The staging archive and its keyring leave the image #4

Merged

marcos-mendez merged 1 commit from fix/staging-archive-keyring into 19.x

2026-09-27 16:47:28 -03:00

marcos-mendez commented

2026-09-27 16:36:17 -03:00

(Migrated from github.com)

Part of Keel-Linux/tracker#7.

A layer recipe installs the project's own packages from a copy of the staging
APT archive inside the build tree, named by an apt source and, from
tracker#7 onwards, verified against the staging public key installed as
/etc/apt/keyrings/keel-staging-keyring.asc.

None of the three belongs in a finished image. The staging key signs whatever
the build host produced, so an image that kept it would carry trust in a
nightly. The recipes remove all three in their own conf scripts; the same
defect has now had to be fixed in four of them, so the arrangement that holds
whether or not a recipe remembers belongs here, next to the captured package
pool that is already taken back out.

The three entries carry the ~ glob prefix, so a build that used no staging
archive passes over them silently. They are inserted before the rm tmp contents section rather than appended, so that this and the pool removelist
branch do not collide on the same lines.

Test plan

removelists-final/turnkey parses as it did: the three new lines are
globs of the same form as the pool entries above them
the paths are what the recipes write and remove, checked against all four
recipe Makefiles and conf scripts
proved on a real image by the wordpress boot test, which now reads the
assembled rootfs and fails if any of the three is there

Part of Keel-Linux/tracker#7. A layer recipe installs the project's own packages from a copy of the staging APT archive inside the build tree, named by an apt source and, from tracker#7 onwards, verified against the staging public key installed as `/etc/apt/keyrings/keel-staging-keyring.asc`. None of the three belongs in a finished image. The staging key signs whatever the build host produced, so an image that kept it would carry trust in a nightly. The recipes remove all three in their own conf scripts; the same defect has now had to be fixed in four of them, so the arrangement that holds whether or not a recipe remembers belongs here, next to the captured package pool that is already taken back out. The three entries carry the `~` glob prefix, so a build that used no staging archive passes over them silently. They are inserted before the `rm tmp contents` section rather than appended, so that this and the pool removelist branch do not collide on the same lines. ## Test plan - [x] `removelists-final/turnkey` parses as it did: the three new lines are globs of the same form as the pool entries above them - [x] the paths are what the recipes write and remove, checked against all four recipe Makefiles and conf scripts - [ ] proved on a real image by the `wordpress` boot test, which now reads the assembled rootfs and fails if any of the three is there