mbox series

[0/2] Restore bootstrapping of raspios on trixie host

Message ID 20260306160255.1017503-1-felix.moessbauer@siemens.com
Headers show
Series Restore bootstrapping of raspios on trixie host | expand

Message

Felix Moessbauer March 6, 2026, 4:02 p.m. UTC 
When bootstrapping from a trixie host, mmdebstrap uses the host apt for the
first part of the bootstrapping. In Debian trixie, the default apt gpgv
backend is sqv, which blocks SHA1 signed keys from 01.02.2026 on [1] (this
is configured in /usr/share/apt/default-sequoia.config). As a workaround,
we provide variables to instruct mmdebstrap to not check the expiry date,
which internally switches the gpgv backend to gpg which also does not have
a check for the SHA1 deprecation. Unfortunately it is not possible to
instruct apt / sqv to just disable the SHA1 check (except by replacing the
whole config file) [2].

This fixes [3], unblocks the TestCross CI and is release critical.

[1] https://wiki.debian.org/Teams/Apt/Sha1Removal
[2] https://bugs-devel.debian.org/cgi-bin/bugreport.cgi?bug=1092747
[3] https://groups.google.com/g/isar-users/c/D5NaB_TdioY

Best regards,
Felix Moessbauer
Siemens AG

Felix Moessbauer (2):
  add variables to inject config into mmdebstrap
  work around bootstrapping issue of raspios due to SHA1 key removal

 RECIPE-API-CHANGELOG.md                                | 10 ++++++++++
 meta-isar/conf/distro/raspios-bookworm.conf            |  2 ++
 meta-isar/conf/distro/raspios-bullseye.conf            |  2 ++
 .../isar-mmdebstrap/isar-mmdebstrap-target.bb          |  1 +
 meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc  |  7 +++++++
 5 files changed, 22 insertions(+)