[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]


On Sun, May 01, 2011 at 06:24:00PM +0200, Stéphane Glondu wrote:
> I was thinking of a request that would include a base suite (e.g.
> squeeze, wheezy, or sid), files to drop in /etc/apt/sources.list.d (and
> /etc/apt/preferences.d), and the key used to sign unofficial
> repositories. Of course, the request itself would be signed (like
> *.changes or *.commands files on ftp-master). Then a buildd accepting a
> job would add the key with apt-key, drop the files in /etc/apt, upgrade
> and launch the build as usual... the whole thing done in a throw-away
> chroot, obviously (I use cowbuilder myself for that, but I heard that
> sbuild had support for LVM snapshots).

sbuild has support for all the clonable chroot types schroot offers
(LVM snapshots, Btrfs snapshots, unionfs/aufs filesystem overlays
and file-based sources such as compressed tar).  AFAICT most of the
buildds are now using LVM with snapshotting.

If you do want to work on this, checkout sbuild.git.  See
etc/99builddsourceslist for the existing apt sources.list configuration
used by the buildds.  Could this be extended to do what you need?
Otherwise see lib/Sbuild/ResolverBase.pm for the existing sources.list.d

WRT the signing key, there would need to be some form of trust path
or else the signature would be worthless.  If packages are being
uploaded to Debian infrastructure, and are under our control, can't
we use a single signing key?  We presumably verified the integrity
and origin of the package on initital upload, so we should be able to
use a generic signing key surely?  If this is provided in a package
then we can trigger automated installation of it.  This could even
be installed prior to downloading the source package; we don't currently
do this (we use the already available archive signing keys), but we can
add it.

The main thing sbuild needs would be the information to add to
sources.list, signing key packages etc.  This would probably require
passing from buildd, so probably more a question of how buildd will
be configured and get the information to pass to sbuild.


  .''`.  Roger Leigh
 : :' :  Debian GNU/Linux             http://people.debian.org/~rleigh/
 `. `'   Printing on GNU/Linux?       http://gutenprint.sourceforge.net/
   `-    GPG Public Key: 0x25BFB848   Please GPG sign your mail.

Attachment: signature.asc
Description: Digital signature

Reply to: