From 76cd3e94c5b72863c09185f83dc48bfad5f41a54 Mon Sep 17 00:00:00 2001 From: navigator Date: Fri, 2 Oct 2026 13:07:21 +0000 Subject: [PATCH 1/5] fix: images take packages from Debian and the Keel repository only The first boot's security updates fetched from archive.turnkeylinux.org. conf/bootstrap_apt wrote an enabled TurnKey stanza into sources.sources and into security.sources.sources (the file 95secupdates and cron-apt read), turnkey-testing.sources beside them, TurnKey's keys imported and an o=turnkeylinux pin at 999 from overlays/bootstrap_apt. Per handbook decisions 0039 and 0043: - conf/bootstrap_apt writes debian.sources (deb.debian.org trixie and trixie-updates), security.sources (security.debian.org trixie-security) and debian-backports.sources, signed by Debian's keyring, and removes the three names it used to write. Builds below Debian 13 are refused. - overlays/turnkey.d/keel-apt adds keel.sources (archive.keellinux.org trixie, the stable track; trixie-testing disabled) signed by keel-archive-keyring, which plans/turnkey/base installs instead of turnkey-keys, and /etc/apt/preferences.d/keel at 990 on o=Keel Linux. - 990 and not 1001 (tracker#23): above Debian's 500 the Keel version is the candidate whatever Debian publishes, below 1000 apt never installs it over a newer installed one. - conf/turnkey.d/keel-apt stops a build missing keel.sources or the keyring, or with a source naming the TurnKey archive, and removes TurnKey's files a layer inherits by name, as apt-identity does. - cron-apt's install actions read security.sources. TurnKey's keys leave the image; the CI job that installs the overlay packages keeps its trixie key as tests/fixtures/tkl-trixie-main.asc. --- .github/workflows/packages.yml | 2 +- COVERAGE.md | 9 + changes/turnkey.changelog | 30 ++ conf/bootstrap_apt | 166 ++------ conf/turnkey.d/cronapt | 7 +- conf/turnkey.d/keel-apt | 38 ++ overlays/bootstrap_apt/etc/apt/preferences | 4 - .../usr/share/keyrings/tkl-bookworm-main.asc | 66 --- .../share/keyrings/tkl-bookworm-security.asc | 66 --- .../share/keyrings/tkl-bookworm-testing.asc | 66 --- .../usr/share/keyrings/tkl-bullseye-main.asc | 66 --- .../share/keyrings/tkl-bullseye-security.asc | 66 --- .../share/keyrings/tkl-bullseye-testing.asc | 66 --- .../usr/share/keyrings/tkl-buster-main.asc | 66 --- .../share/keyrings/tkl-buster-security.asc | 66 --- .../usr/share/keyrings/tkl-buster-testing.asc | 66 --- .../share/keyrings/tkl-trixie-security.asc | 66 --- .../usr/share/keyrings/tkl-trixie-testing.asc | 66 --- .../keel-apt/etc/apt/preferences.d/keel | 11 + .../etc/apt/sources.list.d/keel.sources | 19 + plans/turnkey/base | 2 +- tests/apt-identity.bats | 85 +--- tests/apt-sources.bats | 380 ++++++++++++++++++ tests/coverage.sh | 1 + .../fixtures}/tkl-trixie-main.asc | 0 25 files changed, 528 insertions(+), 952 deletions(-) create mode 100755 conf/turnkey.d/keel-apt delete mode 100644 overlays/bootstrap_apt/etc/apt/preferences delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-main.asc delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-security.asc delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-testing.asc delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-main.asc delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-security.asc delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-testing.asc delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-main.asc delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-security.asc delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-testing.asc delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-security.asc delete mode 100644 overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-testing.asc create mode 100644 overlays/turnkey.d/keel-apt/etc/apt/preferences.d/keel create mode 100644 overlays/turnkey.d/keel-apt/etc/apt/sources.list.d/keel.sources create mode 100644 tests/apt-sources.bats rename {overlays/bootstrap_apt/usr/share/keyrings => tests/fixtures}/tkl-trixie-main.asc (100%) diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml index 2fffe380..ba47c55b 100644 --- a/.github/workflows/packages.yml +++ b/.github/workflows/packages.yml @@ -100,7 +100,7 @@ jobs: printf '#!/bin/sh\nexit 101\n' > /usr/sbin/policy-rc.d chmod 0755 /usr/sbin/policy-rc.d gpg --dearmor \ - < overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-main.asc \ + < tests/fixtures/tkl-trixie-main.asc \ > /usr/share/keyrings/tkl-trixie-main.gpg echo "deb [signed-by=/usr/share/keyrings/tkl-trixie-main.gpg] https://archive.turnkeylinux.org/debian trixie main" \ > /etc/apt/sources.list.d/turnkey.list diff --git a/COVERAGE.md b/COVERAGE.md index fc5637d9..17684c53 100644 --- a/COVERAGE.md +++ b/COVERAGE.md @@ -4,6 +4,15 @@ Measured on 2026-09-24 against upstream 19.x (b60dd23), following the project decision 0003 (90 percent floor per repository, 95 percent for every file our changes touch). +## Branch fix/keel-apt-sources: 100 percent, one new file (2026-10-02) + +`conf/turnkey.d/keel-apt` is measured for the first time: 11 of 11 lines, +kcov 43 on Debian 13, from `tests/apt-sources.bats`. The suite also reads +back from apt what the sources of `conf/bootstrap_apt` and +`overlays/turnkey.d/keel-apt` fetch, and which version the pin makes the +candidate, from local archives carrying the real Origin; the bootstrap URI +tests that were in `tests/apt-identity.bats` moved there. + ## Branch fix/utf8-login-locale: 100 percent, one new file (2026-10-02) `conf/turnkey.d/locale` is measured for the first time: 15 of 15 lines, diff --git a/changes/turnkey.changelog b/changes/turnkey.changelog index fbe3ba4a..163bf3e0 100644 --- a/changes/turnkey.changelog +++ b/changes/turnkey.changelog @@ -14,6 +14,36 @@ turnkey-core-19.0 (1) turnkey; urgency=low (100 percent of its lines); the ROOT_PASS tests of rootpass.bats, samba-rootpass.bats and before-firstboot.bats now expect it ignored. + * An image takes its packages from Debian and from the Keel repository, + and from nothing else (handbook decisions 0039 and 0043). The first + boot's security updates fetched from archive.turnkeylinux.org: the + bootstrap wrote a TurnKey stanza, enabled, into sources.sources and + into security.sources.sources, the file 95secupdates and cron-apt read, + with turnkey-testing.sources beside them and TurnKey's keys trusted. + conf/bootstrap_apt now writes debian.sources (deb.debian.org, trixie + and trixie-updates), security.sources (security.debian.org, + trixie-security; the double extension is gone) and + debian-backports.sources, all signed by Debian's own keyring. + overlays/turnkey.d/keel-apt adds keel.sources, archive.keellinux.org + trixie, the stable track, with trixie-testing disabled, signed by + /usr/share/keyrings/keel-archive-keyring.gpg from keel-archive-keyring, + which the base plan installs instead of turnkey-keys. TurnKey's keys + and its o=turnkeylinux pin at 999 leave overlays/bootstrap_apt. + + * The Keel repository is pinned at 990, on the Origin of its signed + Release (o=Keel Linux), in /etc/apt/preferences.d/keel. Above Debian's + 500, a Keel package is the candidate whatever version Debian has; + below 1000, apt never installs it over a newer installed one, which a + pin above 1000 does (tracker#23). tests/apt-sources.bats asserts both + against apt itself, and fails at 1001 and at 500. + + * conf/turnkey.d/keel-apt stops a build whose image lacks keel.sources or + the Keel keyring, or has a source naming the TurnKey archive. It + removes, by name, TurnKey's files a layer inherits from a parent built + before this change, as conf/turnkey.d/apt-identity does for 01turnkey. + + * cron-apt's install actions read security.sources. + * A login gets a UTF-8 locale. 