rayburgemeestre
/
build-config
關注 1
收藏 0
複製 0
程式碼 問題 0 合併請求 0 版本發佈 0 Wiki 活動
瀏覽代碼

Finalize move to apt secure repo

master
Ray Burgemeestre 5 年之前
父節點
acebc12358
當前提交
e8bff7695b
共有 4 個檔案被更改，包括 394 行新增 和 4 行删除
分割檢視 顯示文件統計
  1. +217
    -0
      apt-publisher/INIT.TXT
  2. +1
    -2
      apt-publisher/Makefile
  3. +176
    -0
      apt-publisher/README
  4. +0
    -2
      apt-publisher/update.sh

+ 217
- 0
apt-publisher/INIT.TXT 查看文件

@@ -0,0 +1,217 @@
root@209899561fe9:/home/trigen/projects/build-config/apt-publisher# gpg --full-generate-key
gpg: WARNING: unsafe permissions on homedir '/root/.gnupg'
gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

gpg: keybox '/root/.gnupg/pubring.kbx' created
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: Ray Burgemeestre
Email address: ray@cppse.nl
Comment:
You selected this USER-ID:
"Ray Burgemeestre <ray@cppse.nl>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 234F14AB5CE16B7B marked as ultimately trusted
gpg: directory '/root/.gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/root/.gnupg/openpgp-revocs.d/D16D83CA3E4397DEB2462A3B234F14AB5CE16B7B.rev'
public and secret key created and signed.

pub rsa4096 2019-12-27 [SC]
D16D83CA3E4397DEB2462A3B234F14AB5CE16B7B
uid Ray Burgemeestre <ray@cppse.nl>
sub rsa4096 2019-12-27 [E]

root@209899561fe9:/home/trigen/projects/build-config/apt-publisher#

---

had to invoke this to get the key ids again:
--


root@209899561fe9:/home/trigen/projects/build-config/apt-publisher# gpg --keyid-format SHORT -k
gpg: WARNING: unsafe permissions on homedir '/root/.gnupg'
/root/.gnupg/pubring.kbx
------------------------
pub rsa4096/5CE16B7B 2019-12-27 [SC]
D16D83CA3E4397DEB2462A3B234F14AB5CE16B7B
uid [ultimate] Ray Burgemeestre <ray@cppse.nl>
sub rsa4096/43C5B68C 2019-12-27 [E]

--- mapping from blog post ---

theirs 10E6133F is ours: 5CE16B7B
theirs 7B34E07C is ours: 43C5B68C

---

root@209899561fe9:/home/trigen/projects/build-config/apt-publisher# gpg --edit-key 5CE16B7B
gpg: WARNING: unsafe permissions on homedir '/root/.gnupg'
gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Secret key is available.

sec rsa4096/234F14AB5CE16B7B
created: 2019-12-27 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa4096/DD5B61D243C5B68C
created: 2019-12-27 expires: never usage: E
[ultimate] (1). Ray Burgemeestre <ray@cppse.nl>

gpg> addkey
Please select what kind of key you want:
(3) DSA (sign only)
(4) RSA (sign only)
(5) Elgamal (encrypt only)
(6) RSA (encrypt only)
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

sec rsa4096/234F14AB5CE16B7B
created: 2019-12-27 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa4096/DD5B61D243C5B68C
created: 2019-12-27 expires: never usage: E
ssb rsa4096/C91687F126512AB8
created: 2019-12-27 expires: never usage: S
[ultimate] (1). Ray Burgemeestre <ray@cppse.nl>

gpg> save

---

get ID again:

root@209899561fe9:/home/trigen/projects/build-config/apt-publisher# gpg --keyid-format SHORT -k
gpg: WARNING: unsafe permissions on homedir '/root/.gnupg'
/root/.gnupg/pubring.kbx
------------------------
pub rsa4096/5CE16B7B 2019-12-27 [SC]
D16D83CA3E4397DEB2462A3B234F14AB5CE16B7B
uid [ultimate] Ray Burgemeestre <ray@cppse.nl>
sub rsa4096/43C5B68C 2019-12-27 [E]
sub rsa4096/26512AB8 2019-12-27 [S]


---

theirs 10E6133F is ours: 5CE16B7B
theirs 7B34E07C is ours: 43C5B68C
theirs A72DB3EF is ours: 26512AB8

---

mkdir keys
gpg --export-secret-key 5CE16B7B > keys/private.key
gpg --export 5CE16B7B >> keys/private.key


gpg --export 5CE16B7B > keys/public.key
gpg --export-secret-subkeys 26512AB8 > keys/signing.key


-- ignored: #back up the private.key file before running this# rm private.key

# not ignored:

gpg --delete-secret-key 5CE16B7B

root@209899561fe9:/home/trigen/projects/build-config/apt-publisher# gpg --delete-secret-key 5CE16B7B
gpg: WARNING: unsafe permissions on homedir '/root/.gnupg'
gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.


sec rsa4096/234F14AB5CE16B7B 2019-12-27 Ray Burgemeestre <ray@cppse.nl>

Delete this key from the keyring? (y/N) y
This is a secret key! - really delete? (y/N) y

root@209899561fe9:/home/trigen/projects/build-config/apt-publisher# gpg --import keys/public.key keys/signing.key
gpg: WARNING: unsafe permissions on homedir '/root/.gnupg'
gpg: key 234F14AB5CE16B7B: "Ray Burgemeestre <ray@cppse.nl>" not changed
gpg: key 234F14AB5CE16B7B: "Ray Burgemeestre <ray@cppse.nl>" not changed
gpg: To migrate 'secring.gpg', with each smartcard, run: gpg --card-status
gpg: key 234F14AB5CE16B7B: secret key imported
gpg: Total number processed: 2
gpg: unchanged: 2
gpg: secret keys read: 1
gpg: secret keys imported: 1
root@209899561fe9:/home/trigen/projects/build-config/apt-publisher# gpg --keyid-format SHORT -k
gpg: WARNING: unsafe permissions on homedir '/root/.gnupg'
/root/.gnupg/pubring.kbx
------------------------
pub rsa4096/5CE16B7B 2019-12-27 [SC]
D16D83CA3E4397DEB2462A3B234F14AB5CE16B7B
uid [ultimate] Ray Burgemeestre <ray@cppse.nl>
sub rsa4096/43C5B68C 2019-12-27 [E]
sub rsa4096/26512AB8 2019-12-27 [S]


