keys: make AptKeyManager.install_key() more robust
Metadata
Current evaluation
Merged as 9a9706b: AptKeyManager.install_key() now accepts multi-key input, tolerates GPG diagnostics, and can verify a target fingerprint.
Resolution: closed resolved
Reason: PR #86 was merged as commit 9a9706b. The change supports valid keys in multi-key files despite GPG diagnostics and rejects imports missing a requested fingerprint.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This commit relaxes the restriction of the provided key contents having only a single (primary) key, and makes AptKeyManager better handle the fact that "gpg import" might print out useful diagnostics messages even if the key contents are imported "successfully".
To do this, we capture gpg's output and add a new optional parameter for the desired "target" key fingerprint (the key that we desire to import even if other keys exist in the contents). This fingerprint is used when naming the imported file, and then:
1) If we don't have a desired fingerprint, proceed as before. 2) If we have a desired fingerprint, check for it in the imported file,
failing if it's not there.
The motivation for this change is that there are keys "in the wild" that generate gpg error messages but still contain a valid, non-expired desired key. This was supported before but regressed when we moved away from apt-key.
This commit is the second one on the road to fixing the "multiple keys in the same file" regression.
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `tox`?
-----
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as 9a9706b: AptKeyManager.install_key() now accepts multi-key input, tolerates GPG diagnostics, and can verify a target fingerprint. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/craft-archives#86 (commit 9a9706b), improving AptKeyManager key imports by supporting multiple keys, tolerating GPG diagnostics, and optionally verifying a target fingerprint. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged. Updated AptKeyManager.install_key() to handle multiple keys and GPG diagnostics. Added an optional target fingerprint parameter to verify and name imported keys, fixing an apt-key migration regression. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/craft-archives#87
(confidence 95%)
Follow-up merged as 9fbb5ce, forwarding key IDs to install_key().
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #85 keys: make AptKeyManager.install_key() more robust | craft-archives | closed | Closed unmerged; the intended AptKeyManager.install_key() robustness work landed in craft-archives#86 via commit 9a9706b. | |
| #83 AptKeyManager.install_key() is unnecessarily restrictive | craft-archives | closed | Fixed by merged PR canonical/craft-archives#86 (commit 9a9706b), making AptKeyManager.install_key() handle keys with primary and subkey fingerprints. | |
| #3359 repo: key management refactor | snapcraft | merged | Merged #3359 in commit 8272e54e3, decoupling key handling into AptKeyManager, enforcing 40-character key IDs, and tightening key-asset validation and tests. |