6Xu|HM8YcKMFw$f3rT7P7+-ewW3{l)mr z#g2-FdnV{gHwL|@TMHky-)w=AF0Lq z`Gp|RowoohlW3xrfGm;?HvUZ{Bk>L4^}6pezcA_RX>9>H@%9pdG~Y67Mi1x#HBig> z61?e{|Ff2M&1bC$!p4nB)RG_^c|f)xq94tyx2)%nL29R}n)cG5o_tb3wiyJi9LS-5 z41(1*5_t{zQojlc%76Xc|C(Xi1E0nEq)hV6XrhpFj1fLuEqw)F9Bam6bDLG9Epo%a z$ocV5Qq@65?Q-V6(69urj)+ z8T?R08oYq%^a}(bTuab)`KYXWdr5I zE=#U<((V8eJ!c?kZP;z(Z}00Te3Zlbi4^gNy?a9Y2+xDLpH#w(5Sdkq5g(c7T-6sU za^y;0edHl_GjUZ%c270%?RRsX@ma`sppz#%M9dDg1;A9_rGDi4Z@hyPgA0xhWUQn| zk`ygfdy2rrUS^p^hL%2cw6=VN8`xpj;T*x{+Z@1AuV5{7fH10hftI~_OkH+gCxA*O zsdY~b2UCg)*=9nF6D^kxL4iYBZ?=CUQ}!#ZIiMYfMGCYQvBjlLQ{%_^+HcJUf%CeY zv5nUj2U46+lZ+{uwSGf)PjHn!7gRY)N20j1QP0SZRilOxgqZeYw|xE8Wps+EuksHn_t*y21$~ag7Xq^uH>Z64DvUCIf*xyiZC@hIwqdAW%lR<}W^2wB$!Mk>5`(NHvaK^Huhczvi zv2b!D%M8U>-V3w0%W7uwu={TJjMa=zIp4m#w`x4lL7dwd$FWE{sXr*FlHr-BSwq|) zmy5x;qt#J_XVdcWI)$?x6(^*D0n%`R=1AE+6fF4lj8cLzFbSSqi*Mgvis ztW$|p)?%KXmJD#b-a=ANfxmaVeBk>nrF{32$RtPbI@0`sQnk-%v@J5cg@ca4OAb#n z^9pWVs~`H)G89#C=%Ha%Tkoq&(3%w|t}5NWmV^-~Iv>kIKooIB5dz|pQ2FhipWZd2 zzdIuBM>8I@?OK;zsk?&W`ihUbiO79^|H=U=dY)UlcV@y<7$=T>-MIjg^rV+)(CgqT zB45;yTg4k()Vbk=pR+_^$I*qdsFOQzWn$Ncuk$g?9{e6z#~zOyHO>2_Q#^Q0TQs@^ z`l+zfyG09v?9Nw=dU{%rM>9-H%JGQJbMR~(C01HKEsce+ppb%HRpmz&8c`YB@Ea;V zxZmwku$cE!k~VL1U<+I^tdAiey37*DMBTba8+T|adUDHVLhnH2BE46dJ)9QjG>-J% zQu_gdCfsMDo8P6UF7%IEn&`z!lW`R8+$ziwLY8Xd^s?3s=bbj%Af-g_ulK*2CX$$jq_znZdj?!AU!kK z5vqY9AUSAxmdNOXlk}gRpG(dBPcG*1|Cx(@ZuyV^axmaerv8(Q{b#?2hWgij|6j3~ zU0rUU$w#yCq$0vQc@VTZyJvpUSN}7yVTPkXHk7CGi(<+c5q$oMeccK4vD=31T#e#Z zeSiAlV~h~XD_Q;QvYAc(x7MavjRAjuIHTVi{DifJ)2Tyi17GTYhFbrW3&p~+OGWhE z6u(B`?R+o~els60HM>7|vD3iHt0`IZIyqyds~dcng5B5A{E^KOvDMhNEmH4oTy64v zU4XWoZg1C+N4@EQnwg4ns@`YwH6)KtD19mX7=MiRK{BR8P6_n55J-0SRWp*LLy@tC zQ{k!BvRcRWQIp?eC60m!VkI8hQLMdsa!n~)@r46AGB7O=ff*v#qPaT}H!w0JQlbjv zy;6TaR`J{^^hNk=uEN=KDdm0!XttLa5zBcU4+!3^>beW=%Uh4R4X_339mv!wH z6Tw3M@aNtla%lJ_l?n@?oS-%=-5^wU7ZK;KxBL3s$$RQwL5etz{?$ViC=P0X>t) z>I5_(1ce{=gVAF)$}lIwdoC?fPBY1>c0Tv+7fJNZpXK+hNZ^V>JR%68&Y!Bf-Twz6 zQn5IAZ{;FCpf@T%Z;s@6b8EnI5HMSNDmo^p;*w@L0lD8YEH>hY1n|pG`xwATgmo+T;t&=Ob`j z5wAiY^O|@3n}`5JrX;6^#5l^Y9Rf&#zK3N-Z9Ds04=dn>g<9Em?dauK(K>>)87*DF z5%`l=JNq=6aI;=}qBL8OQ%N|->N(3(!