build: KEEL_APT_TRACK picks the Keel track; the plan drops tklbam, hubdns and the release meta package #32

Merged

marcos-mendez merged 2 commits from feat/keel-apt-track into 19.x

2026-10-02 15:53:32 -03:00

marcos-mendez commented

2026-10-02 15:14:43 -03:00

(Migrated from github.com)

Summary

The bootstrap gets the Keel archive. Since #30 a Keel image installs from Debian and the Keel archive only, but the bootstrap had no Keel source, so the plan could not install keel-archive-keyring, inithooks and the other Keel packages from it. conf/bootstrap_apt now writes keel.sources into the bootstrap, naming the armored public key mk/turnkey.mk copies in from the new keys/keel-archive-keyring.asc (the key the archive publishes at its root). The package later installs the same key as .gpg and the overlay replaces the file; the conf script removes the bootstrap's copy.
KEEL_APT_TRACK (conf variable, default stable): testing enables trixie-testing in the bootstrap, so the build installs from the testing track, and conf/turnkey.d/keel-apt makes the image follow it (the overlay's stanza turned on). Any other value stops the build. This is what step 4 of the attended release needs: images built from trixie-testing.
Plan: tklbam, hubdns, webmin-tklbam leave plans/turnkey/base (Keel Backup, decision 0040; Keel Cloud); that also drops turnkey-pypy2 and py3curl-wrapper, which nothing else wanted (checked with apt-cache rdepends against TurnKey's archive).
No release meta package: mk/turnkey.mk no longer runs make-release-deb.py (turnkey-<app>-<version>); keel-core is the meta package (decision 0047). /etc/turnkey_version is still written (decision 0014). Note common#5 (/etc/keel_version) is still open.

Tests

tests/apt-sources.bats: 44 pass locally. New: the bootstrap writes keel.sources (stable on, testing off, key path, and the key in keys/ is AD0964BE…3180); the track decision for unset/stable/testing/other; the conf script on the default track (file untouched, key copy removed), on testing (only the stanza's Enabled changes, apt would fetch both suites), and its refusals; the plan has none of the five packages and the makefile no make-release-deb.

For the maintainer

An image built with KEEL_APT_TRACK=testing follows the testing track once installed. Say if a testing-channel image should rather stay on stable.
keys/keel-archive-keyring.asc is the public key only, the same file the archive serves.

## Summary - **The bootstrap gets the Keel archive.** Since #30 a Keel image installs from Debian and the Keel archive only, but the bootstrap had no Keel source, so the plan could not install `keel-archive-keyring`, `inithooks` and the other Keel packages from it. `conf/bootstrap_apt` now writes `keel.sources` into the bootstrap, naming the armored public key `mk/turnkey.mk` copies in from the new `keys/keel-archive-keyring.asc` (the key the archive publishes at its root). The package later installs the same key as `.gpg` and the overlay replaces the file; the conf script removes the bootstrap's copy. - **`KEEL_APT_TRACK`** (conf variable, default `stable`): `testing` enables `trixie-testing` in the bootstrap, so the build installs from the testing track, and `conf/turnkey.d/keel-apt` makes the image follow it (the overlay's stanza turned on). Any other value stops the build. This is what step 4 of the attended release needs: images built from `trixie-testing`. - **Plan**: `tklbam`, `hubdns`, `webmin-tklbam` leave `plans/turnkey/base` (Keel Backup, decision 0040; Keel Cloud); that also drops `turnkey-pypy2` and `py3curl-wrapper`, which nothing else wanted (checked with `apt-cache rdepends` against TurnKey's archive). - **No release meta package**: `mk/turnkey.mk` no longer runs `make-release-deb.py` (`turnkey-<app>-<version>`); keel-core is the meta package (decision 0047). `/etc/turnkey_version` is still written (decision 0014). Note common#5 (`/etc/keel_version`) is still open. ## Tests `tests/apt-sources.bats`: 44 pass locally. New: the bootstrap writes `keel.sources` (stable on, testing off, key path, and the key in `keys/` is AD0964BE…3180); the track decision for unset/stable/testing/other; the conf script on the default track (file untouched, key copy removed), on testing (only the stanza's `Enabled` changes, apt would fetch both suites), and its refusals; the plan has none of the five packages and the makefile no `make-release-deb`. ## For the maintainer - An image built with `KEEL_APT_TRACK=testing` follows the testing track once installed. Say if a testing-channel image should rather stay on stable. - `keys/keel-archive-keyring.asc` is the public key only, the same file the archive serves.