diff mbox series

[2/2] work around bootstrapping issue of raspios due to SHA1 key removal

Message ID 20260306160255.1017503-3-felix.moessbauer@siemens.com
State Priority Review
Headers show
Series Restore bootstrapping of raspios on trixie host | expand

Commit Message

Felix Moessbauer March 6, 2026, 4:02 p.m. UTC 
From Feburary 2026 on apt versions used on trixie and later will reject
repository keys which use an SHA1 hash. While this issue needs to be
fixed upstream, a workaround is needed to bootstrap these distributions
from a > trixie host distribution (purely bootstrapping within a
distribution is not affected, as then an older apt is used).

We work around this by applying the recommended mmdebstrap option to
disable key expiry checking (which internally switches from sqv to gpg
which does process SHA1 keys).

For details, see https://wiki.debian.org/Teams/Apt/Sha1Removal.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta-isar/conf/distro/raspios-bookworm.conf | 2 ++
 meta-isar/conf/distro/raspios-bullseye.conf | 2 ++
 2 files changed, 4 insertions(+)
diff mbox series

Patch

diff --git a/meta-isar/conf/distro/raspios-bookworm.conf b/meta-isar/conf/distro/raspios-bookworm.conf
index edba011f..0bed3018 100644
--- a/meta-isar/conf/distro/raspios-bookworm.conf
+++ b/meta-isar/conf/distro/raspios-bookworm.conf
@@ -14,6 +14,8 @@  HOST_DISTRO_APT_SOURCES ?= "conf/distro/${HOST_DISTRO}.list"
 
 DISTRO_APT_SOURCES ?= "conf/distro/raspios-bookworm.list"
 DISTRO_APT_SOURCES:arm64 ?= "conf/distro/raspios-bookworm-64.list"
+# workaround for https://wiki.debian.org/Teams/Apt/Sha1Removal
+DISTRO_MM_OPTS += "${MMAPTOPT_NOEXPKEYSIGN}"
 
 DISTRO_BOOTSTRAP_KEYS = "http://raspbian.raspberrypi.org/raspbian.public.key;sha256sum=ca59cd4f2bcbc3a1d41ba6815a02a8dc5c175467a59bd87edeac458f4a5345de"
 DISTRO_BOOTSTRAP_KEYS:arm64 = ""
diff --git a/meta-isar/conf/distro/raspios-bullseye.conf b/meta-isar/conf/distro/raspios-bullseye.conf
index 60782f67..1b108649 100644
--- a/meta-isar/conf/distro/raspios-bullseye.conf
+++ b/meta-isar/conf/distro/raspios-bullseye.conf
@@ -14,6 +14,8 @@  HOST_DISTRO_APT_SOURCES ?= "conf/distro/${HOST_DISTRO}.list"
 
 DISTRO_APT_SOURCES ?= "conf/distro/raspios-bullseye.list"
 DISTRO_APT_SOURCES:arm64 ?= "conf/distro/raspios-bullseye-64.list"
+# workaround for https://wiki.debian.org/Teams/Apt/Sha1Removal
+DISTRO_MM_OPTS += "${MMAPTOPT_NOEXPKEYSIGN}"
 
 DISTRO_BOOTSTRAP_KEYS = "http://raspbian.raspberrypi.org/raspbian.public.key;sha256sum=ca59cd4f2bcbc3a1d41ba6815a02a8dc5c175467a59bd87edeac458f4a5345de"
 DISTRO_BOOTSTRAP_KEYS:arm64 = ""