Skip to content

MONGOCRYPT-815 trust newer Debian signing keys in Debian 9 #1020

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 3, 2025
Merged

MONGOCRYPT-815 trust newer Debian signing keys in Debian 9 #1020

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions Earthfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,9 @@ ENV_DEBIAN:
# Update source list for archived Debian stretch packages.
# Refer: https://unix.stackexchange.com/a/743865/260858
RUN echo "deb http://archive.debian.org/debian stretch main" > /etc/apt/sources.list
# Trust newer Debian signing keys to avoid "unauthenticated packages" error:
COPY +get-deb-signing-keys/keys/deb10-archive-signing-key.gpg /etc/apt/trusted.gpg.d
COPY +get-deb-signing-keys/keys/deb11-archive-signing-key.gpg /etc/apt/trusted.gpg.d
END
DO +DEBIAN_SETUP

Expand Down Expand Up @@ -364,6 +367,19 @@ check-format:
COPY --dir .clang-format src test /X/
RUN /X/etc/format-all.sh --dry-run -Werror --verbose

get-deb-signing-keys:
FROM +env.deb12
RUN __install gpg
# Get "Debian 10/buster archive signing key"
RUN gpg --keyserver keyserver.ubuntu.com --recv-keys 80D15823B7FD1561F9F7BCDDDC30D7C23CBBABEE
RUN gpg --export 80D15823B7FD1561F9F7BCDDDC30D7C23CBBABEE > deb10-archive-signing-key.gpg
SAVE ARTIFACT deb10-archive-signing-key.gpg /keys/

# Import "Debian 11/bullseye archive signing key"
RUN gpg --keyserver keyserver.ubuntu.com --recv-keys 1F89983E0081FDE018F3CC9673A4F27B8DD47936
RUN gpg --export 1F89983E0081FDE018F3CC9673A4F27B8DD47936 > deb11-archive-signing-key.gpg
SAVE ARTIFACT deb11-archive-signing-key.gpg /keys/

# The main "build" target. Options:
# • --env=[...] (default "u22")
# · Set the environment for the build. Any name of and "env.<name>" targets
Expand Down