Deb Mirror, multiple gpgkeys

Support
#1

Problem:

I am trying to create a ubuntu deb mirror of Index of /ubuntu
for both “focal” and “bionic”, when I create the pulp remote, I am filling in the gpgkey field. but the signing key for focal and bionic are different. so when I attempt to sync the repository it fails.
Is there any way to support both keys?
Do I have to make 2 separate repo’s one for focal, one for bionic?

I will be polishing as verbatim, but would still like the additional safety net of upstream gpg verification

Expected outcome:

Pulpcore version:
3.19
Pulp plugins installed and their versions:
pulp-deb 2.18.0
pulp-file 1.10.2
Operating system - distribution and version:
ubuntu 20.04
Other relevant data:

#2

You have found a design flaw: There is currently no way of associating more than one GPG key with any one APT remote. It is worth opening an issue for this, but it will most likely take a while before it will be worked on.

In the mean time you have two options:

  1. Don’t associate any GPG keys with the remote (no signature verification during sync), publish verbatim, and rely on the clients for signature checking.
  2. Create two separate repositories for focal and bionic.

I would probably recommend option 2. since it will allow you to perform signature checking during sync, and also keep down the repo size of your Pulp repos (very large repos have been known to cause performance issues).

1 Like
#3

Thank you very much for the reply
I have opens a issue

I removed the gpgkey (#1) in an attempt to get it to work (and it did sync), but I will explore option 2 as well.

2 Likes
#4

I have not tested this, but I have seen some documentation that suggests it may be possible to add “multiple” GPG keys into a single Pulp gpgkey field, by making the content of the field something like the following:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFy/HE4BEADttv2TCPzVrre+aJ9f5QsR6oWZMm7N5Lwxjm5x5zA9BLiPPGFN
4aTUR/g+K1S0aqCU+ZS3Rnxb+6fnBxD+COH9kMqXHi3M5UNzbp5WhCdUpISXjjpU
XIFFWBPuBfyr/FKRknFH15P+9kLZLxCpVZZLsweLWCuw+JKCMmnA
=F6VG
-----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFw467UBEACmREzDeK/kuScCmfJfHJa0Wgh/2fbJLLt3KSvsgDhORIptf+PP
OTFDlKuLkJx99ZYG5xMnBG47C7ByoMec1j94YeXczuBbynOyyPlvduma/zf8oB9e
Wl5GnzcLGAnUSRamfqGUWcyMMinHHIKIc1X1P4I=
=WPpI
-----END PGP PUBLIC KEY BLOCK-----

@jgrammen-agilitypr Can you test if this approach works in your case?

#5

Hi @jgrammen-agilitypr

Can you try exporting multiple GPG keys into a single ASCII-armoured file at once? Have a look at the following procedure: Extracting GPG Public Key Fingerprints from a Release Files in the Foreman/Katello documentation.

#6

I have just test the first suggestion from quba42, putting both gpg public keys concatenated together into one gpgkey field. It seems to work,

I have yet to test maximilian’s workaround, but will test it in the near future.

2 Likes
#7

I have now tested maximilian’s workaround using a single combined gpg key. It also works.

3 Likes