import: rename keyring extension from .gpg to .pgp and add OBS key for system:systemd (#37927)

The format is not specific to gpg, it's defined by the pgp
protocols. Lintian even warns about it:

systemd-container: openpgp-file-has-implementation-specific-extension
[usr/lib/systemd/import-pubring.gpg]

Rename it accordingly, as new pgp implementations are slowly becoming
more popular.

Keep using /etc/systemd/import-pubring.gpg for backward compatibility.

NEWS

@@ -116,6 +116,12 @@ CHANGES WITH 258 in spe:
           kernels that lacked support for it, hence the prefix serves no
           purpose anymore.
 
+        * The default keyring for systemd-importd and related tools, shipped
+          in /usr/lib/systemd/, has been renamed from import-pubring.gpg to
+          import-pubring.pgp, as it is supported by other PGP tools as well as
+          GPG. The local keyring /etc/systemd/import-pubring.gpg is still parsed
+          if present, to preserve backward compatibility.
+
         Announcements of Future Feature Removals:
 
         * Support for System V service scripts is deprecated and will be

man/importctl.xml

@@ -125,8 +125,8 @@
         <option>--verify=signature</option>, the sha checksum file is first verified with the detached GPG
         signature of <filename>.sha256</filename> or <filename>SHA256SUMS</filename>.  The public key for
         this verification step needs to be available in
-        <filename>/usr/lib/systemd/import-pubring.gpg</filename> or
-        <filename>/etc/systemd/import-pubring.gpg</filename>.</para>
+        <filename>/usr/lib/systemd/import-pubring.pgp</filename> or
+        <filename>/etc/systemd/import-pubring.pgp</filename>.</para>
 
         <para>If <option>-keep-download=yes</option> is specified the image will be downloaded and stored in
         a read-only subvolume/directory in the image directory that is named after the specified URL and its

man/sysupdate.d.xml

@@ -481,8 +481,8 @@
         downloaded resources (specifically: validate the GPG signatures for downloaded
         <filename>SHA256SUMS</filename> manifest files, via their detached signature files
         <filename>SHA256SUMS.gpg</filename> in combination with the system keyring
-        <filename>/usr/lib/systemd/import-pubring.gpg</filename> or
-        <filename>/etc/systemd/import-pubring.gpg</filename>).</para>
+        <filename>/usr/lib/systemd/import-pubring.pgp</filename> or
+        <filename>/etc/systemd/import-pubring.pgp</filename>).</para>
 
         <para>This option is essential to provide integrity guarantees for downloaded resources and thus
         should be left enabled, outside of test environments.</para>

meson.build

@@ -320,9 +320,10 @@ conf.set_quoted('USER_CONFIG_UNIT_DIR',                       pkgsysconfdir / 'u
 conf.set_quoted('USER_DATA_UNIT_DIR',                         userunitdir)
 conf.set_quoted('USER_ENV_GENERATOR_DIR',                     userenvgeneratordir)
 conf.set_quoted('USER_GENERATOR_DIR',                         usergeneratordir)
-conf.set_quoted('USER_KEYRING_PATH',                          pkgsysconfdir / 'import-pubring.gpg')
+conf.set_quoted('USER_KEYRING_PATH',                          pkgsysconfdir / 'import-pubring.pgp')
+conf.set_quoted('USER_KEYRING_PATH_LEGACY',                   pkgsysconfdir / 'import-pubring.gpg')
 conf.set_quoted('USER_PRESET_DIR',                            userpresetdir)
-conf.set_quoted('VENDOR_KEYRING_PATH',                        libexecdir / 'import-pubring.gpg')
+conf.set_quoted('VENDOR_KEYRING_PATH',                        libexecdir / 'import-pubring.pgp')
 
 conf.set('ANSI_OK_COLOR',                                     'ANSI_' + get_option('ok-color').underscorify().to_upper())
 conf.set10('ENABLE_URLIFY',                                   get_option('urlify'))

mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf

@@ -9,5 +9,5 @@ Environment=
         GIT_URL=https://salsa.debian.org/systemd-team/systemd.git
         GIT_SUBDIR=debian
         GIT_BRANCH=debian/master
-        GIT_COMMIT=01b5b96a2f85594c2c8caf5d10048a4ec41f9d89
+        GIT_COMMIT=84966b99cdfc7ea3ee35163ad224775d9be90055
         PKG_SUBDIR=debian

mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot

@@ -19,9 +19,9 @@ TS="${SOURCE_DATE_EPOCH:-$(date +%s)}"
 # disable manpage compression as the files cannot be found. Fix the issue by removing the compression
 # extension.
 #
-# TODO: remove manual cgroups-agent patch when the upstream spec is updated
+# TODO: remove manual cgroups-agent and pubring patches when the upstream spec is updated
 while read -r filelist; do
-    sed 's/\.gz$//; /systemd-cgroups-agent/d' "$filelist" >"/tmp/$(basename "$filelist")"
+    sed 's/\.gz$//; /systemd-cgroups-agent/d; s/import-pubring.gpg/import-pubring.pgp/' "$filelist" >"/tmp/$(basename "$filelist")"
     mount --bind "/tmp/$(basename "$filelist")" "$filelist"
 done < <(find "pkg/$PKG_SUBDIR${GIT_SUBDIR:+/$GIT_SUBDIR}" -name "files.*")
 
@@ -117,15 +117,6 @@ build() {
 
     EXIT_STATUS=$?
 
-    # TODO: Remove when the opensuse spec cleans these up itself (https://build.opensuse.org/request/show/1251175).
-    rm -f \
-        systemd.lang \
-        debugfiles.list \
-        debuglinks.list \
-        debugsourcefiles.list \
-        debugsources.list \
-        elfbins.list
-
     # Make sure we don't reconfigure twice.
     MKOSI_MESON_OPTIONS="${MKOSI_MESON_OPTIONS//"--wipe"/}"
 

src/import/meson.build

@@ -109,6 +109,6 @@ install_data('org.freedesktop.import1.service',
 install_data('org.freedesktop.import1.policy',
              install_dir : polkitpolicydir)
 
-install_data('import-pubring.gpg',
+install_data('import-pubring.pgp',
              install_dir : libexecdir)
 # TODO: shouldn't this be in pkgdatadir?

src/import/pull-common.c

@@ -458,6 +458,8 @@ static int verify_gpg(
                  * otherwise. */
                 if (access(USER_KEYRING_PATH, F_OK) >= 0)
                         cmd[k++] = "--keyring=" USER_KEYRING_PATH;
+                else if (access(USER_KEYRING_PATH_LEGACY, F_OK) >= 0)
+                        cmd[k++] = "--keyring=" USER_KEYRING_PATH_LEGACY;
                 else
                         cmd[k++] = "--keyring=" VENDOR_KEYRING_PATH;