[fix(builder): pre-import PKGBUILD validpgpkeys before build - #362
[fix(builder): pre-import PKGBUILD validpgpkeys before build#362Aroy-Art wants to merge 2 commits into
Conversation
Keyserver connectivity inside Docker containers causes --pgpfetch to silently fail for packages with validpgpkeys (e.g. zfs-utils key 6AD860EED4598027), breaking source verification. Sources PKGBUILD after paru -Ga to extract validpgpkeys, then tries three keyservers (Ubuntu → OpenPGP → MIT) before paru runs. Never fails the build; --pgpfetch remains as secondary fallback. Partially closes Lukas-Heiligenbrunner#64 (Manual import is not handeld)
| // (--pgpfetch will still attempt to fetch during build as a secondary attempt). | ||
| let import_pgp_keys = |pkgbuild_dir: &str| { | ||
| format!( | ||
| r#"(bash -c 'cd {pkgbuild_dir} && source PKGBUILD 2>/dev/null; for k in "${{validpgpkeys[@]:-}}"; do [ -z "$k" ] && continue; gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys "$k" 2>/dev/null || gpg --keyserver hkps://keys.openpgp.org --recv-keys "$k" 2>/dev/null || gpg --keyserver hkp://pgp.mit.edu --recv-keys "$k" 2>/dev/null || echo "Warning: failed to import PGP key $k"; done' || true)"# |
There was a problem hiding this comment.
Thanks for the PR. I think source PKGBUILD is not a very good idea to run manually since it can be an arbitrary shell script.
Doing makepkg --printsrcinfo should be a better option since its run in an controlled way.
PR #360 moves from using paru to doing our own dependency resolution and added already something similar than you here:
https://github.com/Lukas-Heiligenbrunner/AURCache/pull/360/changes#diff-9824f463ed3db347394cc2d3267d13ed1349c9412eeb7de66503066486f4878bR5
We still need to review and pollish this pr until it gets to master.
Do you allign with the approach taken there?
Its not a very clean way to pass such a large shell script to the docker containers CMD tho.
Feel free to comment on PR #360 if you have improvement suggestions / input.
Thanks!
There was a problem hiding this comment.
Good point — source PKGBUILD executing arbitrary shell is a valid concern. Agree that makepkg --printsrcinfo (or reading .SRCINFO if already present) is cleaner and safer.
The approach in #360 looks right: prefer .SRCINFO when it exists, fall back to makepkg --printsrcinfo, parse validpgpkeys lines with sed. Happy to update this PR to use that pattern instead of source PKGBUILD if it's useful as a quick fix on master while #360 is still being polished — otherwise happy to close this in favor of #360 since it handles the problem more comprehensively. Let me know which you prefer.
There was a problem hiding this comment.
2 participants
Keyserver connectivity inside Docker containers causes --pgpfetch to silently fail for packages with validpgpkeys (e.g. zfs-utils key 6AD860EED4598027), breaking source verification.
Sources PKGBUILD after paru -Ga to extract validpgpkeys, then tries three keyservers (Ubuntu → OpenPGP → MIT) before paru runs. Never fails the build; --pgpfetch remains as secondary fallback.
Partially closes #64 (Manual import is not handeld)