Infrastructure » sepia

apt-key add release.asc

automatically converts it to the correct format.

Is the resulting /etc/apt/trusted.gpg file something that should be reused though? It's not ascii.

This works fine on Debian 10: wget -q -O- 'https://download.ceph.com/keys/release.asc' | sudo apt-key add - as our docs suggest.

I tried importing the key then exporting it using apt-key export but it just outputs the same public key block (minus Version: GnuPG v1)

yes, `apt-key` works, but would require to add gnupg as a dependency for cephadm on all hosts.

What I'm getting at is, is /etc/apt/trusted.gpg after apt converts the key portable? Can we just throw trusted.gpg on download.ceph.com and it'll work universally?

For those trying to follow along, I ended up doing this:

curl https://download.ceph.com/keys/release.asc | gpg --no-default-keyring --keyring /tmp/fix.gpg --import - && gpg --no-default-keyring --keyring /tmp/fix.gpg --export > /etc/apt/trusted.gpg.d/ceph.release.gpg && rm /tmp/fix.gpg

The key import itself works fine, it's just that the Debian repo it matches against can't process the type 1 GPG key.

The output files in /etc/apt/trusted.gpg.d/ (e.g. debian-archive-buster-stable.gpg) are also not ascii files, they're data blobs.

Jon Spriggs wrote:

The output files in /etc/apt/trusted.gpg.d/ (e.g. debian-archive-buster-stable.gpg) are also not ascii files, they're data blobs.

Are the data blobs portable? Could I just upload those to download.ceph.com and have our tooling pull the new keys if the OS is using the newer GPG version?

I am running into this issue on Debian buster. I'm happy to contribute the changes if someone wants to upload things on the Ceph side.

Mohammed Naser wrote:

I am running into this issue on Debian buster. I'm happy to contribute the changes if someone wants to upload things on the Ceph side.

I'd be happy to upload a patched key. I just still haven't gotten confirmation that a patched key is portable. i.e., if a key you've imported on your machine can be imported to any machine.

Cool. I decided to run a little experiment in that case:

docker run -it --rm debian:buster
apt update
apt install curl gnupg
curl https://download.ceph.com/keys/release.asc | gpg --no-default-keyring --keyring /tmp/fix.gpg --import - && gpg --no-default-keyring --keyring /tmp/fix.gpg --export > /etc/apt/trusted.gpg.d/ceph.release.gpg && rm /tmp/fix.gpg
md5sum /etc/apt/trusted.gpg.d/ceph.release.gpg

The md5sum was 86c50270e710a52ba54922f8959bb253. I reran the same exact thing in another Docker container and ended up with the same md5sum. Now, to test the theory that it's portable, I uploaded that file here:

https://bashupload.com/rPoHl/nYBR_.gpg

I launched a new container again, but this time using the consumed key:

docker run -it --rm debian:buster
apt update
apt install curl
curl https://bashupload.com/rPoHl/nYBR_.gpg > /etc/apt/trusted.gpg.d/ceph.release.gpg
echo deb https://download.ceph.com/debian-octopus/ buster main | tee /etc/apt/sources.list.d/ceph.list
apt update
apt install librados2
apt info librados2

The result returns

# apt info librados2
Package: librados2
Version: 15.2.4-1~bpo10+1
Priority: optional
Section: libs
Source: ceph
Maintainer: Ceph Maintainers <ceph-maintainers@lists.ceph.com>
Installed-Size: 13.4 MB
Depends: libblkid1 (>= 2.17.2), libc6 (>= 2.28), libgcc1 (>= 1:3.0), libibverbs1 (>= 1.1.6), liblttng-ust0 (>= 2.5.0), librdmacm1 (>= 1.0.15), libssl1.1 (>= 1.1.0), libstdc++6 (>= 6), libudev1 (>= 183), zlib1g (>= 1:1.1.4)
Conflicts: librados
Replaces: librados
Homepage: http://ceph.com/
Download-Size: 3110 kB
APT-Manual-Installed: yes
APT-Sources: https://download.ceph.com/debian-octopus buster/main amd64 Packages
Description: RADOS distributed object store client library

N: There is 1 additional record. Please use the '-a' switch to see it

So, my little experiment confirms that it works and feel free to reproduce it with the instructions above. :)

Mohammed Naser wrote:

Cool. I decided to run a little experiment in that case:

Thanks so much for this!

@Sebastian I., can we have cephadm start using http://download.ceph.com/keys/release.gpg instead of release.asc?

I believe that the following section must be updated:

https://github.com/ceph/ceph/blob/cb529acaf485a62c48df557341a88d3092823ee2/src/cephadm/cephadm#L4289-L4290

David Galloway wrote:

@Sebastian I., can we have cephadm start using http://download.ceph.com/keys/release.gpg instead of release.asc?

I don't know the answer to that, but I tried simply replacing 'release.asc' with 'release.gpg' in the cephadm source code and that doesn't work.

https://github.com/ceph/ceph/pull/41813