← Back to issue list

keys: make AptKeyManager.install_key() more robust

View original Github issue

Metadata

Project
craft-archives
Number
#86
Type
pull request
State
merged
Author
tigarmo
Labels
—
Created
Updated
Closed

Current evaluation

Merged as 9a9706b: AptKeyManager.install_key() now accepts multi-key input, tolerates GPG diagnostics, and can verify a target fingerprint.

Resolution: closed resolved

Reason: PR #86 was merged as commit 9a9706b. The change supports valid keys in multi-key files despite GPG diagnostics and rejects imports missing a requested fingerprint.

Evaluated by: mr-cal-bot

No scores available.

Issue body

This commit relaxes the restriction of the provided key contents having only a single (primary) key, and makes AptKeyManager better handle the fact that "gpg import" might print out useful diagnostics messages even if the key contents are imported "successfully". To do this, we capture gpg's output and add a new optional parameter for the desired "target" key fingerprint (the key that we desire to import even if other keys exist in the contents). This fingerprint is used when naming the imported file, and then: 1) If we don't have a desired fingerprint, proceed as before. 2) If we have a desired fingerprint, check for it in the imported file, failing if it's not there. The motivation for this change is that there are keys "in the wild" that generate gpg error messages but still contain a valid, non-expired desired key. This was supported before but regressed when we moved away from apt-key. This commit is the second one on the road to fixing the "multiple keys in the same file" regression. - [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `tox`? -----

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged as 9a9706b: AptKeyManager.install_key() now accepts multi-key input, tolerates GPG diagnostics, and can verify a target fingerprint.
stealth/space-bunny-alpha — closed resolved Merged in canonical/craft-archives#86 (commit 9a9706b), improving AptKeyManager key imports by supporting multiple keys, tolerating GPG diagnostics, and optionally verifying a target fingerprint.
qwen/qwen3.6-35b-a3b — — Merged. Updated AptKeyManager.install_key() to handle multiple keys and GPG diagnostics. Added an optional target fingerprint parameter to verify and name imported keys, fixing an apt-key migration regression.

Update history

No update history recorded yet.

Related work

Related issues

Issue Project State Summary Similarity
#85 keys: make AptKeyManager.install_key() more robust craft-archives closed Closed unmerged; the intended AptKeyManager.install_key() robustness work landed in craft-archives#86 via commit 9a9706b.
85%
#83 AptKeyManager.install_key() is unnecessarily restrictive craft-archives closed Fixed by merged PR canonical/craft-archives#86 (commit 9a9706b), making AptKeyManager.install_key() handle keys with primary and subkey fingerprints.
81%
#3359 repo: key management refactor snapcraft merged Merged #3359 in commit 8272e54e3, decoupling key handling into AptKeyManager, enforcing 40-character key IDs, and tightening key-asset validation and tests.
71%