'conf/turnkey.d/locale' wrote LC_ALL=C and LC_CTYPE=C into /etc/default/locale, which pam_env gives every login, so a shell ran in an ASCII locale and dialog, confconsole after diff --git a/conf/bootstrap_apt b/conf/bootstrap_apt index bd161f2b..dcd23e45 100755 --- a/conf/bootstrap_apt +++ b/conf/bootstrap_apt @@ -7,8 +7,6 @@ # - will fallback to host system if not set # - NONFREE : # - set to enable non-free by default -# - TKL_TESTING : -# - set to enable the TUrnKey testing repo # - BACKPORTS : # - set to enable Debian backports repo # - PHP_VERSION : @@ -24,11 +22,17 @@ # - 'disable' (disable proxy) # - HOST_DEB_VER : # - if not the same as guest, apply relevant transition changes -# - NO_TURNKEY_APT_REPO : -# - disable TurnKey apt repos - useful during early transition # - NO_PROXY : # - same as APT_PROXY_OVERRIDE=disable (will override APT_PROXY_OVERRIDE # if both set to different values) +# +# What a Keel image installs comes from two places only (handbook decisions +# 0039 and 0043): Debian's packages from Debian, written here, and Keel's +# from archive.keellinux.org, written by overlays/turnkey.d/keel-apt once +# the plan has installed keel-archive-keyring, the key that source names. +# The TurnKey archive is no package source of a Keel image, enabled or +# disabled: TurnKey is an upstream in git only. TKL_TESTING and +# NO_TURNKEY_APT_REPO, which switched it, are therefore ignored. # Note, to install packages from backports: # - set 'BACKPORTS=y'; and either: @@ -61,7 +65,6 @@ case $CODENAME in bullseye|bookworm|trixie) MIRROR_URL=http://deb.debian.org/debian SEC_MIRROR=http://security.debian.org/ - KEY_CODENAME=$CODENAME MAIN=(main) CONTRIB=(contrib) NON_FREE=(non-free) @@ -77,15 +80,6 @@ case $CODENAME in MAIN=(main) CONTRIB=(universe) NON_FREE=(restricted multiverse) - ;;& - focal) - KEY_CODENAME="bullseye" - ;; - jammy) - KEY_CODENAME="bookworm" - ;; - noble) - KEY_CODENAME="trixie" ;; *) fatal "Codename '$CODENAME' not supported" @@ -110,13 +104,13 @@ if [[ "$HOST_DEB_VER" != "$deb_ver" ]]; then fi fi -if [[ $deb_ver -le 10 ]] && [[ "$distro" == 'debian' ]]; then - sec_repo="$CODENAME/updates" - PROXY_PORT=8124 -elif [[ $deb_ver -ge 11 ]] || [[ "$distro" == 'ubuntu' ]]; then - sec_repo="$CODENAME-security" - PROXY_PORT=3128 +# Keel builds on Debian 13 (trixie) and later, whose sources are deb822 +# files; the one line sources.list of older releases is not written. +if [[ "$distro" != 'debian' ]] || [[ $deb_ver -lt 13 ]]; then + fatal "Keel images are built on Debian 13 (trixie) or later (got '$distro' $deb_ver)" fi +sec_repo="$CODENAME-security" +PROXY_PORT=3128 if [[ "${APT_PROXY_OVERRIDE,,}" == "disable" ]] || [[ -n "$NO_PROXY" ]]; then PROXY_PORT= @@ -147,17 +141,14 @@ fi DEBIAN_PHP_V=$(apt-cache policy php \ | sed -n "\|Candidate:|s|.*:\([0-9]\.[0-9]*\)+.*|\1|p") -tkl_apt_repo_enabled="yes" -tkl_apt_testing_enabled="no" debian_backports_enabled="no" sury_php_enabled="no" debian_components=("${MAIN[@]}") if [[ -n "$NONFREE" ]]; then debian_components+=("${CONTRIB[@]}" "${NON_FREE[@]}") fi -if [[ -n "$TKL_TESTING" ]]; then - # note that if 'NO_TURNKEY_APT_REPO' is set, this will be overridden - tkl_apt_testing_enabled="yes" +if [[ -n "$TKL_TESTING" ]] || [[ -n "$NO_TURNKEY_APT_REPO" ]]; then + warning "TKL_TESTING and NO_TURNKEY_APT_REPO are ignored: a Keel image has no TurnKey package source" fi if [[ -n "$BACKPORTS" ]]; then debian_backports_enabled="yes" @@ -167,133 +158,42 @@ if [[ -n "$PHP_VERSION" ]] \ && [[ "$PHP_VERSION" != "$DEBIAN_PHP_V" ]]; then sury_php_enabled="yes" fi -if [[ -n "$NO_TURNKEY_APT_REPO" ]]; then - tkl_apt_repo_enabled="no" - tkl_apt_testing_enabled="no" -else - key_dir=/usr/share/keyrings - # As of TKL v19.x apt repos use a single gpg keyring that is generated from - # the 3 separate raw ascii armored keys - # - # For prior releases, each repo had a separate gpg key generated from each - # of the sepaate asc keys - repos=(main security testing) - for repo in "${repos[@]}"; do - full_path=$key_dir/tkl-$CODENAME-$repo - keyfile=$full_path.asc - if [[ $deb_ver -ge 13 ]]; then - keyring=$key_dir/tkl-archive-keyring.gpg - else - keyring=$full_path.gpg - fi - # by default gpg generates "GPG keybox database version 1" files - # apt in Trixie requires a "PGP/GPG key public ring (v4)" - gpg --no-default-keyring --keyring gnupg-ring:"$keyring" --import "$keyfile" - chmod a+r "$keyring" - done - # ensure that gpg-agent is killed after processing keys - gpgconf --kill gpg-agent - rm -rf "$key_dir"/*~ - rm -rf "$HOME/.gnupg" -fi - -if [[ $deb_ver -ge 13 ]]; then - # As of TKL v19.x apt sources files are deb822 style '.sources' files +# Debian's own keyring, under the name Debian 13's debian.sources uses +DEBIAN_KEYRING=/usr/share/keyrings/debian-archive-keyring.pgp - SUPPORTED_ARCH=(amd64 arm64) - - # Main repos - cat > $SOURCES_LIST/sources.sources < $SOURCES_LIST/debian.sources < $SOURCES_LIST/security.sources.sources < $SOURCES_LIST/security.sources < $SOURCES_LIST/debian-backports.sources < $SOURCES_LIST/debian-backports.sources < $SOURCES_LIST/turnkey-testing.sources < $SOURCES_LIST/sources.list < $SOURCES_LIST/security.sources.list < $SOURCES_LIST/$TKL_TESTING_LIST < $DEB_BACKPORT_LIST < TurnKey_Linux_5-install.README << EOF # ------------------------------- # # This is the historic and default TurnKey cron-apt behaviour. Only packages -# from the security.sources.list repositories will be installed. Any conflicts +# from /etc/apt/sources.list.d/security.sources, Debian's security archive, +# will be installed. Any conflicts # or missing dependencies will not be installed and will cause package removal. # This package removal may cause one or more services to fail. # @@ -52,7 +53,7 @@ cat > action-available.d/5-install.default << EOF autoclean -y dist-upgrade -y \ -o APT::Get::Show-Upgraded=true \ - -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/security.sources.sources \ + -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/security.sources \ -o Dir::Etc::sourceparts=nonexistent \ -o DPkg::Options::=--force-confdef \ -o DPkg::Options::=--force-confold @@ -63,7 +64,7 @@ autoclean -y upgrade -y \ -o APT::Get::Upgrade-Allow-New=true \ -o APT::Get::Show-Upgraded=true \ - -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/security.sources.sources \ + -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/security.sources \ -o Dir::Etc::sourceparts=nonexistent \ -o DPkg::Options::=--force-confdef \ -o DPkg::Options::=--force-confold diff --git a/conf/turnkey.d/keel-apt b/conf/turnkey.d/keel-apt new file mode 100755 index 00000000..8a4f5934 --- /dev/null +++ b/conf/turnkey.d/keel-apt @@ -0,0 +1,38 @@ +#!/bin/bash -e +# +# Holds an image to the package sources of handbook decision 0039: Debian's +# packages from Debian (conf/bootstrap_apt) and Keel's from +# archive.keellinux.org (overlays/turnkey.d/keel-apt), signed by the key the +# keel-archive-keyring package installs. +# +# A layer built on a bootstrap or a parent layer from before this change +# still carries TurnKey's apt files by their known names, the same way a +# stale 01turnkey outlived 01keel (conf/turnkey.d/apt-identity). Those are +# removed by name. Any other source that names the TurnKey archive stops +# the build, because it was written by something this script does not know. +# +# APT_ROOT is a test hook; a build leaves it unset. + +fatal() { echo "'$(basename "$0")' Error: $*" >&2; exit 1; } + +root="${APT_ROOT:-}" +sources="$root/etc/apt/sources.list.d" +keyrings="$root/usr/share/keyrings" + +[ -f "$sources/keel.sources" ] \ + || fatal "'$sources/keel.sources' is missing - it is shipped by overlays/turnkey.d/keel-apt" +[ -f "$keyrings/keel-archive-keyring.gpg" ] \ + || fatal "'$keyrings/keel-archive-keyring.gpg' is missing - install keel-archive-keyring (plans/turnkey/base)" + +# TurnKey's own files, by the names its bootstrap gave them +rm -f "$sources/sources.sources" "$sources/security.sources.sources" \ + "$sources/turnkey-testing.sources" +rm -f "$keyrings"/tkl-*.asc "$keyrings"/tkl-*.gpg +if [ -f "$root/etc/apt/preferences" ] \ + && grep -q '^Pin: release o=turnkeylinux$' "$root/etc/apt/preferences"; then + rm -f "$root/etc/apt/preferences" +fi + +found="$(grep -rlE 'turnkeylinux\.org' "$sources" 2>/dev/null || true)" +[ -z "$found" ] \ + || fatal "these apt sources name the TurnKey archive, which is no package source of a Keel image: $found" diff --git a/overlays/bootstrap_apt/etc/apt/preferences b/overlays/bootstrap_apt/etc/apt/preferences deleted file mode 100644 index 07cb4e2f..00000000 --- a/overlays/bootstrap_apt/etc/apt/preferences +++ /dev/null @@ -1,4 +0,0 @@ -Package: * -Pin: release o=turnkeylinux -Pin-Priority: 999 - diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-main.