# # spec file for package suse-build-key (Version 1.0) # # Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany. # This file and all modifications and additions to the pristine # package are under the same license as the package itself. # # Please submit bugfixes or comments via http://bugs.opensuse.org/ # # norootforbuild Name: suse-build-key BuildRequires: gpg License: GPL v2 or later Group: System/Packages Provides: build-key Requires: gpg AutoReqProv: off Summary: The public gpg key for rpm package signature verification Version: 1.0 Release: 852 Source0: suse-build-key.gpg Source1: dumpsigs BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildArch: noarch %define pubring usr/lib/rpm/gnupg/pubring.gpg %define susering usr/lib/rpm/gnupg/suse-build-key.gpg PreReq: sh-utils gpg fileutils mktemp %description This package contains the gpg key that is used to sign official SuSE rpm packages. It will be installed as a keyring in /usr/lib/rpm/gnupg/pubring.gpg. Administrators who wish to add their own keys to verify against should use the following commandline command to add the key to the keyring as used by RPM: gpg --no-options --no-default-keyring \ --keyring /usr/lib/rpm/gnupg/pubring.gpg --import %prep rm -f foobarnosuchfileordirectory #%setup %build %install rm -rf $RPM_BUILD_ROOT mkdir -p $RPM_BUILD_ROOT/usr/lib/rpm/gnupg install %{SOURCE0} $RPM_BUILD_ROOT/%{susering} install -m 755 %{SOURCE1} $RPM_BUILD_ROOT/usr/lib/rpm/gnupg touch $RPM_BUILD_ROOT/%{pubring} touch $RPM_BUILD_ROOT/%{pubring}~ %files %defattr(644,root,root) %attr(755,root,root) %dir /usr/lib/rpm/gnupg %attr(755,root,root) /usr/lib/rpm/gnupg/dumpsigs %config /%{susering} %ghost /%{pubring} %ghost /%{pubring}~ %post if [ ! -f %{pubring} ]; then touch %{pubring} fi echo -n "importing SuSE build key to rpm keyring... " TF=`mktemp /tmp/gpg.XXXXXX` if [ -z "$TF" ]; then echo "suse-build-key::post: cannot make temporary file. Fatal error." exit 20 fi if [ -z "$HOME" ]; then HOME=/root fi if [ ! -d "$HOME" ]; then mkdir "$HOME" fi gpg -q --batch --no-options < /dev/null > /dev/null 2>&1 || true # no kidding... gpg won't initialize correctly without being called twice. gpg < /dev/null > /dev/null 2>&1 || true gpg < /dev/null > /dev/null 2>&1 || true gpg -q --batch --no-options --no-default-keyring --no-permission-warning \ --keyring %{susering} --export -a > $TF a="$?" gpg -q --batch --no-options --no-default-keyring --no-permission-warning \ --keyring %{pubring} --import < $TF b="$?" rm -f "$TF" if [ "$a" = 0 -a "$b" = 0 ]; then echo "done." else echo "importing the key from the file %{susering}" echo "returned an error. This should not happen. It may not be possible" echo "to properly verify the authenticity of rpm packages from SuSE sources." echo "The keyring containing the SuSE rpm package signing key can be found" echo "in the root directory of the first CD (DVD) of your SuSE product." exit -1 fi ### import suse package build key to roots gpg keyring if test -f root/.gnupg/pubring.gpg ; then chroot . usr/bin/gpg --export --armor --no-default-keyring \ --keyring %{susering} build@suse.de \ | chroot . usr/bin/gpg --import || true if ! chroot . usr/bin/gpg --list-keys build@suse.de >/dev/null 2>&1 ; then echo "gpg import for build@suse.de failed, please import manually" >&2 fi else cp %{susering} root/.gnupg/pubring.gpg fi chmod 600 root/.gnupg/pubring.gpg %changelog * Mon Jun 02 2008 ro@suse.de - update keys again: for collaboration with rpm, the current self-signature needs to be the first signature found in a key * Mon May 05 2008 ro@suse.de - updated keys 9C800ACA,8495160C,307E3D54: extend expiration by 2 years until 2010-05-05 7E2E3B05: extend expiration by 2 years until 2010-05-24 * Mon Mar 19 2007 rguenther@suse.de - merge suse-build-key keyring to roots gpg pubring * Mon May 29 2006 ro@suse.de - added new official provo dsa autobuild key ID 7E2E3B05 * Fri May 19 2006 ro@suse.de - removed unused provo autobuild key - added new official provo autobuild key ID A1912208 * Thu Apr 20 2006 ro@suse.de - add dumpsigs script here to have _one_ place for the script * Fri Mar 31 2006 ro@suse.de - added build@suse.de rsa key ID 307E3D54 * Wed Jan 25 2006 mls@suse.de - converted neededforbuild to BuildRequires * Tue Oct 18 2005 ro@suse.de - use correct provo autobuild key * Tue Oct 18 2005 ro@suse.de - added provo autobuild signing key (#128128) - removed jds key * Fri May 27 2005 mls@suse.de - added mktemp to PreReqs [#86177] * Thu Apr 28 2005 ro@suse.de - added JDS public key (15c17deb) * Tue Jan 25 2005 ro@suse.de - added OES public key (0dfb3188) * Tue Jun 22 2004 ro@suse.de - updated build key (expiration changed to 2008-06-21) (#42326) * Tue Feb 24 2004 hmacht@suse.de - building as non-root * Tue Sep 09 2003 ro@suse.de - ignore return code from first gpg calls * Tue Sep 09 2003 draht@suse.de - call gpg twice without any arguments for proper initialization inside postinstall * Tue Sep 09 2003 draht@suse.de - use temp file instead of pipe due to resource race between two instances of gpg in %%post. * Thu Sep 05 2002 draht@suse.de - package now installs key from package-owned file into the rpm pubring in %%post to allow other key packages to add their keys. * Tue Aug 20 2002 mmj@suse.de - Correct PreReq * Fri Jul 26 2002 kukuk@suse.de - Change Provides from suse-build-key to build-key * Thu Feb 21 2002 draht@suse.de - directory permission problem: 644 -> 755. * Mon Feb 18 2002 ro@suse.de - moved to /usr/lib/rpm/gnupg/pubring.pgp rpm needs a directory as gpg_path and will use pubring.gpg in that directory * Wed Feb 13 2002 draht@suse.de - initial package. Contains - pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team - pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key - sub 2048g/8495160C 2000-10-19 [expires: 2006-02-12]