%-*!CTlYBQ~Ao$XgQ|9=-QpaTB0`}Nx)T$ z9Sss3i_{fAIt1syd}d;lPlHp*muMOZk=+mn2Hlq0hOe=*4^`r|GKrYanh=?csqO%Z z=_bG^NQG%A5u8`+;TAneqhaLbW99c&42a1(o5WPR&!+(tYZ!98L%AWa2$iHI|3K&4PzH%6fG0YpFtM74x zg9)e)@j3k-kS+5Y1^_WIJ!XxC8N6sX%a4NZr|{Rv|E942;8w~$`C07WDePkk0iXyU zC@WMHIt@Vuju$4peSjf?*0!Q1YYym3ueONfqkLxw(8-4*Gf0VTAiO_r^&M%P1RVl0pdbe04BABiMIBRI07HzpAx{Q@HX{C0`F}Jk>mnVCc9x z8|q|yLzr~1PGTUHmJ;iP&>?Yhi$(dRQK=Gyv`L1K^b2CUB0|=J>9XI<11IWAc=;uP z-zxCMWM&8RuT-MlC8g8#ie($hXXj_qGQA^J{lXf_Yl%B6ctOP(!F$QOh@oH9KWI24 zk*(v-aQOh%M^G?G9&!)x?8fx%d#icQ&{bDrT%*()XeVwpojt;p`7%_bexPfc^uOk2 z@_7ai_Mn)_XgH5IK(nBV^2Eml0 zT2WpM$83`@TM$_r$@C5foUkTHS*5zJ{jgtaGw#Br|DdA&$u0_=U?}0Fo+&+N^j6y9 zN}15Htdd2q*wT`Dug*L+3hPnN)zI}W5-rEXBzCa_+{#4F7#lKL{u@Q4W5Lwc-ELXk zbA|w&O-<5PJ*!^&u#fzgiF_Wdm2kXVcQK&MC`;<$c(z3O&ld4lk<%_d6?rCHu#)D8 zDzX~G=-G=vDTp!myVwa!*Wz0INY)L>RG5o{MdzzM+#a=hz`iSJQj>?>t6QgemA7M4 z?eVuFUukTEI8tdcYBa58hjCNFbD&~lJKDl3CkFTEUxNeJ$4rM^<<&=dhyGL8XkxUD9|r-IUz{fCFdGW z?^gz?el0TP<3%@1`1$Ww7a0s&=cKXGf8RDy*JOZK8g?ySJu#@D#KTi(w%u&9v6P?e zLX+$~{OTu|24telv|SsA|LuqKnUIu}E$fvjYIJ0HsaW4xaVh4~+(Psu76bwJ(@#*4EWITO~qd>Dd0}zWnU<9mJAFC}?0hk9E zPuOk6+qXFho~_ZS1)dzELeh~cMp=g~mB%w7_^P%3{^X{jQF{$f%rT2Pa_338U)7K{ zcHq)$%>Ek$@BZB#LiUFCbb5Q8r?=gUZZkP3R!=8NDhn+tKqFB9D6;tfTP()*Cl+)2 zE7SkyRP6H}8RX|ZGPys1{q`A0GSqQU<8cX+-3k2#T6c z_jlV`VEAr4Ai(@Rr-D#^I(baM6>M__f zQ~V%ai(hK=aWo?ofw)pB-wv)=q^4OuP-1tKf2+H#am{re`)0-a)EB&TV-J-*``;*= z9W4OILS9L1Z2g$kcf(jrw-*FH0Nk|lyc2?-)XEbgr2|L z=WizUTeW)vMzy}UU@73Pu-@zv>-N|EH8wSY!e)TxffW*krGn+@W3NR9?Y(bw-?}(h zfOp_D_2CfRg6OnAdI*NiedCK$#81H|0p_n;VqUi9GG{Zm0woGi*ep(K^3rjOZc1U{( zk3UMuQSK{*ZhtR`8AsH(!c_*UqAUDHECoI(J!X(*@hQxI(gzfze*`A&=IT>m{vC^P zeF0=Z28Amrvr5(aOxJaR7L@(nVac1OvXhb*Z zI>cL*kvJuIC=m0b;WHrZ)Y4%^I(q>7|2B(H+NPx_+Vr`qnb0%)sze29FdB7P?_v3J+9sx=@1k35%7cB$ znS0;;P`}-fJQ48)j`MA|t>`-e74vFf_v4mY`c7%f6U{m)xPboEUf0pZp_TcU12r{o zEZ{jWil0BMp?6c{BZo&mhGKa1J8a0FS^buiFLSLHy8Ug#&bJJ-qxxE~%Nrpj(69JK zbH^E}xf19DXkn!zWc@G3hr(I4dr5>;1+Cj#MW4E_Y8n)kYqgfX5#%VsxEr3!fr4+b zZjCLEZJcSIiQ-E$??*<3Rn9geHN=}`S*k? z=p`N7?#~qUm_fepfjMbI;}>T9=!y!