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-main.asc deleted file mode 100644 index 8d204244..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-main.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBGRrBS4BEADKfWQc9gt8ExlH+F7GV5eE35hXOrPpFN4YL5v8k6JetWpnbjnv -8IKmBEv5KAQMKvPZOYzcj/67h9oRbWZEUBQ93rCH+BHKihSXuflsYAdEvcGvh5S1 -sIdxiaVJxRbmQbsk58crSU63VycwKoq8VnmkBs8KSWMa6NR4cm5Hdt5THEGWgewt -SZzpo3lqnJCE7liIxA+aXLyHIBcextTrO3TmoXD6QkUn1Eu94y6eyTNS8Wt5zcuJ -QFHYaPeJJrjpd99d3C1szv9J1nqmaQTVf60Hu/A2HkVzAMwLpTOzD4xffa7grLvD -/uwFdw0iG5VyL8fSeW2tHXPnWsU+yqKuPwTvo0DL8FRWE2mX/OQYPAjRBKdyxyKf -6VGeZ+P3CiYhpkLYa3xRniFGQdBSNRxakCjd06KClKDgpTp78thGP9ruwQeYmb9z -APtxpOVaW4n5w4R4bUJofg/zX/hNILHhQYZ/s5HH9WBuawZTtMjGap+j7X+KB84n -6LdRd+ylx/cMmiEagUXR+2UnUeskLmTOQ3zgGLqv4Lkyss50364/wI9JeEl40G8l -/azd2no93F4pcMshuKy/9HRFDG2ODUaUUD3E4prJVyL4nLLfIoKbFn5lOn1pGaeX -b0irwaphze8FDBcPkkJy0Lwj8Yae+XsXVhOBE6yjSPapkst7bB2iZtmjvQARAQAB -tJJUdXJuS2V5IEdOVS9MaW51eCBCb29rd29ybSBNYWluIGFwdCByZXBvIChHUEcg -c2lnbmluZyBrZXkgZm9yIFR1cm5LZXkgTGludXggQm9va3dvcm0gTWFpbiBhcHQg -cmVwb3NpdG9yeSkgPHJlbGVhc2UtYm9va3dvcm0tbWFpbkB0dXJua2V5bGludXgu -b3JnPokCVAQTAQoAPhYhBKR8OUkXZSNzIlk3hx2B7/qQcueZBQJkawUuAhsDBQkl -mAYABQsJCAcDBRUKCQgLBRYDAgEAAh4BAheAAAoJEB2B7/qQcueZnw8P/RqyBCLu -pXpnGUdll9Nkz20hs2qW6ced35Or3JKe6Bn1U3bUKyRcInBkn5S+7C5rqb/jASr3 -p8Gsr0stmYAEb1MSayW2cUs2ZXS7n0OEwpyopqzxK91tv8D4NgT0hL0dlmaAtMPI -6pRez5zgOVTPzAhoZ2l4ZxR73oVCQQ3Lx2HWbr9kz9pNLSpNtkyfsg4hveGZvxxp -IDzuR33HGbqeLzP8s/OZJkFnO9qExXJjzmJy2o04D62AXrygC2NNktq9vCujpH4O -JLSAMfxEI2WfjW8GlvovCH6G6SmqthR9/uniiPH3zlxj8PEUyqHuLcCp2AKeo2bx -1b7oi2lFh4YpbRqrEr05JN87ZVQTZxp56gpyN8z7s6mkRDoiDbiZpqP/fUcOipH7 -fGPHQ5h22AgjTqys9FEg4lira8nPESCDvMKMDa+RiC9SSzf/kPJyKg3Ffm76BHnF -xWQn0NT38U+9frSFFDBu8MmdK4J1F3aiPxou4SJAozJIeezm4HsPZluHFVLwbEoJ -NuV5prpLvlw+7b3oqcFoGLC7go37UucUgRbNsNJTp/R7ZRWEqCmuf2ENXM+gF4JD -Hythyn5A75RYsxzFQJytNYp/U5zoSjc+eaGxcpraK3huPvl8kAS3af9QkxqZ8Y4t -ZZucnhGH/PbXOoviYUhPeT6c8osLi7kq5IsuuQINBGRrBS4BEACioRV1ben7gWJt -fnz/P0KEC6yD9AeeMwQAjzSvmqpqxl0kW7nwiFEHkLAtNhUh/7rLn1G4B6K77bPq -gz1p37BF0VsjDY4DEdE5ud2htBS7OCw6HobxJGrZQB8v3sztXVoHOR7ItdslUMkR -xLNAXNeMVEgt5c4UdA779H7DOmrUqEozxgd4Gnd9huMe9dAADNGGG7LRa4X3mgIm -uG/g4Q3vF5uCmna9VrmKFlweuVCx1lacFnMUjRt6708A6r8xX9zgyNdHt7ki/Des -i99ltYTIW8VYrPj+coird/n8y/Jdea3ckXIDbbDS6QgSAs+sabL6Raa8JwP6Soof -52NbzTmvHqXJ5BlC/XWm8aNH7Qb/RTdjg/12xj7cKpXwI7fEwcZBCuGBQKvC0fV4 -2Iw5ORkOemWKJhB8f/5aFXI6oLex7PEyxSvFg0+LdLpbMQyad889Sf/+Irp0If5G -fzyA/MKeUVAWqR6sqB3SpxwPRvoA8UqaQ2XnY8GPUlXkx8wO/USJyxQhHD+6rhy0 -VoCkCh39PunoY+9P6D6tOMm+zWPSQU0OyfX+12nKCInQxjKm0vdliywWy5v2M7Qy -lMBl2FjUs2TIeZw6Q+jcRWTyalfKEJR3597AfQi4kWKpJhRfu/itC/cv3k7t7D7K -QWsgkeRTrLBBsnM200UOv92mjUunWQARAQABiQRyBBgBCgAmFiEEpHw5SRdlI3Mi -WTeHHYHv+pBy55kFAmRrBS4CGwIFCSWYBgACQAkQHYHv+pBy55nBdCAEGQEKAB0W -IQSeSK0IQSk3g0JGrNDz+3oUIRVGfAUCZGsFLgAKCRDz+3oUIRVGfI1iD/wO9tWC -FTCcZ9k0bPNkmMkWFkPnX1Qprr8hfz5PAW8CSVByDi3gCLm7rSvggPo30OPmYmuA -wPVei3AO8DnaMxh2EzVaHfpCRiulSZXPfPrPKS/94ZV4zPjTXaYQ2ywdptp56/pn -XQyACYfagtpdUW2cUfYqzfGuVPoA8sldvDVVxoxlnAcTzbRKTYOVloQqRHBTd3eW -wp2vZ4LXs35P58fSYsvKwH8D5Vn6bfQOXFx7zOvMDMwRw8NuRD7Wb4KLWYADKVFR -PgdrvpZHTWrXGopjacL1M8U+70jyWP3h3DHEnYs5dfZgclDIcTr8LA5CcG/ISRW4 -eXkoXtBj2A3USzW4cNcmors5AN7MDuVxr2sSLpu8DiFl9HlUX0kyAfRgLEMmpMU7 -+RFx5X1BL6B5fK2GuKcZ0MUT2idYa+tbxRvksVpfllFwlngNHQijhqt/uo+1ltQc -zZxj0FgfxUoKFPkrM7AEAjVpEHJlFCGnr3wTgYdrYSWtIr/L/AJFNKgB4jLfXNDi -K7JnihN9VLKC/xbuBCGkVj4CsS2K+7iF32l8tpRgjbSKT7OzXedJdInhM13544gN -SGZ/STh16Z/aVZ/V1PUz+VvX1iMw4HqiOs+8SVxCmevqN1km9KpKadWKSc7HQgjE -PmK+xFBq1fTxBl3OWecL3tDljd7iJIDRL5f0O9jjEACLhCSXKyf9ZKfdLmxzvsBw -sSXBCvA7t22VEReLHmNUY8o7vB/NOm5TsTWQITZtm/6yuBc1yvK0sqVNQDD921yX -AJSvjM4zmBW0OS/PWt6m/aBqdTHx4s4ZMTVTvEDLg6xvVI7F31SVbrzzTtvl7iuX -k50E7fc43YhchoZ8DZWq6qkoXUXLd8wr5yStdsigsVLnfG2T0pLa6m6KVzff26RA -CGcKTPWxIFFTezGKWWehY7BbnI1JfQjFNi2jQhQDgBdeyFSV4+QW3/3jD1gSTAAB -P0hUZbaLcsUlxgi/DfmilcNqCvY8GFrezQnpb/F/bwiOzIis1vxDJq+1wERpxoex -ddE1q2pFwveUbiH4KRpS0djFiD2E78s4vg98pHOesyxmeUdMiwXfyz5rgLjz1Zqt -DWFxS1GOZK49ZyLA3SOldyI481p4OwrgqptEHgxBW24O5/rR7zRYBYPdNQBw1ze/ -/jCeZTgPNCp7GzkDc2+YaHfgNnZkuGFnVs4Sdahkwb1zSFa+hFgMnozshBG82tJx -kzxDsOW6r7271Gzti7NEP57M+tyetdhIleOfyFJQZyfxEPilIDjMItVqXwNDwGT6 -DyIMNG8dlj7rQ4zi+vm7wfzCZuk9Rr8pS1A+Hrm+ulOCNedGRxPwE86xT8rlRN9n -4nBir3o3PfpgajaJYk7D1w== -=KlGk ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-security.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-security.asc deleted file mode 100644 index 76c3a8d2..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-security.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBGRrA3ABEADQ8R6h5HJ9BJXm16oFyRijVlQUqMddOBv5gK797ziee6OjeFK1 -sMBVDMGKwr7+ywpexUdOl8hUuRaUk8+sah0ADizuTNOXcfryuBVJyzymY6qbZXXI -8Mo+OmHD8FmAEvaIByh9a9WrtmcgbgIFE33IzluoVrq45dfizshNunFv3doNM0/H -zeLpvlbujcUQ1pfauL7xJeUnmweEUUdFkVXjFpZOBK7ZG6x2xtZGbAJqeZ+PwYES -kkV//GfwUKELFJhZIElyVml1r+2EHVbaHEuRvpEh3Fad1QVJm/FjfkStXDQeAo64 -WkVGnOEDWLLI2YQCoz9yjHHvZ/9EWcV0FmTVFMR4lhimMb8eSjMrBjPM/fD/W90k -j0QLkdT+iCTlOJ60MQtkh7B6VvBXmXX1blabLf2igxOmteuuH0UBbP4aAls11l0j -yoNRdD+LstUr16BB3aqDwBGluXxLDErlf0GIA4LOoB90V8BXhUZ+gmJVUYTTsOFS -hHPZLuWly14SpLqDA+LjXm/hxBTwnA5RSpbIf3ei/ZehcgIbAHT8L6XDH582w5vh -diZw3upl7p6UzPgNB3NHq/dYyTtGShiJ1wtEmUi9Nn+ZyArAJKlJx0EOoTlwzrJ2 -DxpCti0cFbt5KHIzTxXTS5F3fSURWngk0Gd96ZcAIhLwi84b5JAf6PVxeQARAQAB -tJ5UdXJuS2V5IEdOVS9MaW51eCBCb29rd29ybSBTZWN1cml0eSBhcHQgcmVwbyAo -R1BHIHNpZ25pbmcga2V5IGZvciBUdXJuS2V5IExpbnV4IEJvb2t3b3JtIFNlY3Vy -aXR5IGFwdCByZXBvc2l0b3J5KSA8cmVsZWFzZS1ib29rd29ybS1zZWN1cml0eUB0 -dXJua2V5bGludXgub3JnPokCVAQTAQoAPhYhBNwAB3dbgWNoBrPLC/CZsHeyQjlu -BQJkawNwAhsDBQklmAYABQsJCAcDBRUKCQgLBRYDAgEAAh4BAheAAAoJEPCZsHey -Qjlu8CEQAMztpfG/yiG9iZFzG4kRCoPWvFCj8eP2+B5D+Wd1ESxjaOg7xcLvCd6z -4s5PaZ9Kte5GizvdrRFSMaQjmDgv1dgK1Z0WUpZn0PJgkOI5yyzuLd9NsQOMwdhY -jVAetESFCsCq3LACm/smFHHzN6cuY5ONvVy/grOWEvl8y66Cg+dD9yyti5upETV2 -yiKECRwu3svGvYAh2Mq+RPydOak2dI/PprwAiLeTioEYkSX7oOSbplPz5SU1prkW -FLeEcTJTwvg8a+WmHvfn+olntM7NPn6IEpoQHNU9CSIqyBYk5AQet8HDsOOmmgW9 -wRdEY8Geq0zPLGNw6gqlY6eYRUMj0L/fhLM94iZTW72OUt6eW8iG8pf1PeeHLM4N -MoTf1qVzsddyIKMaY7Cy21rOOSNDwFSUbuklS7XBh0ljqsfp4TxkxCOtFI9WHFGR -iYE5Jxjx5JR3+mZJ2T59V/+Wc3n5Sg/wUtdUvHfyPxLjoP0GggBSn+bqJYbK42qu -Dw0G7Gq3rh9VDeb+GVGdlC4oP2Z16D+EcPqEtkZCTimxzuQY8Echgml/Xal0x9es -hgKvmSX+DRV1iKvsZW1BQcFc+nB9UEOzbl2C3i3fc/YiUtyrN4oCPrJ5CtWsdg7i -EMeZedxWRF7hqH8+YDa+JDsKkVpgdFMIDyB7/rRu7a4juwYlhV04uQINBGRrA3AB -EACwu6Pj3hlPRIZBLrCdH8xoUNirYWmJfpB2bbILv8IPeL/GFnVfu4k9/c/ZeHFq -+bs9Aa9wIYPeHBNy1NOS/lnOPfZ66hDZfF2ULYdzhQov1K9iKqxbE79/C1LJqfQ6 -bJjl3iKMOAQffhdldAeXawLJUGOi9tX8wByRB55y8AJwTXNSDQA2oDhsJoJ6+Muz -fYKTigSyiuREqflybIXJ6QnAYgf76FXvyC0PiLl1f3VDPSu1dYQbgVC/NsAuYT/7 -7eckzrRZnR+DqibeGVtNSSsXjM346AoilMLKvQDxz7SQ0BPYHRatiop8iCUtd8ep -GPRI+mo6yhd42ItixhtbYahz2esFO2JrAeZaeROUA25vVLLWUD7aL3cTk3ebLZzm -jws5eYOr7CR3PiCTKPTFhyRGyGWWoOljt7GKBdT91uYhua6mA/toKM6trwhkcqqd -oYYmrqJ+ncgz4V0ba3J1DfpHpL9STRFV/wsT42+j/CqQXvroiGimQfkMKMxbhpEc -PJXAaIDqDxhK4obHp5DtLCgOUb/nJfxxp4yG67vX+udBKVUMNPubXtdfoX8pizci -8WPx1fHk1RJTgdd/Xy7gQt80M3XVlupeKE61jPBWCUayw5VpZbAHCn7Y8IyvXKwS -8PltTgL+gSwdHWY0rmwQFV+y1fuQOUI58sdrLzpTTL53XwARAQABiQRyBBgBCgAm -FiEE3AAHd1uBY2gGs8sL8Jmwd7JCOW4FAmRrA3ACGwIFCSWYBgACQAkQ8Jmwd7JC -OW7BdCAEGQEKAB0WIQRwCdJi/L+rGlaNt3H8tLlFz8W+EAUCZGsDcAAKCRD8tLlF -z8W+EAwAD/9012OIgbpWzNya0zixaG4yhRXe383vp/d2hFs2ehzO1nA+0bs/nG34 -Vy1coZf63yckR3mG4+plDAnZl0MMqbaCS0gEaQjOFNAq1r+yldB3C/zdGo7kPN5T -gRyjDd6ORLpwW8Kz4ux9SXhb0uh32NrSrrabzi5YEFN9NUbrEOwtXguTK98P/Wvf -mOKtnqW0zW5hTaqHmlsjR9FZxkqIEijTZq36p57GgQpScvpM1cRjlatuWevbtJg2 -Tk2+PIcOvjxIrrcIaD59ErsU/KG6htTDE5FXd2SnqnwtuoDLqOg0sW95u5TbCAhg -C1zyLWpH8JnbdjEExX0Q4Y4GgV6d6Ctr/gP8lPXtsa/qDoJV/lun7D0yJGf8YfgS -9STo29aMj1fxjRQ1G7g8GcuD7I8twcbONGIpgjc18vNX2ckKazvTnvN7Fvfa2qBG -tutXJMsmJv7er3wcC8OhKS9+HSyy2I+ULvEzwCTw+D7woNd29LHgMuDeTlVtB5Ty -0PvosIUDFgYf5LRc16MNAhbqCbGMP3wbVfJ9uVDXHr2ucPQiNc5KwJzcpMmtNc83 -gzh4oinmNp+Jm5BozNS9S1+cHr1Ji8ji0KEi2hAuyxSkgDEQzzfqWgK/dCc5BS/I -FEI8czeaUeQ52Qw5IcN5ZpmE7/HtFTTOtrVAT6p8ZADIhX0/07X3UUSTD/4wXdFB -gOGOVWzJrdH28yIF4OMsDOgWTwB79mk4emM4s7sgllAd2GPrL2F1JqLBHYtotTo5 -Pqrv8b8eb8uvfkKnBEHF+EV84JanNNM4UdcUfscuGSRI7un8Rmopqj38yTFZuMlX -RmNdekPeyqYgYHWQb5laJzOVIi0Up9W/nkeYag6jGVozxTk8tUR20rNaOf7d5YjL -nFA39/Gjcu5819f8ZFT8xuY4/6YE0sDqDcyfpPRpVGUlKmTyrHT1PzCbr0yXLs1W -URp7zJ9TbN6O1xqg09LnXCnJakC3Iru1yy1I7z/FcmzQCLIBFfssDmGH/KuSJ+db -O14C+PG5naxxMp7CtisQCKaoS/olMzTHT7YUu+DTrwH+zV3YENDM/QZrkqtDWKhV -MP+9/koiADODekhREHSVs3R3pxHUT9d64KXSt13ktffZeE4wj+tYXq7A0Jl/NlQA -bv8tuoqUgO//7ua5/hAN9I1VITK0rfju8Ghvqg4jtGjIld7zGa5eRjwxZdZPzF9l -0UZgLn64NrdmBnKyNw3iHZ1tcWEmXDcYEJQbSHVmjVuix4woUgxsESAbHKE4cXrf -hKk8RGhIgefe6/jOAtVtJz3LqVtbbffpFZQm9gEuCktTedU23U0nUURiWf5wUqMD -aUJcQlFzp+mL2gJI+Hw1V9031OzpSprun7t//Q== -=vY1R ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-testing.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-testing.asc deleted file mode 100644 index 1d1f7ace..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bookworm-testing.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBGRrBaIBEAC++PxnGs8aUl77Hg7t82wm9U6szyfHknCcaCyFeBVXtkwfS41+ -jPof7KjzyBAR7iWiRaVtxd7mtmS+8ICAJGCCmckURZdpI0mduTCLi/y5OvL3qut7 -vBCwR0+VR3SJrWJ38CjiMpy/pD3oPoWYgl34zBBHSNOzVFYSzLBReHRuaoNUrW8P -9+S5M/CNmRr4J+/JW/dC0i/vvceYdN5k4LRhbQvrYkrQ23/8gQrNRJPS2T4I+fTJ -MaosluhbzlHs4Z8F3mPES1KbirT3xgDfRA+Vf+7ow2qv6LpkujHvpjXyXWF760aX -7M0v/H9A0jq8evDNbdzN6g02Htfo8s6s3iU9ut26am28dntyOD4wYJzvHgWNrlYy -7CYhBCMvPz9NOxSraIGwPUM/PQFIMH/149O51yvdn0Wc1YwLw08WXFvohoPUUq1b -W283zdMUDXkyLlOOM1zHjgBsWrDjs7ACAknGS7DYoOJWdSbpzNlym+Ed6GD2j1sa -Yp4jUdMIkGJEskCp0CDWK1AMsC5Pz2g0NoxSXRMBA4JwSEIqdIkU7LiZvdsUf5mH -15UptTW/ffctsxEABq5iBxwTn9ybd/IUdRrqsY3ZHsyYXWkJ8+GA+KrvO8+AeLiW -VPPos4HmZ5v3Xs4RVyWpWPhHlgO4eqW+Bs0gH675sqXwSX+k7CPaD0wOlwARAQAB -tJtUdXJuS2V5IEdOVS9MaW51eCBCb29rd29ybSBUZXN0aW5nIGFwdCByZXBvIChH -UEcgc2lnbmluZyBrZXkgZm9yIFR1cm5LZXkgTGludXggQm9va3dvcm0gVGVzdGlu -ZyBhcHQgcmVwb3NpdG9yeSkgPHJlbGVhc2UtYm9va3dvcm0tdGVzdGluZ0B0dXJu -a2V5bGludXgub3JnPokCVAQTAQoAPhYhBNAg6wg7aOyw6tnEuME4HCcPCS2SBQJk -awWiAhsDBQklmAYABQsJCAcDBRUKCQgLBRYDAgEAAh4BAheAAAoJEME4HCcPCS2S -TcwP/iD4EbmVh6xbOGdBsoZKl6BCJam0C5fhRYIDBE+/HmOtbw0uxyFQ+lH9Fvjh -t0HC13Y0xr0PDpasOG+mceKJvRT/oxsuRCjG84faKEYSJkMQ3z4PkAtr5XhECYiY -5Gmw0P7x22y0A0f28BfmK2LRmSuC5HuUDhiQWoPJMTvilPLv11bylH3ph6EnXn8W -VACoy8GEDfKkXpw/qisRijpPIjM0kbp2gHWqOhyDDgUA5+aTk4uoxVnyyx4mLGXF -mBF1oRvJuG+ZCpJCCQrOj7HJGYeMh/vwWU242ZKOsEIA6zS6pupQWiKreRuVm1FM -o5FHSjRCMEh0SA43H+GH9DW3iV0VBEfzjMcJ8ePFxfF1leqIRdJ0YbpXh3KQiWy0 -fkhuJmxz3JZmq5ymq1eqpgYmafV3u1+CFTc8XrZ4fSDYUSqglVYgbsO4ZcTL3Q1i -mrdHL+cJHJ9s2EEl6YBc5fjUI/Jg1j8Pa8PcGWROYDcfmtHUor6p/FqcHxGzEr/s -HjP3hUb+EJUtOm+czTYGg6MA8O4Q/6IPHZsWVCDm9IfTi0Ikj1u3F0g3eMzpZEzb -tbi0jD30sYp9K4SvD5GssjBfOF/I1rMXB5aXv56t5WciJOSez4eW4HjWLlDKme7E -7gzY9CcU7Sfcrvi0h7CwZE0EQ5QiPpUZYIvT7hk5kzzp7AOtuQINBGRrBaIBEAC4 -iOwWGejwJFS1GS3okMevLFXvhhtWdm3jf1iEh542gbvapxFQnSChjwmcI7f4MB99 -gRIDOzX2sdI+AfN4iNEOmrwwan1TagBQZfHEcxkqpMiLSPtZt3r22nZsxgdneZAX -MuNd6WJDNSsDufGZ73ru3NolVzslMny+ra2smdbap+mXbU8JxcxGjZiSLSjLLQOS -AIAsYnKB78aANt/kjYzDRfphwhGiGA+r8rKp3QZP4g/V4QYx0HQHzRxEuFUWwA5K -y+BuXExJZRS877b/gTa2GLZyy0mDIeSOc7FekGyLKgF3AVjxu7U1Tpm51y3nYUiv -cBELfr+aViEz6DcjZzw0u+pOXWPKK+znxc3BKWf7/HOS7FwgLy8M6CDEh6QWD5mo -sHmgXr2fs2a/oFz+cyxhuIWGlj05TsqD7cjba61tybAnH7GWAiohGO0SO9eHFguc -42FGRkxjmFTlnYWnWzt32Hv9s4vrsi12qpH6/Hse2Tv64xxxEEpI5DAb6kfVWnaR -LhiXTqlSksEp8/zPpRkxUEZpF/0iI610+EFO2573I/nV1ioIpPc5y3fCMZm+8B6P -PbTdZ2JMQN1EBLCof/hFgbNEepVp7IYcKtUOpEmaGZ7k6/jQrc8VtKlPkZx8ufKc -6WkjCYlpZXtQ4nLbkohb5VWihuKNnomNWX0/DQ6bDwARAQABiQRyBBgBCgAmFiEE -0CDrCDto7LDq2cS4wTgcJw8JLZIFAmRrBaICGwIFCSWYBgACQAkQwTgcJw8JLZLB -dCAEGQEKAB0WIQQDOkmWFXdpuHcpxEYMIxd1GqXXYAUCZGsFogAKCRAMIxd1GqXX -YIDKEACyw/E1PlSgP+yU7RrAbR3Oo9k5aa3WtkgCuH1wdNBs4O0iQFwNAf3DxMdh -7EwP1rY80RyGMumcgUK3hSbbK3Evv5zjrRR67hyxeBqNM28ae3JfYo8dzJUwirxk -x9WsXGO70b2coNt4FSAK9lZbYIzSUVncHS1xiwKAGBXyhBLJWoly5oyyrYAuZuTS -W6i1uI3bS1JW86tjVbQ8zn6kB3JOBoVGJKUkjb5K4c2RZims3dDffrSE+StErWbs -zzMKUnfhooiE8yfVP8kSSoJgcRGvt+d/F99ktF0ddli9kjR5BBnzmNaIxavqxpUz -VY+iJNujPMtdSWI2cUkcUHYfeaK1t/RbSzbF/R0Gh0Nb6jPmFmzh+0hgi2AzAi/J -nrwVe4xip9ZyVq4j9vOu7Oio78s54CZbdxK2D9Dv22cjyGmZGj0v/JSJf8EASAN3 -VswA2My8Peila3hjHa68EZQDnXaiQ+T7AG/tENed2vFhanWdsiJ3Ak0VWOWOmo/c -1iDRMEWgwtDQuG5TmBRfyn0zquuKjbhUQ4WZX6LNllN3FCn/wsl1W3sFQvKOi/HH -QIP+DUBe/vS0iTTKDxvSby2bnrOQnsBSFu7n9uc5BfOMm+73QP3Oy+Uropexq/bX -iLnzf0l1mzCQt4F9PaL9rJdEt8KnzJ/vGXPy+7PYZ5fAaxa5eJV2D/9M0l1oK879 -rGf7a/Px1/31ItKmnWJM8CBOpD0650gUaUoWQa4Y6EqmfkWjyPYaZHuV6BKYatvg -m3gYm6ZVJ4L4b40V/gLTYfIylhW2AVbOiYex55hdO3Ju27D5Km41U4oeTnteWJes -wxPyBmQxloHZwnJT/dvLHyg4/sIXJJNYjdRULbxyqd8JqcX8AkFTIqgf4WT5UoiE -o3isFKEAuRu/fzz87ie9BraOrq7E5KJ8s5u9lrjUO2vqrhjX/Hm92G9oRphiwp0H -9beYIXxLllBSwyLy8lrr4gODHU71ieW4YgRnzU0ttYshASEY0comMyWflXYoCO1+ -uStWbQgQ4BL7x8/jr1+k/rN0s1W/6wiVImidCafLEDsjoaVy4gtyYcatyfSbZESI -DPTUtvycibeWo9zW1Z6pfeLSaP+wIxtAr5pE4DQLisNq2QRfXpHmP6k2cMwcwl0H -Q6koz7K0OblJ6VzTTJl/NhndTuGiirPv6ydy371N1Qp6qrVr09FeipeO6418w9DY -KDUd4fhn4iHvBV90KQ3rSiywOYpk6yJjKyIwtIefHAhJ9psk06TDtZHMqSzun2hX -4iUnbIUE77eKMmyXYZprYP/0/or4bnxpDO1ugENU2LDPPVwRg6mBSXoZoL4LiUhu -X9JKbg1K4D7HD+fn4T7oFYzRpoX/BT/rGA== -=37Q6 ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-main.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-main.asc deleted file mode 100644 index 6982fb10..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-main.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBGEKew4BEADhXIcvTzznjS6YFUgJ4WLWE+yfDMajw3ayIQy+31BMb3rTi6dQ -4bCFvHt5Jm+u38nWeeGIHVWpTVN76hbcNnYK76+otNk73GDadKhAO6gT0l1SY/79 -O8mVOTwIHGqNf8nbzYKD+Nrctk/tAbL96a2j9nuEh3jP7i2eD90LXEN507622+3J -kdcMLemwzfTK+KJynNZrcR5clCiufck36aCwrHWZrekiCjD2r8LgFW8lxtaGuV3R -xfwyD8bYsZglu5PEO0ItE5tsFt6m8MsI23apnQIZ36jQuLQxX1eXYuMLMnSLK6xI -BeI20zt9GZ5jyhDWogPD4Cv1qyxQqONQMLsRGmAmMBjAtcIGGD3mYm5KexzN6g0W -OA3eg0BYUlBslP0C8i6YHF/6sU4DnTZGsAHuEnW7a/05fnX+kLhec3rHuoDEtvLc -5Sg23PqE2JAeZ9c9A7bOOEoQDAvuZjAPBoWqkIc16sJo+HKauhUDg6w7wgMUhk8Y -EqBUsyXwAGni3NRDtO1X5UzWIVeJy3dnXV7qRKt4mQ6G1NZiiXlSQD9kjhBMBnsR -QQlcf73XeHh87zLwmb5aU5pJvn3kvkp0U+vbAViU10qbeSMLdjr6G3cJc289rDr/ -HAnO2iX5miRRHoRllLtcvSgEuIWboIWjiIVGAS193eFJD/s+hjcuyS8zJQARAQAB -tJJUdXJuS2V5IEdOVS9MaW51eCBCdWxsc2V5ZSBNYWluIGFwdCByZXBvIChHUEcg -c2lnbmluZyBrZXkgZm9yIFR1cm5LZXkgTGludXggQnVsbHNleWUgTWFpbiBhcHQg -cmVwb3NpdG9yeSkgPHJlbGVhc2UtYnVsbHNleWUtbWFpbkB0dXJua2V5bGludXgu -b3JnPokCVAQTAQoAPhYhBE1JAmC8tUEVgxg0y4MQ+1kkTtb6BQJhCnsOAhsDBQkl -mAYABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEIMQ+1kkTtb6LG0P/jVzE3n9 -2RRgtxry3LFyFtIVJ82lUbEn0wmnbRK2xmMo3jXXjsXU3yY85p8LRtWFKdJrIgSF -JNIUZsSF6gdPGTtn4dlAxvKms8alexlrs6t+ilwywxhUYZMXOGB0hLytx9oHcrAj -zPqXj81ulOFyafEAvvELmY7pSRioEyv36fxJ7ByH6r5YGG9mUhtN9Lca4zR12jAc -GMX849CybpGovLW58KZUAm6EitCadyxgdN/TFlFRAx4gThRjaEpknaZYgACsvRU1 -KC+C1bXA1L3x9Tku0IpvlCv2SE7+jFGTyx3fNjFYBufE/aagbVmiWMAR7F67uGwP -cm4qAxWNQ/b0PKjVEI8eGmQmee4SwImZ1pQ7qRmBiCVByuKke5Y2TTpxYEA2FsaL -xmZwmoyxyjFivBj9/22R1rsJ9XVxNKW8enclSg2YHpcAzItnTK2nwVRTWmQ3X454 -6QfJv8PHqlP9w3oh9NLy9adCPKlE1rXzGQeaTqi0ZU/HOroHV/c46YZR8hz8rq02 -sjebHnSQY+nuKX7WylP3ZwDI5/vs5iZX3xGxAIy5G08fHCUnuXtAHEyLauVw489h -776KgEdIyIRB70+KG1Mz4yd6ZsFaQZ43SmhacdI04iuJlU5mO9cyvXDh/7/UAYF1 -o9GPb/2tTqgkA8kogUHWbLcwSCYDxOspIyFTuQINBGEKew4BEAC+nzUvvD6nTEMg -LDyXBuWVKNS9z7zsDzAcpNSuae8+VrcHQ2HCn0EYNET/HOdBdhxgQZ5CXO8hxunU -aW5Le1M/nXU9/rmHS2fADZyOWPgUN0eW2+MWm0PjP3R7fTL/OI6+7Iu01Bn0JYlh -9Gt+S2fC6nEw47sK2WgGIkeFsZ3NLllh8sOrvyAl1rGIaeMEAaxVtq1KdKy9DaQL -cCGTu1DBqr5bmJCLsP9Tlcvmp5Gmq86+q2l2RkJJf1AaBb8Tmd77keaUnQSAIisq -8z+jDCPBFfRXLUl7pNLVgv+PGBniXz6O2GA4rBlnhhjsfwXNRz1gQmyWkyfOeujz -gc1oL9KMw72LVWfA2CftLreFHala2KxJcv3adofTJqwJtTmQonEuxks3FWpYH1N9 -kHOz9+qX3tXc9uFcMyMp6kB/juI15+8FVqRehbMa0Cn7QMVbrrzNpNxE25NeUOFh -bjez/2vymO0Edt9561Ovnu0qAcI1aVko6RbqWqtSMHzmtcGckq+6H3TdRh2fOBQX -M7FAa4cFcof2gEqa9Cs4oGR8KK4FapszGzkm+oMaGyLrGArvQIHzQaCUe+oqC5+n -DLOpnmOZLCQVIAw3ZGzSepwYnB58K4VIbNaIZAb5qXxuNXgrteLD3stKWDUd5c00 -4FDf+XLhFT4pCr0KTeSvaDX5pnvigwARAQABiQRyBBgBCgAmFiEETUkCYLy1QRWD -GDTLgxD7WSRO1voFAmEKew4CGwIFCSWYBgACQAkQgxD7WSRO1vrBdCAEGQEKAB0W -IQRrqA2rqOhA8WnDKd8GMg1sulf2DAUCYQp7DgAKCRAGMg1sulf2DKLDD/46kSu0 -M6/QDANLQCWWfGzj/IPHcOALiUmrEBCVQUf2d8KoOXHx0cXLnOX2QicC6iya5LCy -wuT2CZkq+auBsngOgg0lE29YeLRjSCY0NwFJnJ0lemCD9Qa80v/1sKnzaHXr2o9x -I5nwqpQMQ15VKdLJuwCMFR/KBRIz2l2xuXy3HEhZt7VDsNvrMDImkyG7vGAGEGyc -9hJw657ak4WhwxzYoLzweLSkHWqDfWp3LWKvYp0B0EHtrCnqVesRW5zz3adtCwZ1 -MVdPcn5o0jPX5TP9hzZ/LPSwdcdxS6qKWY0xZnPiy8yKPOk4OoVveUR3JTH5Y/vh -vlcspIMgACeSRavVVyS/bLfuhEUGrzuJM8tlYl8R+EpXczhWuqxUWa1b4H8XWPmm -JSSM4xLwOQsHtAM22iAWUFUFsaawp5jJJ4fbfg9LFNe2/Y2Ti73qdryMjLgaWCzX -keZrsqZP3sTOPoLqsOGptosqntVImYc8UA7LM94EooH5DzKBlQuAIWjmaF7+H99A -BvgxEgkYkUJWGdXSR60pc902fxIMYYB5YjPqOmRZFtpsiifPuI7/Jl8YNAzM/gsO -m9FoEMiTpiCFNuK6jB94UcLN8C9ArKfMnosXRHiElNxYJxRNo+ZXplUsw0iVEOj/ -dC9WeYdQuNiic8LgW1Zd44PeaQj6vg2wOh42hvQGEACYL/5934gYpwHSCtABnip8 -CWK6yktTanQ25T/Hb7aviyi6XcNx1FqdFZ7iCCqNgDl1vp6dRM3UB8ly5hW4p8Gj -mZb8xDbAwdIC52j69d8cbsE/ORFDvwvea7p0XA0ctO0PxojEpXUNBUF0oZXkK14t -71XT7l9BYHInMbWABRpBJh/DrP0XVX5MuSfOep+ntX0HZHCLXTYlJD6tC+jVHNIn -ck5LO1auNpb+CDFSdfxkNOnxm+kK5fe+dCVetqub0wf0LAse1QYHK0wb7MIhmDw6 -lndQ0qAJjAQMM54oqf7vR0/YFnAZmQjk1WUxtZFzdzSAEpynCw6IF3KF4zQndr0d -jZvYr+25bQoUYvwDgbgJnFR+PTv+VseVgoo2OD2ejmGrMcQFVXbXzVNhxpxqLTMu -tLmHkZ4xmnEYHta93zBkli2GmuZkFrNAn63lRli/ieQwrKWf/PSSEYApajusd4EI -JhfzQBRbihfYHjR6K3aZf8e4koMGnI429+sXmZLgePaDcJ3GQMq/QE00VE/Pme0a -q9qer+de5EdBAwzigcm4pwgmdLZ96gxU/cPSS2MK0J9QeHzCgff0F5LUrnra++Ny -Pm5OC5dGP74xSoncMUA26HlEWOO0tzLsXHbQPTPSkI/8/2RtMI6q4TKCGr4ZaHnz -vwm9eBMADprFPAZQSe03nQ== -=/zdB ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-security.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-security.asc deleted file mode 100644 index 46b476e9..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-security.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBGEKfgMBEAC9KZT2nNW4Fx/G8khE4ICiubJ2wnvNd1C9iEsMVJHmPApv1Fm7 -TSuT/lGRcCgcfq9Z8tv3D3oS2nqV0bacwNK15K5G9Jq/hCShIm8uiMRasQ/DJZqE -+Srrzo/gKTXjiA/L3RqLrRK7NWxX7lxkvAH4PGbEGcOoNn5czKxqfvDTfTZ6Rj6B -6OGGqn5O1dJjT5u/J4IyGDG1nE2xXiSFq5hV7J0KiEZ14fjXr/pPD0h4Yusx0tsb -DOxdhc1DWzcZ+dpMlgYKEmoV8lkeFo7LyDIEOxtEeRfXk9kmrQKOAT7b+I0p1GGA -e/HEaw8C/HAIARV7GdTEB8hH24p7otalnmBMec6dbRCmZA8J+exyV50ie7kzbOQp -zbaRD3njnRMbrbAsA6RYKnAFe6+wVzKeyDOsbY/dVQx9uRzu64nbnPGKEhXCVW2m -Km/yd6Eq9mDo9oDpODui0eL2k+gVp1lc7301vK2atGSE1v+dZ5yv+JU6no7APQ8j -7dPOcKBU+KC/I6Ts11ull89EsysNL1O7mTa3BtKYPn1MIJbpwh4X322gY27Wef2v -PdyAB3SCGSewy6nV7WgDa7VgXiYDkqHqzb+BI7kFsl4RIjp4DxP7oqHxaS9Xh1y3 -oK4X7q0QWaXTQM8lVA6GIXxfrSg/0Y5neF0dRICj/fjiYWK5oJvT+FKkSQARAQAB -tJ5UdXJuS2V5IEdOVS9MaW51eCBCdWxsc2V5ZSBTZWN1cml0eSBhcHQgcmVwbyAo -R1BHIHNpZ25pbmcga2V5IGZvciBUdXJuS2V5IExpbnV4IEJ1bGxzZXllIFNlY3Vy -aXR5IGFwdCByZXBvc2l0b3J5KSA8cmVsZWFzZS1idWxsc2V5ZS1zZWN1cml0eUB0 -dXJua2V5bGludXgub3JnPokCVAQTAQoAPhYhBAunCZGPSKtsb3TvZxi3u3DGjrD8 -BQJhCn4DAhsDBQklmAYABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEBi3u3DG -jrD8i9gP/0ae+DD5a/D99lv1GMJlWOvcsr2zjbHTaWSOWPMO1dssI68n5NC797kD -Nn/DbKqTrNzFHkqc6m3lMZHTk2+g2xnzXhjTp7JM5J/0EioAAIM+hFPEg4us8vCn -lJUhONgtgl6h7TTMFzR44ReN3JRyyB83SJ0haKpf2HxO8T6ABzPxbrK8D3xFo5L9 -o9XPjD09qBb9UGQqw81MaqZRVpTbBaxHYk+jUTjrF/8JmL5Hr4QnJYk3ezsgvr0A -Ver8IyFbptQ+LlpHOVqwtS682Kmq//de2WqK6SpJYLk9H8ovrkhjit2PgBDM7p6z -FJJxNYxWLLGJysmj1lzPYxJy2DnTuWrF935TrziyjyuByo/AnFBDawLShdTcTAWV -rO07ItjdcLhO7M0k00xchIu3DpOvey5dcjaxoA9PdWHov5qSEzpRtE5srvF3yGMj -VOozoZwWt4vHQlCl6oAG2OUYilqOB9Q32W+4T3q6fVDKxgLwBn4ZtjRQoLhUFc0s -+rsMNsgw1tDiQJXvbQ78ySsGNlEeS6K/OM1+/Ep7xYVp9aENrqq6EwYLqPGCmT8E -C+13H05yf76h8IRmfqmzokcVWg9stTCK3MhZj36cO0Ay44XGkp4ak3BhzoBy9G2V -hLx79MvXFQHYqVBF8o/cS+sHsPLEaZqRyw7ToUCY/VjhI7nDYSS4uQINBGEKfgMB -EACmVLezISyEkgt/LbUxXvM9YJzloePs/6qjmCdPPl/+DjWPXOtOqKWFvOQV7Pff -lh+DcvSDTHhkE0fA1rODGYDjOpIeFqNCx34tiV2o3gsvbhQdnK7ABjQ4Qk466QE6 -U7i6UX3R3KbGfdlT88mXJJM6sqHFQLhMiKZM0oohqwbZTfUEV1sGIR7B/qefL/Bf -sSspamXiMzSUJ2jWN7f+CqRUy3NKF3lqFIIpJvlZW3l0tTqyDzyUaiDfkziplSzN -RdHb51neHRPGQZFsxY5kgw4JTHn2igCNjmHqMZDtG/BnlZswk6y92v34oqUR3jFQ -1BEcaQt1LB4xVx1lSMIwCy01Oa3+3cIOA3sURccYvZs2KiaGcD7R0jUWgDf1/Mno -cIXp5sCrcFJksQq8rdnZ9V0eNXsjQB5YU+NiVkS+IPUgcZyypFrnPZQmZMhY5I5A -zI9ukr6/VYIUK/anEG+zr4XWji1X6Wx69XGY/6Mzt1j7epqld7fH4o0c4AJmWY0/ -yeV0bgtNDUGokq7coto47TiKAhnh08KI/ZMmv+87asdLuDwhZaoLYYb4qxmPlmIU -gtDMfS11xkwgYlneFDZb+EhHAf4WAnSJkllJdRtQzKRRdhtmPM0BLVrSi8jFaAYf -ITgeU9VhTd+fsYX7LFReBURr6mxGVoT+HO+qDSz4DrCr0QARAQABiQRyBBgBCgAm -FiEEC6cJkY9Iq2xvdO9nGLe7cMaOsPwFAmEKfgMCGwIFCSWYBgACQAkQGLe7cMaO -sPzBdCAEGQEKAB0WIQQfKcGXz0s0r35xd1/72KALvMQ9RwUCYQp+AwAKCRD72KAL -vMQ9R681D/oC7AoRGy6J8FIHRQ3ELkeCB15nXy3qzQN9VDfgdDsiLy7zc33Z6pBN -a5ZXH7OyMvQAKQp3zf9q00QpzO39sqlBRWWWhe2dTrCgXjoboSgK+AMmkvIcVknR -GBk2ClHWR1ljzXWbOs/iV2oQqEmJqBRvceCpuQKWtL9ax9/ufSnObZatcJyux4qQ -D8PrTSbbdblEpse+jxDsN8VETkHBtqQWngSIojFeN03FQxiuU9sQmS8axxEk21EJ -X216tlyFIyfCTi7rBGAjXV8KKKfyWyP8fk2Kf8dasmUngErwqZUGrajHpOSoeUvS -FQZuu+ABFiBYH6S5owaG0zeGO8H3+JxfnehB5S9OynBzPcOWXTk64StbP8T8zY5j -oXsMBlxEnbZ7UozQckI0NS3aK0axE9p1ajR1DjjzQTcI7s8IGEbybMHb8t/oYz3O -ORj7MIGEBU6hwNy6qMF8d9dWN05yQFfrOJqFEaVk7ti9gdyyi1eIEgSKFnM7UBr0 -u9ins6R/RrNOnJ9EibodiW4AXdZ+g3b6Anftgf9RGjWPF2XL9rOLQNT2zTKgANYq -nvXn5bYvs3H1XSsEmWpf2uNOyNbGX87yCthKpRcQHDWimNZ2+zh+ag8qigzE4hQc -RLLQUAF49Kj9g5E48DzYsAxw8AypRtyACiPrAHWCw2ySvk9L84qycUd4D/4hTDhx -8QHT9AJnJ67Cie/d4SoVY1FJRo5FMhPrINtpRxEOYVZlXgLre9rb+1CEN0DhE+QG -gMkExSMzi6v9KBtzmt0cCnWtouYLeL4g+DCTtn2ioVpXQrsF+6o2rdlGJEuslOyZ -NIv9c6VGgFkNedgLM8vv9Rz3STENC8l+mTvvFEiDvNYDmltlB57WsivunyINLrUF -RCJQGAHtV6JREWLeUPRfa11y14kAgriZ2esfTMthagBNB5WanJgT+Ab7pqjORAQ0 -btCVzdgZyDs6poC1S4BgARHUkkB3GZcg6K59oVcVutdoIgS4NCu0mAToeqnJFhD9 -mnqN527S1U7Mf13ESb6un/Ahcz/rQ+NT1dtgIgjOnMK9VKKVSPWmy477A4awZOYR -mvXgX1pjp+7BcnXcAnoqFGudU8pcyv7YN7Vh3IPKh0UJuQKnPLZBhPSgoMEFE7DO -ZnTVkYVwJqln9oEsvl1JYq8rwi/NyrpZfo2HoYleQ8GKLceq08mrYeN9pHV6kkY+ -7ydV5yrc7Aew1M9Y4bnzWchBow6QoAt9Whxuoph82mlrEH8gnIIoyWc0RTGROszi -k6tnt9O+iyyj8W6qp7n0uNR+nMD79Rk7LeHmbr7tNiwfBScQ+5t+Fyt9phpuAjE3 -TrVHK57qIIiF9f4L9UJNBbcCVKPsGdCOhoqcaA== -=p2Hq ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-testing.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-testing.asc deleted file mode 100644 index e49b0528..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-bullseye-testing.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBGEKg+YBEACypldELMX938IS4hMMQrGSW8QOSCu/EPlOhor6ur4OjYvQDYgg -C/KjzezgajZKpSgfmCENrv2n/b7+jOh0lvVrXErsWjt2FE/l1p7VlMdRE1EG56pL -y4iWkEeISRwjck5woXC8RF2vchjzOW1F5/9rgIUUGfIcS9iTuCM8OvoU4Srk4dkq -QgS1QQgwieQyVmv3sdAZEPBEMc4PZVqIR81CYfvj2Yq6xVI5D+7W8klMilWFHHY+ -Uqp3BuZdPsTSSrdYS9JSUtIiAMSz5HHKs2mhde4bFwt0xYt/yfxzyLiFjB0wilad -x34Zt7EUOd/TFUf7gNCt7wwtgJc++aMboEA9MIrfWm2ugo8Mab9iXa7sRj5DtV9y -8GEGFa3a/Aktfk8nh9QwR/3RqhF/P1mYfi+ocrkUAg187kc4USZruYa17b6uCE4r -Am/erKVyBtDQ/1sHCNcyp9iavL6L1Rgj3LlTBzaCJpBva3ESV2GWsmMvsxoOnnwN -OqRxi3qZTnr2LjwsPt1bTYXiV4qPzw7+6qpK2VtFZ1UlV6KlhWMhOpSK8xGScYD1 -rZC+ANIj/+Do5d/7NyDmrbR5Jv3ZRP4Mn0uC8TrQ45sPfClcNIHZcxgIT8tj9KwD -JTU4A6bpfrc0RzFmITb5ERXXa2B1KuXWbjiCvP95/h+bXUxMZxhpSq9IzwARAQAB -tJtUdXJuS2V5IEdOVS9MaW51eCBCdWxsc2V5ZSBUZXN0aW5nIGFwdCByZXBvIChH -UEcgc2lnbmluZyBrZXkgZm9yIFR1cm5LZXkgTGludXggQnVsbHNleWUgVGVzdGlu -ZyBhcHQgcmVwb3NpdG9yeSkgPHJlbGVhc2UtYnVsbHNleWUtdGVzdGluZ0B0dXJu -a2V5bGludXgub3JnPokCVAQTAQoAPhYhBPMYq96Tdj+O9KblDU2KDmULpnjcBQJh -CoPmAhsDBQklmAYABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEE2KDmULpnjc -EF4P/ReuRtNUl+rWAlW9zbKN4En+2dpxiP8WaSbm0IY9Kxev9UpPASrSyw4pnxa7 -ZuA+Se6vCxTTw2anU0zvFFM/+0Jo3uJSqo8Rt/tb2lclRNWJxYVAm0S3PWfpVE+7 -MyvPVCMD8b6LcNDlkT0u8CKrQznNvXNOZXfZer+twk+cXCe9JT7pLVB39b/wjDgm -AmoICBswVMPQqXTmwjhmhAMJPXF/juXID/X43ldsJkYLrXbY7d4XCiCOXyZ2gpSJ -Ylybe7A6dQm26lG3AygE+b8lpfpfs4oiY21H5Y+h/IYyECy71bAmm1WX2qOaBOLv -WYNh5lLjIieGp7Z+n4FI+JS0wRwX2qVTWeKSUAaO/W9MGaavS18ikQZigMVFmy83 -pfpOTsIj4NzLWLmSDPM6314dmpj4tjg/0kHqqotcmJ/MWDSyMq1FeSgrXiv7il/8 -9zrX4duKgyrsa80oDnDTvEwPdKz5k6I4Bb4JoCzIFx674wwaSw095x/0kH+denVd -/F4U3hRA5NQsNwA/ktJklCucU61ey63ZanxA9C7ZXfSYt0oVea94DwhR2Ch2qr9u -oZPTaVKc0oQEHfTgzPBASrP1bKM7lAbMEwrG84ozwh8lELGdo/uhEOLsdlz6nJni -waFcGPxto6ESTO3pObVWmcn9b+vjIPt8dS/pNMm87MhR9plluQINBGEKg+YBEAC4 -FR2rO6v3UWXRIedkHMQZC0SSgBYocMEhRgySY6shk9KVycqJUoKFp5+A5OYVrn0V -Tz+YziU7qXi3bcrD/+NGrX8DeEEW4GtXKWlxAylwdz85Y1y1I3Jiq99D50tf945b -UxG3usQzD69PFwNqQtAx64NnShXpqLmjkHINMMTz3TMkVkwqI3rzvyqbGGrGzL6M -//PklxQRCeFwKGIb0XPp3+lw9lOzdvlZlf/M+2dpQZx4gg7Ub3UzTfxrArh/bmaY -Vm6BLEevYFwLz14WHR1fadmOaRL3v6swgF+S+zoMGx43DFHKb+k61U+Ukye2ENlK -QfLD8U8CFIsQEkVK0tHPOL5NNntsbHfao5iHVi7Yblmm93hw/A4HFErctqH4BFdr -iNw62ec7htwVHVdMR4vKS+nykeQt8Ilhu7dcy8oSbSSiUIYs5ado8nQZfbSh0F3y -CiAVpa4jAwaRglpGyF0kdfaaPKxYjox1GN/+uDV/8sr2llTlWzqeuKVyXwxBcGKR -9Eg3jPZ38wYq2bJ3IUuP+IDhIpJixBxnhWfiugp6HyTxO2S/yuNuHcKT/3ap+JmS -RXs9mMe2dcIj2nPVSkH87lwnD42+2v/ohbXVqLqbGw4W+JjyfJDbnXscDFAKm6hJ -6255GLGhyz7tkFxqrC5LX/MTaVHLsZDJfPSGYhtOFwARAQABiQRyBBgBCgAmFiEE -8xir3pN2P470puUNTYoOZQumeNwFAmEKg+YCGwIFCSWYBgACQAkQTYoOZQumeNzB -dCAEGQEKAB0WIQRH9Bhiw7/7i4+/g/+3H1dmc+fXrwUCYQqD5gAKCRC3H1dmc+fX -r8LVD/9s/LDWkT/w0qe/J7dArnYCRMwx0Mhm4tflBsQuxXopuf5L6oDsxewGPx6J -BUVKozDpC/5LmhbvXLUiuCkXDG9ZAOP8Vl8lWleSPCUVUimCx83QTYHv1tFNTGwI -xZkAnPiKz9DLHoNI85wGj3CH7zjsUUR/Gm9CN19q7XYcOzGBG5b7hatmS4f+hU9W -k93oFReoiSCa2PuFP3TqNdEdAZXm5xDb5H9r/PpQHuQnowQnauH86hMjRz/bGBWx -CyiCMfNyK2m00043LemRB+VOuNwd086TQvyIrguW7nQFtjx+NlUCXkccZREEq4l/ -ZkGQ/XUwPUTNW3QKc13t7RuHHNcpVMxwYeOBiRYvHJ0ISgyZNORfMSj5wMPi1Xl0 -3Wvgi0pIEmpf9nxkCeZB4ac9ttP3GdyveuF/d19gnkWW4qvlQT8ivBX9FfkOEp8l -A7NuGJYpr9UhLUDS5QNd8ymnO68r1q/snUkF3GlK5qG64RoQb1PDcFHbqcsjKlXu -nde5gp7QNXW/dPW3S+wOh1roOdeWKeY2RPliuNlX1Js7F52c6H4shWRZxUv944/V -if2EGyh0eWZJsjhKMAMPoiT3Cle7PL9suOKkIMpix7fPoyubXLMNZBoXBGNEe8Mx -nGmEYMgOXhmeQ4l18Hn7FaolK7sm8h357CQ4jfxS3k/qnLnnK2tiD/4sLjQ3ylyK -5uqXrQGjwFXQDWT/OpjywzgH5wJdd4UCFYN5B8ns2H0xS9tWM7vUHYfPVRhQjJfl -NwjD/T1486R4rBH7mUaLRz8p1lubc7pBRhBa1Y6Ot2CIsXuPh7wEXMdAJv+FxQmB -UGxh6tdRWos/x/WAJmABYNFYY0rIon5frIz+U9y++lzgTcYqUSq10jluCyS/2E/T -VfQcmbJkgzodzYLF91tMUKySkroDuIkVBflqT2/AtUy7yX77Z/zsU6OOGSsDYmVm -zt41S38TiPI8CSGdSwkd1DUzGs2oFjxHVLc3DUCkfpe0JIlzppzuf5L/F6Xs95Ez -OJ59zyAf48KGDGNHzo9p5fh475xcNpyCnmyddkR+Y1m1qVVUC2QUd/yYt06D3IOH -Y4UjpFm4EG5ePpUpScn8/TZeBZY6EzTdGsH7r7I9a/mkxPeKrvZ+h6kUk/5XIMFi -/60PHLoq8pDyNHBuw5jrT2gahEnKtbE4MkGeRGeaB6KOBby2Xbbn3oIshABytasN -UX4zxIM7AXvzMwwnuYLdi0R/3R0qQpA6PwgmTS4ovrccyIMB6Wvf+7wvvz5UoYtr -7ZY2afNfDLmwX9ZiLKd91WHhYwM36IwKT3usjgVZGQWljCGqBIyNsgXfMBzjA5rs -RITCKPu0sWoCoZ1ByJAMbtwFOXznD1Fu3w== -=Jqi8 ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-main.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-main.asc deleted file mode 100644 index 6ad3f560..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-main.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBF46heIBEADJWRxsMeIXiT45yHB8Rv1RREX3HRbm8C+qaSaeeE8nycmfqMKl -gSLUtMFUegjjA+gBiSBwzh3vSyNDo7mpW/6uqrPhg7aKR5IWx1dIlGQJa17D38g4 -U0HpX5fCn/I1TiWfGlY8QcEm3v9XI9awE6gi64budK9/g0W+oUjWBfMgoJvHWNMa -igW4NZp7YUdgWKJPROgXh5lhlsLomjjKA7lvLBiZOWb+pyp0RFXz5idBlQ0BpWQM -1eT1bWwFsZlbwrIobDXHwt8cZAzZHt7Eu6FAhJd25xWElWm3AnC3xjJMXm/YMtjh -RDmFODWUxXaFS6V3xxdmsZcScbFkKuyImrQVUOtZTZDO1d3Jkhk/HbLoVeMuJBQT -/SP7Ufujd/CamzRQTDtoLD7SwMZXCuXuLWCfHwtoGdB5QYZbKIVjzV6P+FsYkT8t -UPNZoPC/0JE3SHxdRFQ1wu8lcxk0PZFwSOVWs0UTHZAieOIQH+4CJRvZHvkJ5nED -I93hGwI/IZrYII+xYhv3R0coYZfvUF3R1A/YBxdVpUfakbUDxsopqJ/FM8A8yPWQ -LqyKt+644AZATCZelvR+JdzjXcAhviuoBNYWSIpb5CU8Y8b2cBmHSyJVpjv7/744 -BkJwuoeoXLWNLKu+NLSkRu4mw870hUFZqz/Kue03JMW9/F4ZmJifh75PcQARAQAB -tIxUdXJuS2V5IEdOVS9MaW51eCBCdXN0ZXIgTWFpbiBhcHQgcmVwbyAoR1BHIHNp -Z25pbmcga2V5IGZvciBUdXJuS2V5IExpbnV4IEJ1c3RlciBNYWluIGFwdCByZXBv -c2l0b3J5KSA8cmVsZWFzZS1idXN0ZXItbWFpbkB0dXJua2V5bGludXgub3JnPokC -VAQTAQoAPhYhBEIev1IwV0dJnqEGs++B19juSbXlBQJeOoXiAhsDBQklmAYABQsJ -CAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEO+B19juSbXlgjwP/Ro7rw2etnmF6dJ0 -Nx0CFeZMt1Rl/GWvaYl0ZGB1b+K6XgwMDDYeMKz2Rz8wlwspFh8oW6XPGPNjc77G -L0kBrBjzlFCxTngYhGeNKLC3Flwb6iozAHKy6lmRueTBJcVFgt/M9YV0KoLR56T0 -uvk+XVwbmzgvUM5E9O76m1QzRMCDseRfeBK+PCCTCyJB9fetrCPjVG2ysMZVnOfV -/+x8du3VjQWBdGhbVZKfZseq75KV+xd/cBsDGqUbq93rgKlEGhp3Rm5wxZ8ke5+6 -H4B77aMzgib8DD+WmJSs/ZV4b+gYB+N9NNd176alXDPjGXX/1dPGhVMo/sxqYFdh -Id+aobsEcJShyf1KC2CXV1DmP44YS72V0/dTFqJs2bWN/buZkAvtDErcA5mRaiou -qT/EWklYOVYxa4LhX24Pk37XQViqkyXosf+Z1tbS2DU/2MK8JnknNyGHyeP/oUT9 -8o6/Bf+WKmn95qC6Zfis7908R0h9xOAdlax1Zd2tI8ZiPh2/j2lEP+VrN+Ws8GbI -XsI0ysEKNf76GNpojP0rfWfzZUVHebHMkgzBxKuMP6T/p8Op5WDtCR6eghR9WY3m -Gm9ubnBt55kVfpTyjT6K6Xtzy8/UfFQpt/o1Fnc4HO4A6We2/hr7Vink2C0UaAGE -Jt7mmUn1OPf7BJ6H1m8p3Suih7GiuQINBF46heIBEADQ7toL1+xMFtqsqOLysnz4 -uM8GDkEFzQhnBeZCPHGJ5ouTgfggxnmFvAjO/5qiuDA5vFwT54/twn/xkORyeKX5 -b5IhyGgV6QhAtaI4GVkGQ9jmXPaXUqVR/iynNlkFW03BmCZx+4EiOeBNfzQC7r3x -M6mna29dVK798rQDE4G4JDRiUP3WfAjAJYaKRzHrUU4ymSY7VZ2xbyy/xn4/HAU8 -hWGeYh9FYHBv5my3PWI6OjvQCIxpgKcYXofDjIOV/PigUzH4fkRyzV4gUVSRLibr -DFN7euxIz+nCxXyRUgfz+v1JmYiYFIv0RsIjOA6dloDlQId4iTEvbjk/1/ewyXKh -zYqe3s+jgig2nP9mnTz4sk6yxf7zrR68q3lwNSsMCrAzBmSxHi6VHJnmS40QWYMQ -FbN4TT7++SaJrZtUAO4GW571fxH+yBc/6ZocYORGdjcy3K6ifPuUKvVQUEOgHpOt -sG9JTSgjs2Y4jWhy7XgQ4vhdrcLtgHMUJrlqgelz6zlGVwI7x6+2yuBLnL3yvM4B -CwkYxtQ4Y0iLLKaz3wwhYSJDzq6iNOa58ubyAkdAoWkhiG2qv39t7pyupRuIfHcG -LRGXOIGoAsdYUUeRcVs6zExG/dXuZGmWZv3wFetXoB1PJRLiqOMvi7aS+ZR4mR2Q -evC8V3y/6DE+N2PIihtD/QARAQABiQRyBBgBCgAmFiEEQh6/UjBXR0meoQaz74HX -2O5JteUFAl46heICGwIFCSWYBgACQAkQ74HX2O5JteXBdCAEGQEKAB0WIQTZp1in -wp1wCWxTKy4ccILd53lhTwUCXjqF4gAKCRAccILd53lhT41MD/99OgTWLYajRS3/ -WQlNYIC5YIY8/T6jrnNbFM5EFrFzcrjmW2GKQsTDe4cAvL7g+G9wjSXPrNMU5W7o -+Ytw1Lz+3IfJ57HsT2iFMkVJN5Uteaom3aKn4dHECTJW/9yTgpBR2eUIg88t23tC -6X6ox9kO6vBfiGyr3lX1kjPPoGagBqwrX/eN23TKbtXg4pS2Y6C5lxicBlSF1QwO -758pkMReDiXPW/CvE6N7wCVBJIcNAQGtE4Eu3moFs443tNCIoLdpTLIh64h+aDKf -YAL5pcGpc+wuY4gl/bCW66uXUFdHeJbod0IA6CMC4t4HqAx6f8DTaz3/kxvZcE5o -eBYKxO3EwKIi5D5i0T6s+z5L8zXm2i5qk/B3kHXH73S0+u6fugQLZZ5YiYRLwrtw -w2frM4L3l8yjOUXcrV9udNEYBl20Q9Kv7pWHBonyUOHVDOM4lwo8FPRoHvYP9LRk -50/ZfU3dduYehCqTJtM9+Dq8OqRkamS6zeb4Ob+zodhDIf3mAx1+DMBwiHrWlGfl -/3NH8xK3I9VTCrL1RVqzjj7VN5hFI5p7r4HMdaF4WMBUly/2/7EuatEzdaNTqQmm -7q531KGMI+4rysYpBGGhn05DI+o6bdoTlc+2U6NK0b/G96Lr/Qaq3CTPrWHkPFl3 -riTow/T/fW3uo0oU3gSBU8HyMYkT4myAD/4kk9F6D5SWTTy91HZP0DAxyNp1ihpz -s52FhphauAt6DUgPR1/JVo638yAxA9L5YCe6v+tEMEyxk3GFZOG8q0hWPawA+8iV -elGb2hqjuQD7SiEVg0dXG9ExEnsWzDJyFE1YUHXrA5uRDAOl2sIhaLRTgNczdjmO -+a5smlyi0WJAVYZslDHz6cKTnQ9InpoUSyl5ZqeUTBozzYBlCFvKnGeVUZpisQ6D -lHdDWrVSHU/E85C+Za8jf11JQhKNpNUklhRXqQWiwkjLNHGOppDUyqy6iKXcER+9 -JUYFOtv4Fnj0KUy0g9e68qOL5r+ahafK9xqJfv61EsbywM7srfmXdzcobefeMCj7 -KmZKpCLo1MYEZsaDuon13BQUsPR2qMZWtNwMMdvPvFIgjzgBgseScXd6EhmeUSQH -JWRoD8gHgLot/aOPPoxUZw/w1gjJx6NhnL6Z8pjE86bdYAq3xNYS2DdcXiVhlxt0 -Hz4aRqcRH+9kAWNfOOTZMBVHmY0k2SyHQIGgkQTn11voa9eO8kZ1pQ5SaaSKl3hP -Nua6/oWYF0v+wyGkDsJOE6/wwbm9IkS4K2asNxLJveahchWLh7NNlZCtVc8vigdD -L9cJKB/Wm577DTy/qmnl0zPFiw4nBYLB3Q+rbRyXtd+z5rVMcniqYhx3/M2N76pp -6Du8/1s6I1OEkA== -=jy7h ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-security.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-security.asc deleted file mode 100644 index f63efd56..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-security.