From ff401d5df9c6090aafb10cdba81ece113b4fa29f Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 22 Jun 2025 17:43:35 +0100 Subject: [PATCH 1/6] import: rename keyring extension from .gpg to .pgp The format is not specific to gpg, it's defined by the pgp protocols. Lintian even warns about it: systemd-container: openpgp-file-has-implementation-specific-extension [usr/lib/systemd/import-pubring.gpg] Rename it accordingly, as new pgp implementations are slowly becoming more popular. Keep using /etc/systemd/import-pubring.gpg for backward compatibility. --- man/importctl.xml | 4 ++-- man/sysupdate.d.xml | 4 ++-- meson.build | 5 +++-- .../{import-pubring.gpg => import-pubring.pgp} | Bin src/import/meson.build | 2 +- src/import/pull-common.c | 2 ++ 6 files changed, 10 insertions(+), 7 deletions(-) rename src/import/{import-pubring.gpg => import-pubring.pgp} (100%) diff --git a/man/importctl.xml b/man/importctl.xml index f67565bc05..c1021e60ba 100644 --- a/man/importctl.xml +++ b/man/importctl.xml @@ -125,8 +125,8 @@ , the sha checksum file is first verified with the detached GPG signature of .sha256 or SHA256SUMS. The public key for this verification step needs to be available in - /usr/lib/systemd/import-pubring.gpg or - /etc/systemd/import-pubring.gpg. + /usr/lib/systemd/import-pubring.pgp or + /etc/systemd/import-pubring.pgp. If is specified the image will be downloaded and stored in a read-only subvolume/directory in the image directory that is named after the specified URL and its diff --git a/man/sysupdate.d.xml b/man/sysupdate.d.xml index 9a32c8c734..13dcd09775 100644 --- a/man/sysupdate.d.xml +++ b/man/sysupdate.d.xml @@ -481,8 +481,8 @@ downloaded resources (specifically: validate the GPG signatures for downloaded SHA256SUMS manifest files, via their detached signature files SHA256SUMS.gpg in combination with the system keyring - /usr/lib/systemd/import-pubring.gpg or - /etc/systemd/import-pubring.gpg). + /usr/lib/systemd/import-pubring.pgp or + /etc/systemd/import-pubring.pgp). This option is essential to provide integrity guarantees for downloaded resources and thus should be left enabled, outside of test environments. diff --git a/meson.build b/meson.build index 3f5ddccd12..a468cf1ea1 100644 --- a/meson.build +++ b/meson.build @@ -320,9 +320,10 @@ conf.set_quoted('USER_CONFIG_UNIT_DIR', pkgsysconfdir / 'u conf.set_quoted('USER_DATA_UNIT_DIR', userunitdir) conf.set_quoted('USER_ENV_GENERATOR_DIR', userenvgeneratordir) conf.set_quoted('USER_GENERATOR_DIR', usergeneratordir) -conf.set_quoted('USER_KEYRING_PATH', pkgsysconfdir / 'import-pubring.gpg') +conf.set_quoted('USER_KEYRING_PATH', pkgsysconfdir / 'import-pubring.pgp') +conf.set_quoted('USER_KEYRING_PATH_LEGACY', pkgsysconfdir / 'import-pubring.gpg') conf.set_quoted('USER_PRESET_DIR', userpresetdir) -conf.set_quoted('VENDOR_KEYRING_PATH', libexecdir / 'import-pubring.gpg') +conf.set_quoted('VENDOR_KEYRING_PATH', libexecdir / 'import-pubring.pgp') conf.set('ANSI_OK_COLOR', 'ANSI_' + get_option('ok-color').underscorify().to_upper()) conf.set10('ENABLE_URLIFY', get_option('urlify')) diff --git a/src/import/import-pubring.gpg b/src/import/import-pubring.pgp similarity index 100% rename from src/import/import-pubring.gpg rename to src/import/import-pubring.pgp diff --git a/src/import/meson.build b/src/import/meson.build index a2bb54992b..e1670da817 100644 --- a/src/import/meson.build +++ b/src/import/meson.build @@ -109,6 +109,6 @@ install_data('org.freedesktop.import1.service', install_data('org.freedesktop.import1.policy', install_dir : polkitpolicydir) -install_data('import-pubring.gpg', +install_data('import-pubring.pgp', install_dir : libexecdir) # TODO: shouldn't this be in pkgdatadir? diff --git a/src/import/pull-common.c b/src/import/pull-common.c index 67ed640a6f..40248eee3d 100644 --- a/src/import/pull-common.c +++ b/src/import/pull-common.c @@ -458,6 +458,8 @@ static int verify_gpg( * otherwise. */ if (access(USER_KEYRING_PATH, F_OK) >= 0) cmd[k++] = "--keyring=" USER_KEYRING_PATH; + else if (access(USER_KEYRING_PATH_LEGACY, F_OK) >= 0) + cmd[k++] = "--keyring=" USER_KEYRING_PATH_LEGACY; else cmd[k++] = "--keyring=" VENDOR_KEYRING_PATH; From 857f08137a1cef6490eca11acbeb0ca702fba2a0 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 22 Jun 2025 17:52:02 +0100 Subject: [PATCH 2/6] import-pubring: add OBS key for system:systemd We are publishing ParticleOS images at https://build.opensuse.org/project/show/system:systemd so add the signing key to the default keyring, so that they can be imported out of the box. --- src/import/import-pubring.pgp | Bin 45015 -> 46992 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/src/import/import-pubring.pgp b/src/import/import-pubring.pgp index 8c6d2ebea6014006d327964bed4cdbd78637789f..433c9b8efd8c3a05c2937ebdee8ed5f84efa892d 100644 GIT binary patch delta 2061 zcmZXVc{J2}AIHaxnXwFhXskmc4G}TZFv=2d8@HZ~RsjE41B!b8%W8}H*EMQBScum;my*SQ$TCXcCI7)`lbowKw#%a)3$*g#-Za@uK@t^kTzWYe=>B4$HKZpGaKDfTq zD@5#hL$5L-8tHd^E2X2EgaqsOpcH+?x7A zp%5ZXWaqavdtv}ma^^PvOt`6n)MEA%=5eFcEd-U8R_c_0qdKSeK;hqNPICDTaiRKM~lb-!dW#>0)7-D#ZDp76rw1XiS=MOb-GA+_z6Z~y5{OF$qJ zey|c6@ZxVd(a1|xo^Z&!=9LjI(t&PKZiAcIpmS)Vged$7JQL* z{@goNkGVI|(&y%nx`|^jn^HTgl$o#;l?llnkSGs`=l^#pG*c={jxYa*jfryY}o#$!>_}gWN z@s{mm@rHJ2RfW4b#GJ{pC0&FRM{37ke1E(rv9elU9P;)uQzywsd~KydQ-k3*D*LR& zX@3D)Hvn1itSEq%ox4rv9~*Z3z`zvc%pSRNT&$%DgPV9V#-MGO-nm zQNhijaXI&rHwttjS=0oNpx%zey^*qp@^}fPG_XW8cOR2|f^;NnL;=yW$=PM| z0*tivn<2WYSWT}-_7h10pOBRi*NaTQt!)`^c9yn+*@>chk$ec``t*%z(rH9dHOv#D z|2ZR-!);hlJ5UKxFZ|lgaC(J4t>X+fea+gTO~c6I4>vC3Art;YZpxfM2qWX5T06*~KBo-vX#opCjzs!lXifLw_lbBV3mQ40>7}vY|tQRuB|5DOsMV{`gW>$?TG9ZbM+$zi9xVqvpo$pw`9O{EpRrd&x&b^)^b7 zldS&6uH{*zY&5tWLo#WDb&_kJHYHU`H8bzW?OX_`VjT(>9X{3NTsPn!z^7K0d`o6c zrPyRVeFg<*4i&~Uq8u_>*!ewDln}{9$0&#Q-pe?sbwgG9zO2rwKQ;n^2L^Iw5jn); zT9as^bG&CVbp@6$HpEfY9k;ffzO`XFxRX$+4AD|<3EC2qEPTmJc$^JpFWghnh3&~( z4mR-$osm=;wc%LN3lh#6L=~!+?19xTG|9*cp~2ocP`+W(n3qvF#Y-omF*4Vt{3)_y z@MLlzMvMJyjjc1GPYvtKX`z?wXsdfLV2TKhHg!^$++Mpq!rM!!F`P(>)9e1YbGqZ3 zpCl3mf#t?-TManI=5=#@&PwUo<2|Mm6+wKVbhSxV6wN1g`RjxRyyPM~=z^0%IDLe6 UWa<>J6*NzR^_`$Uzkbkv07H|C*Z=?k delta 136 zcmbR6p6U91rVRp2lP3s@PG;ei-5kec!^F(Qz`S`Oi!mFRahnS${gX#yvpz3Ws)!$~ z!D#aZL8yqZ2vo7J6i_N#Mq~3r8K~3~IiLuWqS<6OMNcLshRstI6`4Tv9%ZP4|Ee8b E08p$UrvLx| From c45c77e8906d16f8111a2e025d364d607250d215 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 22 Jun 2025 18:12:32 +0100 Subject: [PATCH 3/6] mkosi: update debian commit reference to 84966b99cdfc7ea3ee35163ad224775d9be90055 * 84966b99cd systemd-container: pick up renamed keyring file * 7aab0da57c udev: add 'clock' system group for PTP rules --- mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf index ed4ca80d11..f40a7c3739 100644 --- a/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf +++ b/mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf @@ -9,5 +9,5 @@ Environment= GIT_URL=https://salsa.debian.org/systemd-team/systemd.git GIT_SUBDIR=debian GIT_BRANCH=debian/master - GIT_COMMIT=01b5b96a2f85594c2c8caf5d10048a4ec41f9d89 + GIT_COMMIT=84966b99cdfc7ea3ee35163ad224775d9be90055 PKG_SUBDIR=debian From 4da911c1e52e1431f9678a1fd1966ac737cf1534 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 22 Jun 2025 18:18:53 +0100 Subject: [PATCH 4/6] mkosi: workaround for opensuse spec file to pick up new import-pubring filename --- .../build/mkosi.conf.d/opensuse/mkosi.build.chroot | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot b/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot index ea1acb62f5..84a38a51a7 100755 --- a/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot +++ b/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot @@ -19,9 +19,9 @@ TS="${SOURCE_DATE_EPOCH:-$(date +%s)}" # disable manpage compression as the files cannot be found. Fix the issue by removing the compression # extension. # -# TODO: remove manual cgroups-agent patch when the upstream spec is updated +# TODO: remove manual cgroups-agent and pubring patches when the upstream spec is updated while read -r filelist; do - sed 's/\.gz$//; /systemd-cgroups-agent/d' "$filelist" >"/tmp/$(basename "$filelist")" + sed 's/\.gz$//; /systemd-cgroups-agent/d; s/import-pubring.gpg/import-pubring.pgp/' "$filelist" >"/tmp/$(basename "$filelist")" mount --bind "/tmp/$(basename "$filelist")" "$filelist" done < <(find "pkg/$PKG_SUBDIR${GIT_SUBDIR:+/$GIT_SUBDIR}" -name "files.*") From 18118380c5b2626b1963ff2927408f44c5ea5259 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Mon, 23 Jun 2025 23:14:16 +0100 Subject: [PATCH 5/6] mkosi: drop suse spec workarounds that were merged upstream --- .../build/mkosi.conf.d/opensuse/mkosi.build.chroot | 9 --------- 1 file changed, 9 deletions(-) diff --git a/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot b/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot index 84a38a51a7..ac7202c1d0 100755 --- a/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot +++ b/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot @@ -117,15 +117,6 @@ build() { EXIT_STATUS=$? - # TODO: Remove when the opensuse spec cleans these up itself (https://build.opensuse.org/request/show/1251175). - rm -f \ - systemd.lang \ - debugfiles.list \ - debuglinks.list \ - debugsourcefiles.list \ - debugsources.list \ - elfbins.list - # Make sure we don't reconfigure twice. MKOSI_MESON_OPTIONS="${MKOSI_MESON_OPTIONS//"--wipe"/}" From 078eeac8ea50d12c73b01a6711c58b18bdb7a32c Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Mon, 23 Jun 2025 23:24:33 +0100 Subject: [PATCH 6/6] NEWS: add not about vendor import-pubring renaming --- NEWS | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS b/NEWS index dd6f21dc33..c317c20fbd 100644 --- a/NEWS +++ b/NEWS @@ -116,6 +116,12 @@ CHANGES WITH 258 in spe: kernels that lacked support for it, hence the prefix serves no purpose anymore. + * The default keyring for systemd-importd and related tools, shipped + in /usr/lib/systemd/, has been renamed from import-pubring.gpg to + import-pubring.pgp, as it is supported by other PGP tools as well as + GPG. The local keyring /etc/systemd/import-pubring.gpg is still parsed + if present, to preserve backward compatibility. + Announcements of Future Feature Removals: * Support for System V service scripts is deprecated and will be