_$H<8k*c46`sq(WLT_5|MWfxSrIyE40@#P$k zes}5H=1inYDsG;v>k<|zLy@x%9TFI@%a^CGgR1bsIaz7$Q% zGUD|l@0W?DkLYi_7v3qH&@zgic`x`DX^C?cx>)@$(0QH!N^ae z0`%VG)Z%erU&)aDhye9XIbZU>AuIHkIM4p`zkNnI|N2BAH=m!VgN;aW4Cl#M)gR#v zHN4TXsKPrVPAyW;YZE#+i;n%=EAnYqz79kw7))Z$B9{0z8!a=Dtxlxz0}a)76NM>h zj?P5G@k!}K3nsmFulfb7oZXJ!fa8MIRXq3t z$#IDinO>&_8^PlYF3NgW;SwtzS<`+*!dG?a&7nf%ogjDTL9@m;A$A8o#WWi(GvLy* z4b6aQhj8ah3Bt0kev_7L;qq3uTeRT7r3u(h>8U9zR5Lz`28gIX(7M+(ql;D zY7c1p6C(;umlE400)$Lm{RA0g8f-7glDB4e63}7n`<8DMiyhrmnsV`1e9KpaUDz%> zo#jeWKw=`C*Xo>@lNF2r6Kf2607ffxiO?5t-8+8<#Km1y=r7N`Uvf2%O;oaoj2BY>J*9NYX*2~N#Im*`2+W{A=T6AxkcV|DaPnWd50$6 zuaQ5J>yj}V7D$2S&JuPaqna<;%^1osmnBLRdG+= zKW`XT_ttC`Tq6l(!Sa}a=RmyKfdNhdVWc(x@?m)wSl9jtCgtm6@c^WCrwN3i2;;~i z4NS(yE^EW0v^Ks0p2J)GjtlR&oV!+I1 zSAQac)Uf}7TJsiI<%RHucJR>r^z$3A2bK7?x2A;v)Sp8iR^@~Tht|_7tR91;XOxo3 z^BG7+P02D_46$4hujIYTsz#ap%@raJlv@xNTf|4e^T`bJK!NE#&SJ~UQZByT2#ufj zlR~SiMKc7GhprYSgQKq^u$rr%SgJ|6X~NNTw8@Or7SP!tbw!aV*8T@55=C1fqw3t? znj^EK8O=+KHH5ZZ!_K%bb%zWUeyVM}1uUe`>pA8=m)XZ1 zlxz~Bff*hh*dt;vcfjs-_BD@6sTyMRF%TA(DTC}PJ@Bo$e`eIs>mIBqqOz5FhpYBd zYuh3Tc>c>C%KdxAl4!<#NET-@sF7R!o{E`p7y}rStL}rd&p!PxGWm`JKdqqi+mQ;r z0mFuB)N#}ci(@o{DK~pcqXN1>(*pjTMe|6*<$m|zG*E6FWT8#nDvGS!27_oTE?UfA zX-{F@Sc<_$QRfLv0!_gT zjNr5`Q82+kZ_Hf#xJiaw=?mu2$Ogw0l7VjTiZ}>(kDls~wopJB%7O;{rlF{FEojdB3H_ll(yp%0h1)5nkAh)biVeP%uFU;3CjIWL(p|g1e^JGgQ~-Pq z3nus`(x}J)YC)Z|09hiX7kK346u(n%Bq&gQ&)s*8^@#NlDy#+0c#_9>BAWLd5A<0SU#{h0@p0CopmdepQ$K5g*tuncx ziia3lDw#TRE}e=*C?5mmYO`W*RjRW!cZY1?N|M6>0<(Nn(0!1d> brdCAhOIaZ?EP#O}tQ%dkE8h6nXBYWjjwlbW literal 0 HcmV?d00001 diff --git a/docker/scripts/build-wheezy.sh b/docker/scripts/build-wheezy.sh index dc4bab4..f3a9a56 100755 --- a/docker/scripts/build-wheezy.sh +++ b/docker/scripts/build-wheezy.sh @@ -5,26 +5,59 @@ ## build a base Debian Wheezy # +BASENAME=$(dirname $(readlink -m $0)) + ## the distro we are going to use DISTNAME=wheezy DEBIAN_REPO=http://ftp.debian.org/debian if [ ! $UID -eq 0 ]; then echo "This script can only be run as root" 1>&2 - exit + exit 1 fi ## install prerequisites ## NOTE: may fail on non-Ubuntu/Debian systems -if ! type -P