proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-07-27 14:30:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fetch Debian archive GPG keyrings when they're not available

Browse Source 
When running the debian template on a non-debian host, it's usual not to
have debian-archive-keyring.gpg. When that happens, we skip the
signature checking of the release, which is dangerous because it's made over
HTTP.

This commit adds automatic fetching of Debian release keys.

Strongly related to #409

Signed-off-by: Virgil Dupras <hsoft@hardcoded.net>
This commit is contained in:
Virgil Dupras 2015-11-09 21:23:51 -05:00
parent 2681c0e7ea
commit f16fb156bb
1 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
templates/lxc-debian.in
View File

@ -248,6 +248,24 @@ openssh-server
release=$3
trap cleanup EXIT SIGHUP SIGINT SIGTERM
# If debian-archive-keyring isn't installed, fetch GPG keys directly
releasekeyring=/usr/share/keyrings/debian-archive-keyring.gpg
if [ ! -f $releasekeyring ]; then
releasekeyring="$cache/archive-key.gpg"
case $release in
"squeeze")
gpgkeyname="archive-key-6.0"
;;
"wheezy")
gpgkeyname="archive-key-7.0"
;;
*)
gpgkeyname="archive-key-8"
;;
esac
wget https://ftp-master.debian.org/keys/${gpgkeyname}.asc -O - --quiet \
| gpg --import --no-default-keyring --keyring=${releasekeyring}
fi
# check the mini debian was not already downloaded
mkdir -p "$cache/partial-$release-$arch"
if [ $? -ne 0 ]; then
@ -258,7 +276,7 @@ openssh-server
# download a mini debian into a cache
echo "Downloading debian minimal ..."
debootstrap --verbose --variant=minbase --arch=$arch \
--include=$packages \
--include=$packages --keyring=${releasekeyring} \
"$release" "$cache/partial-$release-$arch" $MIRROR
if [ $? -ne 0 ]; then
echo "Failed to download the rootfs, aborting."