Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1026163 > unrolled thread

Bug#970796: cloud-init: Please add gnupg to Recommends

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#970796: cloud-init: Please add gnupg to Recommends Daniel Watkins <oddbloke@ubuntu.com> - 2020-09-23 17:10 +0200
    Bug#970796: cloud-init: Please add gnupg to Recommends Noah Meyerhans <noahm@debian.org> - 2020-09-23 17:50 +0200
    Bug#970796: cloud-init: Please add gnupg to Recommends Bastian Blank <waldi@debian.org> - 2020-09-25 08:40 +0200

#1026163 — Bug#970796: cloud-init: Please add gnupg to Recommends

Package: cloud-init
Version: 20.2-2
Severity: normal

Dear Maintainer,

cloud-init uses gnupg in two ways: directly, to fetch and export keys
(when specified by ID, see [0]), and via apt-key to add keys to the system
(whether specified via ID or in full, see [1]).  (Even once we remove
apt-key usage[2], we will still need it for the former use case.)

I've just opened a PR[3] to add this to our Ubuntu packaging, and would
request that you do the same so that Debian users are able to configure
custom apt sources using cloud-init configuration.

(My assumption here is that Debian cloud images are built with
--install-recommends; if not, then you may want to consider ensuring
that gnupg is present in Debian cloud images via other means.)


Thanks!

Dan

[0] https://github.com/canonical/cloud-init/blob/master/cloudinit/gpg.py
[1] https://github.com/canonical/cloud-init/blob/master/cloudinit/config/cc_apt_configure.py#L698
[2] https://bugs.launchpad.net/cloud-init/+bug/1836336
[3] https://github.com/canonical/cloud-init/pull/583

[toc] | [next] | [standalone]

#1026172

On Wed, Sep 23, 2020 at 10:57:50AM -0400, Daniel Watkins wrote:
> cloud-init uses gnupg in two ways: directly, to fetch and export keys
> (when specified by ID, see [0]), and via apt-key to add keys to the system
> (whether specified via ID or in full, see [1]).  (Even once we remove
> apt-key usage[2], we will still need it for the former use case.)
> 
> I've just opened a PR[3] to add this to our Ubuntu packaging, and would
> request that you do the same so that Debian users are able to configure
> custom apt sources using cloud-init configuration.
> 
> (My assumption here is that Debian cloud images are built with
> --install-recommends; if not, then you may want to consider ensuring
> that gnupg is present in Debian cloud images via other means.)

This was previously discussed in the context of
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910654

Unfortunately, most of the discussion occurred in person at the 2018
cloud team sprint, and wasn't captured in the bug report.  IIRC, at the
time, most of the discussion focused on the apt-key use-case, and there
were enough people who felt strongly that using gpg to fetch keys from a
key server was a sufficiently bad idea, and the same functionality could
be provided by passing a complete public key directly via cloud-config
userdata, that we should support this functionality.  This opinion
wasn't universally held, but it was held strongly enough by enough
people to overrule any dissenting opionions.

Maybe it's worth revisiting this discussion for bullseye?

noah

[toc] | [prev] | [next] | [standalone]

#1026356

On Wed, Sep 23, 2020 at 10:57:50AM -0400, Daniel Watkins wrote:
> cloud-init uses gnupg in two ways: directly, to fetch and export keys
> (when specified by ID, see [0]), and via apt-key to add keys to the system
> (whether specified via ID or in full, see [1]).  (Even once we remove
> apt-key usage[2], we will still need it for the former use case.)

No, none of this use-cases are valid.

Per ID is not reliable, as the keyserver network is falling apart.

Per complete key does not need gnupg, but needs to deposit the keys in
the correct file.

Bastian

-- 
There's a way out of any cage.
		-- Captain Christopher Pike, "The Menagerie" ("The Cage"),
		   stardate unknown.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web