# ignored: rm public.key signing.key

gpg --keyserver keyserver.ubuntu.com --send-key 5CE16B7B

# ok done :-)

---

moment of truth:

root@b1e2708c4531:/home/trigen/projects/build-config/apt-publisher# reprepro -b /repo includedeb bionic packages/*.deb
Exporting indices...


; reprepro -b /repo list bionic



+ 1
- 2
apt-publisher/Makefile 查看文件

@@ -35,8 +35,7 @@ update-packages:
# echo produce artifact for debugging
tar -czf repo.tar.gz repo
# rsync to host
rsync -raPv -e "$$SYNC_CMD_SSH" repo $$SYNC_CMD_DEST
rsync -raPv -e "$$SYNC_CMD_SSH" keys/KEY.asc $$SYNC_CMD_DEST
rsync --delete -raPv -e "$$SYNC_CMD_SSH" repo $$SYNC_CMD_DEST

shell:
docker pull rayburgemeestre/apt-ubuntu:18.04

+ 176
- 0
apt-publisher/README 查看文件

@@ -0,0 +1,176 @@
This is what I did initially in the `make shell` once:

```
root@9a0308ff4ef9:/home/trigen/projects/build-config/apt-publisher# gpg --gen-key
gpg: WARNING: unsafe enclosing directory ownership on configuration file `/root/.gnupg/gpg.conf'
gpg (GnuPG) 1.4.16; Copyright (C) 2013 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: Ray Burgemeestre
Email address: ray@cppse.nl
Comment:
You selected this USER-ID:
"Ray Burgemeestre <ray@cppse.nl>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a Passphrase to protect your secret key.

You don't want a passphrase - this is probably a *bad* idea!
I will do it anyway. You can change your passphrase at any time,
using this program with the option "--edit-key".

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
.................+++++

Not enough random bytes available. Please do some other work to give
the OS a chance to collect more entropy! (Need 103 more bytes)
.+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
.+++++
..+++++
gpg: key 4FEF6E3C marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
pub 4096R/4FEF6E3C 2019-12-26
Key fingerprint = 0398 0E09 AB56 969E 7AB3 A258 B563 6175 4FEF 6E3C
uid Ray Burgemeestre <ray@cppse.nl>
sub 4096R/DB72E674 2019-12-26
```

Continued executing:

```
root@9a0308ff4ef9:/home/trigen/projects/build-config/apt-publisher# gpg --edit-key 4FEF6E3C
gpg: WARNING: unsafe enclosing directory ownership on configuration file `/root/.gnupg/gpg.conf'
gpg (GnuPG) 1.4.16; Copyright (C) 2013 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Secret key is available.

pub 4096R/4FEF6E3C created: 2019-12-26 expires: never usage: SC
trust: ultimate validity: ultimate
sub 4096R/DB72E674 created: 2019-12-26 expires: never usage: E
[ultimate] (1). Ray Burgemeestre <ray@cppse.nl>

gpg> addkey
This key is not protected.
Please select what kind of key you want:
(3) DSA (sign only)
(4) RSA (sign only)
(5) Elgamal (encrypt only)
(6) RSA (encrypt only)
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
.+++++
....+++++

pub 4096R/4FEF6E3C created: 2019-12-26 expires: never usage: SC
trust: ultimate validity: ultimate
sub 4096R/DB72E674 created: 2019-12-26 expires: never usage: E
sub 4096R/0354330E created: 2019-12-26 expires: never usage: S
[ultimate] (1). Ray Burgemeestre <ray@cppse.nl>

gpg> save
```

EDIT: did above again to make another signing key, this time with password "public".
The version of gpg in Ubuntu 14.04 has a bug that cannot handle empty passwords.

From the tutorial, 10E6133F is for me: 4FEF6E3C
and, 7B34E07C is for me: DB72E674

Then, A72DB3EF is for me: 0354330E << INCORRECT, see below
Then, A72DB3EF is for me:

Then:

```
gpg --export-secret-key 4FEF6E3C > keys/private.key
gpg --export 4FEF6E3C >> keys/private.key

gpg --export 4FEF6E3C > keys/public.key
gpg --export-secret-subkeys 0354330E > keys/signing.key

```

EDIT: scratch this, retry tomorrow.
With newer ubuntu? :-)


---- delete above ---

First did instructions in INIT.TXT

Then make sure you have an "empty" repo,

reprepro -b /repo remove bionic whatever

Until it's empty, then:

ssh-keygen -f keys/ssh < <(echo "\n\n")

Then:

sudo tar -czf secret.tar.gz keys gnupg repo
# might print some errors

Upload that thing to some secret URL you can use during CI


---

Usage:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 5CE16B7B
sudo add-apt-repository "deb https://cppse.nl/repo/ $(lsb_release -cs) main"


+ 0
- 2
apt-publisher/update.sh 查看文件

@@ -1,2 +0,0 @@
#!/bin/bash


Write Preview
Loading…
取消
儲存