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBF46iGMBEADPt91ho1ol1iWVV6YkCNxr39g0t2AxJZM+hvUtBZAU/au/Fpsy -KVqJP3f8ytn2tQoMGsg3U0xD0zzlm3bDdhgeKiH9UNbnle3LMnMIPrh9ROMf/oDp -KeEm2SfxSOh8WdgtEeLefs2ZxLXfwebFUcEjNoaVVGatg5vAxoO26cLJKM7b918a -IZyDN4jPFGZmtoUlqmmhKeLxYltGsti5qdKwa+TtD2rsCgwCRRJxfFXNOw0M+zXJ -VMhh85ktewWjDySxCWwjjWkSPMMYddqRbn4K34fjhfahY4hdePqptEp5wEDahF2j -w0ahWgihomCGveaHMzpln328YkLZ9DYo6S7l651J+/UI/fCyOK0dYXnf6BJiAMZM -gyoH25k/5tY61iLEm8oPfp2Ux+fx2SkXNCgvTa0qq8Ku3U+jp1PmL0iRVCPSzO4T -0+YXqaXa2LB2zO/LUdC7yswG6Jm0uVKooMi4PtnIQ0tugBxmQW+PWRkfHdbj/Bnl -/2twMirU7QG4EymU+/vrUHcKljhh46HhZyC9WIV51U3Y8H2pJ3U8rlGuE5Ix3MNf -XKgafo/MQPzBsIu3HtJs1c7UJHRGzFDoYJdM67+gO3v8p6Zg07rtjlaPIqSbnOeA -ObenLKCqdbw7H36V2AQVa53HkxYal1TTTCYpYOAQQ9uygVuR5X2xiwKwrQARAQAB -tJhUdXJuS2V5IEdOVS9MaW51eCBCdXN0ZXIgU2VjdXJpdHkgYXB0IHJlcG8gKEdQ -RyBzaWduaW5nIGtleSBmb3IgVHVybktleSBMaW51eCBCdXN0ZXIgU2VjdXJpdHkg -YXB0IHJlcG9zaXRvcnkpIDxyZWxlYXNlLWJ1c3Rlci1zZWN1cml0eUB0dXJua2V5 -bGludXgub3JnPokCVAQTAQoAPhYhBPlvpD5Zlrws7Uym5+OmjH027UWVBQJeOohj -AhsDBQklmAYABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEOOmjH027UWVPkkQ -AL9jt6N52CtSb3+GJi4r8hvwSwrxye56mBa1MOwCEWDoxPAaRX+J5nBzeCELx7uk -zUT4gzs25KswqSkkP2Pq8gEepETgyCmx8g6w9hSpI/ugxx5rLD6P6FgnGYRySk9Z -MI35Z0cLagepOKBwAydFoJ0SiG/u2j7GcY1u6YDff1UW7hrp6oBbmjHW5obhwKip -n+A1JQUe2BdPaGU2AG7E7R4/snNiYLhLQ53EPBJ97OKcG9Of3jNVHUumqpS25CIg -9/6Dl3+RiZqcKlF5WGbGIn7RpW9pRnqiJORkg3QyEu9HvG7LuNlMRYL4vvBV/85M -+KS7bnfysCtkK5ykXufiIEHEckfAEur5TxqbQYYCigFig+umjI4SRg1vjQ0CHOLz -g5A6ke/7nm8OGiLIXAszuE7AA2AxvzZWvP90oahRWeEyDDGqADip4aA0Vd2gK3gi -pJVtZbsVQL9o5cpRI200jJxf7LQV3WILBySuVsOcFis9jQEHrD8GgKBC0Gc8JLyj -lkf/fvqJeYQCWxAEAkrg+puk0nc+1BCO4SGeHvkPkYc6hVBLp86Hnb43R/NkYBqv -/zmkMqRIP6hvm0sJwrUQvGa2eZ2eUxHqeDviaRMkPlATVI19s0NPvJI1zaGo/QV/ -pl7novxHbO3MKr7IsFTg3wcPZgeE9pUbEqJ3YHWrzCDguQINBF46iGMBEAC362x7 -HgQNVfS/3Dpiw9SOCgH1dUN1BmCzEIC4H7GPNIHulhXkJi3Hl+YbIDw/zx04c9DH -q5RQHmlEKAeGAGzb+U8SK8QyAU7FfhyizWrmQjIsBSGqyQVViZjNpoa9txZZsow3 -3rmD45su9h1VH/5F9/4MkXOTJ8JY3A+gjZghpyMyTvE/S3duOFBM1yRcSN2ntkQN -WnqL5K5QZ2hewBJncJhes7UrHNrdMXH7pz6550YJeQ69Oj3uBusCHcUnhx3YUcpp -qONcH6iyHQfO68+e7f/+m4CrGDhfcR3LU7+zunCf+YtiAw/BPXXZIT+KOzLdo70z -f7CDt5/fhpdRUYJ2E1rUwVUn0b5gqbVNXaqQKrPVEekZFDixkVVYWsL+jLq1Z9DN -5+4tzYby4SdJh7wY+so08IFfOA1fPXw+3cjJs2EKUW9hcNBn7l8Zl52/M2JE/ETD -zDAfIfqjZ9mY3mafSBSgwkQ4T9eVa5GOQP6vJxkhp/HmcdSaBx1x5ESMkjs+kWed -uEW/u3dzFN26ZUGpFI3iHo9tsJJ/jzqxEuijGRh3Q2x7gvFuPLzKIvFn6zP9UFLZ -++BCbojblhr1SswIciqnMnTNYoF5gI3ejKHiFvoh+n8u+e0pBp9yoEWJJkuyL9Xu -3+6JLKwQq7XjvyvFkBjlNZuudVG5sW8fup0zuQARAQABiQRyBBgBCgAmFiEE+W+k -PlmWvCztTKbn46aMfTbtRZUFAl46iGMCGwIFCSWYBgACQAkQ46aMfTbtRZXBdCAE -GQEKAB0WIQQkr5O7BP9cerxfkNufPfFbSEBtFAUCXjqIYwAKCRCfPfFbSEBtFH9m -EACUPI+y33c95ERdKu9TzW1YiTlrBUAzikZIS2H4MyFfFgWO9RdV6cX5Tuhzq36L -KS4mnygcTeByTqU00MOU71jL1YdOLFr6wCMz44zRKYCVrndod8yZP3tpOmxP1msN -VyFhNrSWNhZQCDNCOQ3c3miJktBZE3dQ6B5KAWF/U9FveMS/PHfbsFiNjUxrJv4W -zj6OhGyRK8tiDIf66rYZMOUpFA0DnVK2jjBmDMD0AsT+Dh7Jc8szsEPZKF/Qo2hw -4cAQY2YKIcIUTfWsa1iJhpMt/kmBmuqyeU+oIxfsv8GMMOKmtFaRPv6d24mUy4ay -QxrfJfpDUWOk/EviFjE/TtP56Ki/X7+rAxNNIQju6xBSHaIcfKqzLB1zChFCmfQj -7Q5oB+UA54zqkkR7jlFyx6uCuAYRe3lP9KA+c878SWtqwh3ZHlXwWizU7v5H3tUg -n6fMjKxxvXWhAp1lnl6epYATA8pKQYk5lEbzoIVUMV+qNY3j9wVDGIJmUZo0aYn2 -iivK5q7l/hN61ER9Lw/EUZ94sNKc05qG3PcKcdfRIvi2AMPtSi9sxIsbVRTV8Rz9 -zcGTYTy8U9N7bfyndvEYT0CaYHnS8bZ5SCvoDKbhB2VeF39aTGhh0mNDNqXKbC+b -YsSPvVaaMjRlXiQk5XJN6sF/I4+VfRQHNonXO6qb1bb8bSGVEADGLNMuDsOQvaf2 -CPscofXuKL+EJiyIoM4TJFUFYk47HCvUBJM7q1wIp2lvWGuzVqKOHCZspOWxrxQ2 -8iqDCxewj9JFpm97/xGARTwc+eZpClek+1lwI3bOG8976onHyNH9j/D0g0tTOlP1 -I64NtV3ok9BM2l+VFMDzorQBYrTXOWCtIOduc/cE2W6AQ/EdY+Ro+pIq07UOWPWJ -M62Yw/8kmDs7/j/xivdM2KSXQQ90kzX+BQN9Ter7wrVnW/FLCvbAezgmcjzU2pEq -6zcqhWo7UW7tsnw9FLr2BIipgPdxFvfRu+HYfbs8vDatYWX8h5wahUL/W7o0qUWJ -GSudd69MMLNENQFmvYIZ5OOExBmDVlcfpFTCDiAfbNqHP1Hjf9OoUpI05wGHHr5u -JafSccIAYby2XL6S1DwD7esAthpkYtzN0Eu+1xdJVupc3G4f7cLzOTLPWLtWI/RS -XIucWVPCLyfgOON1D2sT/3CZt5yceA8Q+P82M09IFxGmxqPXKt0B7HX6K60F/x2F -7IYmGKMIgWCJkIn/7IiCG23fI3Xc5wId9eOygP5d4PT4XBbEnY+XomwryLE1YnAk -iLTRcnzTD+Q5i8eKwHX81/W1dVO+SObGBla3ZOXhZEvfawqoKtyFUvEiDVIMsyZS -EosynJ/dCIk9YkbxMc1AAlMCo88y6Q== -=27Sc ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-testing.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-testing.asc deleted file mode 100644 index 811d120a..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-buster-testing.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBF46i4sBEACdZzjGZrFQpoe2296vEPJJWX5pAd9YSKp15Hyl6QGueYoXdDkb -1UuJQ6b1msKxUzZsauyzN/R3jn3ULNXfs5oLEvoP5XrOL1OevBJGbiRyYiChi60E -8aLhi4lCSK1ek3qHjDQv0W3KWw63Yoz4Z1TRJiAl2By9CDIqcfsZcmc0JwTIiiSA -M/3RB5LfsdAX2ZTweRiFGE1ipRTSUHC6cF/B2DS+krZQKtBKZXaeh+X02GA3FisO -kvR+SX/gyCW420wthCe9CWmYQ6mtH9al+NWhchkPe5EIeOfecRvVcTrCYS9kbel1 -/x5/peWAjuCRC2U25HlZMB4DSNedN6zbgNV3yEzM1qT1sQ1fejhLjY2kSQxXLbSG -CwdKuklkQ8S0OWt3wEEia+DEl4RcBYz1/kwXt3lpCDb3HlUIgjqUKh9PRPBN/7+k -svtgGjRRPYq0YI4LW2Dm6M0mJCqB7CggVsDtN4jAViUnCWvCuCTqDfnNKqBaC+NT -LkTS6OmlL+Y1VmnWX/zAIO52og00ZPKfb2y8uHUrt6f3ceZc/D3fzoaDY+BV67Av -cawxSPI0n9g4c1p1ZMa7TFe/Wo665HlcMRgHq/vERm21SfjU07qE0HCY+QJyYIXp -ytriy2gAmVJ7fsSr/0cwQhGXQixgaL+hE2HTHDn5ExPgAfyZLnGZsnTdcQARAQAB -tJVUdXJuS2V5IEdOVS9MaW51eCBCdXN0ZXIgVGVzdGluZyBhcHQgcmVwbyAoR1BH -IHNpZ25pbmcga2V5IGZvciBUdXJuS2V5IExpbnV4IEJ1c3RlciBUZXN0aW5nIGFw -dCByZXBvc2l0b3J5KSA8cmVsZWFzZS1idXN0ZXItdGVzdGluZ0B0dXJua2V5bGlu -dXgub3JnPokCVAQTAQoAPhYhBF79w0sdlI50kAMpfO6fvRGt5v6OBQJeOouLAhsD -BQklmAYABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEO6fvRGt5v6OD2IP/3qD -QNNQ4b0h3etlQiURUmEzb1Li7RBT4hokQ5YHzXfb0BbduFJ8iEy1AwmouDhNLeXk -JnNeepGu0kQmCd4xtKtomAR7b73z8zTXJ9AuGDicC0ORLNIvXCPcCJmTELhwLsUl -4FZW8ZtSjNXjimKoBR2k+SGyrBsAFt4+FLwzKEW5PxkXyww7g+7h453b6yg4QURF -txJgusBH2d9zhWdSh23WCD6NsIFVHEtTw+c3on4ph6azQvyMizzAPp8jxKgiSpz9 -xH6Kd67W41BwO+B/IMTDeCMCtbVWMQSmEmV+UyUQI/uX3wBvqjIoYNFKtajpamJC -1pmwRwaHjhyivNSruKMwrDBURwfALb32bqtLJhwpZOsac3Xg1YF8wd26RCDqUerC -upwz9X1X8QyVsG0hwkjy9tRE8YhyoAvuKhxwMxwlFF6MDjKboBTMY7JqxKlCaKMz -e/CJGG23SGnEOauHqiYPWFcXVmvHa0hUYLNYzO/JhGQs+TGSowtRTo7EQisxZ1Hy -6wkXGAY30HizjAMYX7bSNaSn22u7DCQ44OjvMSCbFozBe8fXSz3WunPpcoNcaKjJ -iTKBhuj1PhBr4wbk1GoxPSTBqpKiqYNn3luJe3hxK9OWfzj5epgLC0g2vSwYlcB2 -J3izpoXMvsT0IfsmJDBcJc/z1W1WXMf7PRKI4EOkuQINBF46i4sBEAC1EGKAaN5t -W2LeInvoS0TFC4Mxcvu6z3Oqw1Wfl40Fn/hEkzkXS3xsU2vCzABwIQ+SKtMT72sX -QmDZMIrVEIZoEG+I+PusjHqLYupAD7/W3Frqxkh2Ou0O7igmwOLRCetw5reMgHD9 -BrMSgUSRro/e/TSlnmDH+zR9j0etpVTtqYhR3F8eLMO26n8dPEZ3pn1tEZdxz9iM -O7L5gd6mzsh0hB0figKtymbLByYw5jIJd2BLxcv9Mp44uLNSSohlbQTyfK0uyyZl -tRENT6KWRXpGllfnNinWIVwuyfEAi/vbDxPkwgVhGyeGFNGk4BecCW4/QW259ViL -Jb2xSdksChlT0fn4WUAvhXGSmBAK39nHY/nRTthtpG9MOf4K9knWWjFax1e4I6m2 -jEo+4/03W8CNgGy17ZRmJUczGaZf4xJ7Pl3KSXs7UvJKvMmJ7i9kB0Oelipjk0M4 -y7PtUjn6TpR+Bg19wT82rHDGaLahEajJH0y5eNOUaPZw+aeJxF6eyL8kG2SfTGTt -orsakXthBMpWlsxu5YsD6fR8RDcc1/xZwrbeXUPYo/ya1nXih+PUUgq9nksSrzWx -D2nbf96vTq2fKOt3EYgP51jfopMHDRWlDV00aWXIIIQXHkaHkcU0hvsQ74PgvPj8 -Z7eDhSwrcdORlbKrykjpMyabtSR/LJcTswARAQABiQRyBBgBCgAmFiEEXv3DSx2U -jnSQAyl87p+9Ea3m/o4FAl46i4sCGwIFCSWYBgACQAkQ7p+9Ea3m/o7BdCAEGQEK -AB0WIQT2mm1lvtLX0xZl5ZEWp7WVz6JzowUCXjqLiwAKCRAWp7WVz6Jzo9TSD/9I -A0Usb25qiIxpRVAt2Vbx8v9kyE2oZVcQR2Ggi+2B1ljIKACdaVyAOZJD59IBEy62 -3u6J76P1FeU2AB0t0bf2pd7wYJznyQaHux5SeGocPB74RdPgdn3waGYzv43vvEE2 -pBKvUUXb6B94utjSZKY9rGuT6DbsaHAOkttriDibYTY7pLGfBokq5hx6uMkwSWpr -M9rjbT55Km28s9+Ckb+UkxdsFmJuxQUoxMlxoNMVVzDH/0slXxBSk2g10GWVWeqi -0GwVvAvVzOUratt82PMfFm1SZh2STnjOI7lwORY9sn/1mADUjA3WkrdBWtdatYVw -qE2LW7GoK1GTOgyo72fvf8LdHb852xeuGJuN86npmg8juiCiscRQ4gGqtSbToL5O -u+NnA7uQyZz6v4a095/ToIVcHRwLU1jeFHYeBqeo5ChZ5DiiZ79dZjA+31LyLY4Q -mNOsEFIEE1ckA3vj1UzVnnjIcDgzfaut2WfmmyKxmzTNasUcSHQoKcHC2smRaC5m -S9/7mxOs+jLrJCIdvbGniL8YhOqHBQA6Xq9kZ3ZTOk78ACM5e/vZR80L1znRcYBR -PfGxH+G6L00d1nO9oSxsVgyeex7MzWfYu9DMMaIm1ZHtqlFtZBrK9C/9tbIxUx8h -ITjhtBBLKwm1D1EYIfmwp4RDmjRSWn7hQMsEjTJ/7XSBD/0WHBQtZQE7E0gK622C -PvY5ssd4zobC5/EWfHO7rhdblJ4bP/ByQdQ9pzxasp49JM048US2i24sXrfEEGhZ -uEjcCUVq/HLs5yC0KxunhWtfMJRVkBUzpKpjx96vwnf1Lrh5Z4Nt6jiPClvmKUz2 -CVMT3wZyGmtUekomd6mT8MRw9tdfSwXHUpMaqIf2HL39UlLNXBE+XMgZQSsLPkPz -O0TjXF1Zu5Uvbg93HxZzt6qMqY64msb1YCrq4kfd8r8VDKmz8EoZT/yp9f3stxhE -rPr/zAUWQV+eMWvqr8oLK14s/PG/Ha/2vlUOzBz0gYfcio2CbQrRirgbw79kAyT4 -pmE8EUCcCvdmGt5z8hDj773wDEXM8uJ8FGccAsQfUYL036JIkwKNiyLGfWohdbZX -Ihrrm4tDyze4uoIF9Xx/D/V72R6+Q8ZZc3N82ueAJZbKcbbZUtuBxCJ1UYHn7kTl -NO1ZgNkLFSXKIrHJbs7dH/7O3mFVBsKuQ9Gz67SFB36TShgc5x5YaWRPyoSBdWO9 -Giht3vkxBGkKLzaj4YcFsroOrr3Cxxx/M/CQxWMD3tywsOLmHimW81DLtu3Gwfcr -QUQQ8Q2UAhPlyZyDZkkogNDSlSQE6IVhimHrJXXw/4tIKmWGN8nU9wXB0gs613Zy -i9r7NIRLznzpf+ZZEXVkNNE3ww== -=RJIh ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-security.