https://blue-build.org/ logo
Powered by
Pin signing keys?
# questions
v
Is there a way to pin the signing keys for the base image and ensure any packages installed by the module are verified? I'd like to verify all the packages that I can.
a
message has been deleted
g
> packages installed by the module are verified What do you mean by this?
AFAIK, 
dnf
does the verification
a
this is how secureblue verifies the base image signatures: so the signing keys are "pinned" in the sense that the public keys are stored in the secureblue repo, so signature verification would fail if the base images switched to a different signing key
v
I believe the dnf module installs packages even if they're not signed
a
isn't that configured in the repo files? so if you're only installing from repos where the repo file enforces signature verification then it shouldn't install unsigned packages
v
it looks like it auto accepts the keys in the repo file
I want it to not do that. Although i guess i could commit the repo file to the bluebuild git and remove the gpgkey= line
a
ah yeah it does do that. secureblue handles that by vendoring the GPG keys and changing the gpgkey lines to point to the local keys. so for example you can see the modified Negativo repo file here: and the GPG keys are in 
files/system/usr/share/pki/rpm-gpg
, so they get moved into place by the 
files
module, which secureblue sets to run before the 
dnf
module
v
any reason not to use the dnf module for that instead of the files module?
a
how would you specify keys stored in the repo using the dnf module?
v
dnf module can grab keys and repo files from files/dnf https://blue-build.org/reference/modules/dnf/ > Add repos from > any https:// or http:// URL > any .repo files located in ./files/dnf/ of your image repo
a
that looks like it grabs repo files in files/dnf but what about keys?
and also we do want the keys to be placed into 
/usr/share/pki/rpm-gpg
in the built image so they're available at runtime (for example for package layering)
so I think it makes sense to put them in the 
files
module
v
it does the same with keys
that part isn't documented though
a
oh, that should be documented better then... and where does it place the keys in the image? does it also put them in 
/usr/share/pki/rpm-gpg
?
v
i'm not sure but they show up when i run rpm -q gpg-pubkey. I guess it goes into the sqlite db at /var/lib/rpm?
is there a reason secureblue has repo_gpgcheck=0?
a
All the repo files there are just copied from upstream except for switching to a local key
v
well i tested it and it looks like you can commit the .repo file and remove the gpgkey= line and it works if you also add the key file via the dnf module
a
you sure that doesn't make it stop doing signature verification?
v
yep. if i don't include the keys the build fails > OpenPGP check for package "code-1.117.0-1776814401.el8.x86_64" (/var/cache/libdnf5/vscode-yum-8194d3505cd295f0/packages/code-1.117.0-1776814401.el8.x86_64.rpm) from repo "vscode-yum" has failed: The repository does not have any OpenPGP keys configured.
a
ah okay that's good to know
secureblue will probably keep doing it the current way though because it uses the dnf module multiple times with some of them only running on certain images, so it's simpler to centralize repo and key management using the files module
but for less complex builds it probably makes sense to use the dnf module for this
PreviousNext
Powered by