debootstrap; then +if ! type -P debootstrap >/dev/null; then apt-get install debootstrap -y || exit $? fi +## check about the Debian archive keyring +DEFK=/usr/share/keyrings/debian-archive-keyring.gpg +KEYRING=$BASENAME/../keyrings/debian-archive-keyring.gpg +if [ -s $DEFK ]; then + if ! diff $DEFK $KEYRING; then + ANSWER= + while [[ "$ANSWER" != "Y" && "$ANSWER" != "n" ]]; do + echo -n "The Debian Archive keyring in your system ($DEFK) that will be used to debootstrap is different from the reference provided keyring. Continue? (Y/n) " + read -r ANSWER || exit $? + done + if [[ "$ANSWER" == "n" ]]; then + exit 1 + fi + ## use system's keyring, even if different than provided one + ## this is a no-issue only in case the system's keyring is more recent than the provided one + KEYRING=$DEFK + fi +else + ANSWER= + while [[ "$ANSWER" != "Y" && "$ANSWER" != "n" ]]; do + echo -n "Your system comes with no Debian Archive keyring in $DEFK that is necessary for debootstrap. Use reference provided keyring? (Y/n) " + read -r ANSWER || exit $? + done + if [[ "$ANSWER" == "n" ]]; then + exit 1 + fi +fi + +echo "Will use $KEYRING" +exit 0 + ## NOTE: a temporary directory under /tmp is not used because can't be mounted dev/exec mkdir $DISTNAME || exit $? TMPDIR=$PWD/$DISTNAME -debootstrap $DISTNAME $DISTNAME $DEBIAN_REPO && \ +debootstrap --keyring=$KEYRING $DISTNAME $DISTNAME $DEBIAN_REPO && \ cd $DISTNAME && \ tar -c . | docker import - gdm85/$DISTNAME RV=$? diff --git a/docker/scripts/create-gitian-host.sh b/docker/scripts/create-gitian-host.sh index ccc3417..6f6ea8f 100755 --- a/docker/scripts/create-gitian-host.sh +++ b/docker/scripts/create-gitian-host.sh @@ -37,7 +37,7 @@ echo "Now building base VMs" && \ IP=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' $CID) && \ wait_for_ssh $IP 10 && \ ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no debian@$IP ./build-base-vms.sh && \ -docker stop $CID && \ +docker kill $CID && \ docker commit $CID gdm85/gitian-host-vms && \ docker rm $CID && \ echo "Gitian host images created successfully!" && \