Keel-Linux/common
1
0
Fork 0
Code Issues 7 Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat: keel.sources trusts the testing keyring for trixie-testing #54

Merged
navigator merged 1 commit from feat/keel-testing-keyring into 19.x 2026-10-15 19:54:51 -03:00
Conversation 0 Commits 1 Files changed 7 +108 -8
navigator commented 2026-10-15 18:11:18 -03:00
Owner
Copy link

Step 6 of decision 0055: the trixie-testing stanza of keel.sources names the testing keyring, /usr/share/keyrings/keel-testing-keyring.gpg from keel-archive-keyring 0.3.0.

  • keys/keel-testing-keyring.asc: the public testing key, the same file as keel-keys keys/keel-trixie-testing.asc.
  • mk/turnkey.mk copies it into the bootstrap. conf/bootstrap_apt names it in the trixie-testing stanza.
  • overlays/turnkey.d/keel-apt: the shipped keel.sources names keel-testing-keyring.gpg for trixie-testing.
  • conf/turnkey.d/keel-apt: stops when keel-testing-keyring.gpg is missing, changes the .asc name to the .gpg keyring, removes the bootstrap copy, and stops an image of the testing track whose stanza names another keyring.

The archive signs trixie-testing with the main key and the testing key for now (Keel-Linux/apt#31). So an appliance with the old stanza continues to work, and an image with the new stanza works too. The main key is removed from the suite later, when no reader has the main keyring alone.

Tests: written first, in tests/apt-sources.bats.

Step 6 of decision 0055: the trixie-testing stanza of keel.sources names the testing keyring, `/usr/share/keyrings/keel-testing-keyring.gpg` from keel-archive-keyring 0.3.0. - `keys/keel-testing-keyring.asc`: the public testing key, the same file as keel-keys `keys/keel-trixie-testing.asc`. - `mk/turnkey.mk` copies it into the bootstrap. `conf/bootstrap_apt` names it in the trixie-testing stanza. - `overlays/turnkey.d/keel-apt`: the shipped keel.sources names `keel-testing-keyring.gpg` for trixie-testing. - `conf/turnkey.d/keel-apt`: stops when `keel-testing-keyring.gpg` is missing, changes the `.asc` name to the `.gpg` keyring, removes the bootstrap copy, and stops an image of the testing track whose stanza names another keyring. The archive signs trixie-testing with the main key and the testing key for now (Keel-Linux/apt#31). So an appliance with the old stanza continues to work, and an image with the new stanza works too. The main key is removed from the suite later, when no reader has the main keyring alone. Tests: written first, in `tests/apt-sources.bats`.
feat: keel.sources trusts the testing keyring for trixie-testing
All checks were successful
security / security (pull_request) Successful in 4m17s
Details
packages / build (pull_request) Successful in 4m43s
Details
tests / tests (pull_request) Successful in 7m25s
Details
packages / install (pull_request) Successful in 8m47s
Details
packages / web (pull_request) Successful in 12m37s
Details
8783912b21 
The trixie-testing stanza names keel-testing-keyring.gpg, the keyring of
the testing role (handbook decision 0055). The bootstrap names the
armored copy from keys/, and conf/turnkey.d/keel-apt changes it to the
keyring of keel-archive-keyring 0.3.0. The archive signs the suite with
the testing key and the main key for now, so an image with the old
stanza continues to work.
navigator force-pushed feat/keel-testing-keyring from 8783912b21
All checks were successful
security / security (pull_request) Successful in 4m17s
Details
packages / build (pull_request) Successful in 4m43s
Details
tests / tests (pull_request) Successful in 7m25s
Details
packages / install (pull_request) Successful in 8m47s
Details
packages / web (pull_request) Successful in 12m37s
Details
to 9aaabc60d4
All checks were successful
security / security (pull_request) Successful in 1m35s
Details
packages / build (pull_request) Successful in 4m33s
Details
tests / tests (pull_request) Successful in 6m47s
Details
packages / install (pull_request) Successful in 8m55s
Details
packages / web (pull_request) Successful in 12m32s
Details
2026-10-15 18:56:36 -03:00 Compare
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

Something isn't working

  
documentation

Improvements or additions to documentation

  
duplicate

This issue or pull request already exists

  
enhancement

New feature or request

  
good first issue

Good for newcomers

  
help wanted

Extra attention is needed

  
invalid

This doesn't seem right

  
question

Further information is requested

  
wontfix

This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Keel-Linux/common!54
No description provided.