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-security.asc deleted file mode 100644 index 8600afba..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-security.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBGjllyQBEADQ/7qgkj9gR3Bv8DTKcEZdPPH1Xa5OCGYEOvT/zsAiLaaMU45B -tS9KNWPYWx/kZRhJGhhu28TbIgwjESXsCNkxyEf23IhAD53pTuhyRldvCFTgZBWV -PPKSjTswr4zdZ33UfunpZLF3oXg5j52vdMR0JUJo1/ROKMc0fohSrTmOPezieoWP -woxasnf9k4L3HS9/DxQJzaOURektpJsOIU5naJuxQChzWKSRUsjbBu4cCw1wPpAY -ISBpwmurHoY7z6N0Jk9yipzWZlDVF0f0GepdwCFlbFlwYBgbjI05py5Vg3Sk8Q5N -zPVvp1/AT0A+jSAXNKeKsPdH4jTKn7IJQUcxlifB1TQ/4a5LF7MpYRa98c0rIdmA -UZ3phsZ6bl3NZB3W4E9sRjACzA3FAYKYuyN/G7ziXfU/dJeQ6Pt2Jlk5TM2QvI8t -3fVGSqUw501x5ptE/NgLgOMld9z0W7mIiAh0JytuhofexsB2DiKb8UP0KR5d/sor -pwf36Gdn5mhRfLdUZhmvV4l/9l+kVGOPuc10A//23Xtfuml6aYiOo1Q5xN/rWspi -hYiPnD3ePs6UzzMxJ6RunPp7sxo/N9H3jUMc/wLvSKZZferd8m7kOLrDIRjukAtn -xlcPFElqhsiW/8JGemdNh3/Y7Ou7LGNjnVrUmZi9+o5eIBz/XH266KRktQARAQAB -tJhUdXJuS2V5IEdOVS9MaW51eCBUcml4aWUgU2VjdXJpdHkgYXB0IHJlcG8gKEdQ -RyBzaWduaW5nIGtleSBmb3IgVHVybktleSBMaW51eCBUcml4aWUgU2VjdXJpdHkg -YXB0IHJlcG9zaXRvcnkpIDxyZWxlYXNlLXRyaXhpZS1zZWN1cml0eUB0dXJua2V5 -bGludXgub3JnPokCVAQTAQoAPhYhBCMrwcnY83dvnSxjO5/R8RnInoPoBQJo5Zck -AhsDBQklmAYABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEJ/R8RnInoPo95wP -/2wQXsANrcK1Yt5ZKwdNR6hRywtnjGokcQLgC8ax9rWClSbEoD3oAx6qPkjXbaG/ -RK8+pzNIYa4Jzq+tfHAqwbxgE9ndnBtYD4dxGijyngpgf8yblHxqt1U2jQu/jbIg -zxfYeuee4VYVEypnFOZg7z91d6sl2rBYbR3AQeUVBCMI/dUXJUymVfrrGd24cJ6t -RlFbVNsK63LsVlPyhqK7PLTS0qOrqLsda617UU2WfG84h0mzPlRgoW3bQAAzL6HG -eFYpNiNXc5lEZ2n5KwEbrz6OEIWshf6U9b27dr8UoPqP5zTGEtPomZhBAjoetOqV -FDx/pfMcn2U9FFyKF3Eru8RGlqHqq38k/HVmpdJzuQuEOCgD57yCnIhgYixZ3nUa -RnXiVQaE66im/8biPr7eaalBm0kniVfLzb3qU8DSnWGpNr05q8oTJTbI0a5rbRQG -hKPFLLfpvxflj99lQ2EEvzi3D8JH9BAkYzRdHXNc0Sicbc+3iNWoMQbZ6E/KM252 -mARQI8spErggZElQakZ5fqYyKmKmzEesZLVk7dkwe5HeKL0TSVkYk9hjwvW/qPNT -PNoh5sZRZH3Z7u8wAhSdW4ve0agwW5bMjjXOx/FuVfr8/Hu1aLcmoRLdPc+9IYZg -q/j8luSCAvOAALRlWyPazpzU5jenn1btAITPJe/ARcUuuQINBGjllyQBEADCO3k8 -fiLTVh+QgJVRvB1FJY15q8oZkKDZ+YOBDPPSUBDOizNIEvvXbdyoTHRTsQoCvTTb -aYLNaA+fmf1QUub5WxilCdNDIcKRYEy5zlV4V7JtrggBO7789wItARlbp2/Zs2ml -31EjWnMrqg6y4LJBVMlu4u9x17YnzcADhS5McPmhsHS33hzHxoijxezoQIS7gY36 -MvZ4mWZxuR9gBrSXQTl3VwtOQLojJET8vIv086jvNPUTFS4X8/+nSwIbR3+WkJsI -vSo+N0JLBIAYFgnWJ/4sQjl4xsGCktQsiTKIQyFOhd+xYs+NXdG3VjO5lJehN/oP -SHnI7BCgNCPNQqmjKE2TZ2UHNvJCZey63i8XXvgR9+y4V3ZRa+tsdxiGAlgSRida -q67JgKwMKiCs/MvuZNQSwe8krBx3KRvDb1hOgJ4OJSV2GufQzlLla2WeZoo2IDxZ -chMqiN20Ni6OvkWwYTrXWtcbdpfxg7EJpQLVXgLgYAVSatfDJkfptPR5DtDS3qnY -1emDPVe5T9gdgyqncj1UjV6KQoO9EQvJxeoChUqOP2oDsgyWZNM0obwOMIUmznIB -7uCXY8Y5JZWpRad5L0it+nHMmPVzaNLdD7wBWG57v3fKeLsIuqFA4Jyo+pWW1aX6 -cjiRFtnZMtyOrtPMe+3WNQULg1ScUrEWZ7TTgQARAQABiQRyBBgBCgAmFiEEIyvB -ydjzd2+dLGM7n9HxGcieg+gFAmjllyQCGwIFCSWYBgACQAkQn9HxGcieg+jBdCAE -GQEKAB0WIQQdnriwMFOORYXdhJ8yfkjLRxPPEAUCaOWXJAAKCRAyfkjLRxPPELfN -D/9nrsL7/dCxBanGZeGJWS9Ind4Vj6f0RoJSPb2hjuskhXJ9jAA6wDbYCUUpk2dj -D2hFICBt5OAGnPpuQuYjFrpaE0ZmiqkZa5Sxr70NtVwazDeIKwplBg2QoDfNkyBl -V8aoaEpJmjHdra36d1GFxUdw7r1YyzSigPgenz1chvqtIxYo5KlfOX9gY05lMbH/ -mhNQncxI1XTQREZWU+UF3t8mlqenq6nPJVkmH2rRNlNsZSlhxIO8PvLFV0PJzEcb -GMTREzVWbVjuZiHQ62fYPru6Ym6kq5447K2YDD8dF1InbnEVgygWa3sKPYHRrimn -/0060/Ikv720D/ob8iv9wlqLW+UV/hf/FZWW2yoTx/WUP7sXm0bgeamtUhYGsJZ+ -8FukGCWjPn3yFnTDsW+29l/ciWb7BYnrbsUwJeSulwjwDXT2xtR7SIZoTGtHmlBr -t9ctGnRHM2EtL7C14Hzwek5TpuQQL4cTSEAsJXvRkhLKF4NZAAuGpohdMIOe2bPC -Vy8Q7jGtRCbE6sUk6qECYCSO/j8WMmL8312K/xmz+YVR98WDuhOFqX+rBisasLOU -mtfUX4CG4jf7cDXDw4rzzugFoXyApNnTS/Oq8hCRtXcXerGnyx94+4rC1cH0vxLO -tDSvx/aRBUEQsORaRRU4LTUV/jjFtdlN5uzB9S/uBJBWxosfD/4wZfiy/lh0LHr0 -UL85OecUBnNeMIBn/gYsx4FfbWGpgPjy7enbBnwzYOyfbfjB9sbi7uC76msJvSfP -nzne3jeVmIwTSAsCzhcF2WMg6Y7a/QwSzav3jbjNUhHYDuTnHUO9bkMhp76wKMsv -lwNsRMVeUZ4upzDlCmGgieLyJEXkySQ9hwAyC1X2I2szEnEBftw5wfNv+D6sZFgm -XlW+64fWYMktSNlsz5vWI7KmCmu5vDmDCX7sl2TCW1G4/Eh9e8eTuxMvrlIwKIYZ -hfzjJq5p1RF/5j08171i2DnUWAC3T0E50RaNBYxHXz6QCTS70J0b8+xRSWYEqHcM -89mwhE2wdslE8Ip6JIB8DbE90asqh5McJ2IOOIaWRMWO4ivxCeYGDV3ZZLWVupsH -utrn0pe/mAv1fuh3xrsXk43YHs9E/0hKDEnvvSSBULtj64HjsUgTCxyhhEV0+/oU -qCKZFHHsqr3V20rCgsiVROC7iwHXxqfvTBniFNPvxhETYkrGoemADOo+wFeHist8 -TVwo6pdPcAUf/FEuq2Hl+9NLNJJHiY88m9NVO2zWBSP+jiHXVapwlVn+aIei+Xx+ -2wI3IyQoEXen6Y09977URWeoh0JpDMd7SdieyfMhzZVFK9NjoX87VqX+cqU1qECs -zrFo5AJD/FAdlAoEvmnrTUUSCV1T5g== -=7n8/ ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-testing.asc b/overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-testing.asc deleted file mode 100644 index 4c294342..00000000 --- a/overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-testing.asc +++ /dev/null @@ -1,66 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBGjll0MBEADjzrMkzlGw5MSTYH85svdZwDOaIm/yDzaICmKiT2imB1+eUAy8 -nzroLGcBegeygj1uRJUt7obk6vv+D+bhTPQlZv2oz2fhUMKoLSSWhY8I0q14Bd/E -YZqm0WtFNvpSKtW/itQGqlqpd8QSMNVTPvdgmBt69EW/eTsh/BGMxwtC0N2rR4bl -8RBfuSG0BhJeMKuf4ccTuQJSW3GqnpUXV5GiWFpwIRENsj37l0hqR4nbUS36+64H -w/8Y/Th3vFH4CE9N/hEXOTWada96Nf3603VX7nmcEQDyDblKCQcr3pLRA2pO3amx -Jp8gH31iLFFdqBzuRgiHwQqrqihwBJwnDXAUaBWVef6EE9Ewu7LxH277pifQrtSc -tfl58kMDhhhf+OOYIFTFhI0JnFw113J2RnBHnfT0KZmWPvkGmqVLHjMcK5GbqMre -V82cL9ExXIqfrqNgS52oIg5UYoxfSRt98sd7rQiMU7slmQqoG5G259lj+7sjPny6 -hbq0weTMPPuKwp/9EstfXu5n/uLsiRtpQ0xBdbCRz3BtornhwxuqSTdTeMaymarX -EDLN4uoCJxyGXRo8+L+hvnbNIKX5bvnX4+BQGOOUeVdgjSOAiojEcmgF8nA36AYV -1jn2ypKUUeKMnMgnD1ZjChYco+2FFr2eef8jovgWH2tg1MfPC89cOQauxwARAQAB -tJVUdXJuS2V5IEdOVS9MaW51eCBUcml4aWUgVGVzdGluZyBhcHQgcmVwbyAoR1BH -IHNpZ25pbmcga2V5IGZvciBUdXJuS2V5IExpbnV4IFRyaXhpZSBUZXN0aW5nIGFw -dCByZXBvc2l0b3J5KSA8cmVsZWFzZS10cml4aWUtdGVzdGluZ0B0dXJua2V5bGlu -dXgub3JnPokCVAQTAQoAPhYhBKfrHUKoNjzODlmG5BwHJGr5DySGBQJo5ZdDAhsD -BQklmAYABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEBwHJGr5DySGCKEP/0+1 -zwqYhMk9HasARTH45VDgcXpIMaI5/oTk8yYupL4gC9S7Ld098EIMVJ3XdjYA7Tr2 -QnPn24EtP6J5jhNfBhzY7KcBx51NDZX/8pXdkDgfiMVWiQB/R1CV6ujbdoXzoeSR -gOImdXygjOlzFZ3B/MGfmBl9CF8dIMohQHFTWTmkNrAT6qY4578WgA6d1d8ergPM -Tj4xr2pMysCAQmVBUiilf6xbwVdjArZSR3F2Sexq2rsiPwzdE5RjYPqkkU6twaMk -tIFOUy4GCzMjgbD5ctUtCfeq8A101+uBVjtBeZtfOsAzw71JBRPR6dw7hLXc++Jf -Fj6gILlNYJAvH2fLRRkXn/I7R7AD55AJY3DyMTVFnXIy/6bj10zYM0veS8EBZSc6 -H9xF/1Ir6IP0FJ7QDyZnvC9F2osuds7fkE9/t7Y43HGO6kAg7h2lkZDd0pVvrdN0 -8vD/LBQNx8+61REy+036CbCHk4ZJlIdIjJ+pXcJIcUppckRo85buNACvL4iwOi3r -N4EerMC4aTuKJe/k8As2v7wlt60sS4blJ+sVIO7PdkiXU4PbdTI5KNMgklW//tLH -cw6QsYgfu6+gjZGhIKdZOiBpo5msd20hsgpE2HAbLv3SzWyOFI9lM7WOCZJZtoVY -DV+vOW0liyCuQzZh6ab1HYXHlqPf06C1cDH3M8vluQINBGjll0MBEADG6afGPh66 -iXp5/vzIjxcEsaP2Fyg9V8DxESMeM1p+cTlfrekvdSS5viyM2TDA72wThYHLp1rm -9TUKEJ9jBl1lnx2OgDXHsKrODszSGN81wUZ9n0V9CdKZyP3oDOVike+z3I2+v54B -iVbN0OUkOFe/5gsqk3Wzd8scOsUjCDNWT/iJyJsxFJuGHaWNdgnv2KASwIxJZj+I -vtG1JVyFYEt4ayKOBeea/tIz9G6Zx7Ta8vi+uDb6AxF2367xQ+0YbpPt3YZk4y6a -wS9290ARt4NgchOcX+0KezwIVTPP5xD6Cdh2i9sIREt60LFRs2jF5NoYcVUa9qHX -RJIJzQu6z4qBuxoATOFaShQS3xuiUfRPvBvSWeKYPxjB4QmiJssT6fcef0/oqs6K -QhzbhEthu/qJXst5d8dVEOQadBh7BkVmw4OGKLww7gd0boAkkE2rv5WAyBymqeMU -fMCGyGvVD7U0NvQ32pzKV5Ko/KgRZ8hkxmg1QKGDCXD+pMI58QSQUi6uyU/ZLAsD -zy2oh//ugkdiQz69+VLGUbeNpWYmmOEXhCAjEpjyzePEOcimxYDF215840AlnEa6 -x9ZNpCaaBJ/zC2BJBF2fH7PCzZZdtPPaXzSKK8nOSuXz4b1j0cfnRzs1B1mGS+mL -KFklo6cBADEOgR76yiK1SSOk9IMWlYYaiQARAQABiQRyBBgBCgAmFiEEp+sdQqg2 -PM4OWYbkHAckavkPJIYFAmjll0MCGwIFCSWYBgACQAkQHAckavkPJIbBdCAEGQEK -AB0WIQRC41TUrB12eSPFtj4xchwyd6tvxQUCaOWXQwAKCRAxchwyd6tvxXNVD/wJ -FCfjPq6UYkZnGReeC6W337uERbG2QJD2iASdDCV/4V2SkB9apZwff+ugtqHPk15M -zjDP8ofGiKnPTtgSHZw9e7Fm8WPoVMacniV3nkw96UsQ0bUE5QeNJvpmcpFioXeE -hURdNFEjlYY4ijldFDApe+2z0SMjkLo6Ka4UdFJ1aQjUkjsBgWZwlrNeBJF9Igjh -tIz0wUHb7yK4K763Vn5rk452JpFzZdfEMGML99/P73NeEGFIw/WaRdMrJ7rqEhA5 -aBjhvxd/VczMWZtdMIsfYyKtW8CHo/glASBYU59OdR/uawXqTvED2hjpFcPpdsOA -Ykz2EzlP80pLc5ks1uL3M0rhZQHvlr4SQQI81GO5FcSQsShczU7+/slPHa+6dmn1 -TGDb6ySzKnXbvQdj1lUoiuiWHmndvxKeJrEn+8RdoORHNrqIOr6a/UBAFmHhCzbO -sW47xiQGVju+GULdwhcoEww/5sVoH+zXVmREITqUgbB1jx7+NKdJM69uEsGvVp7f -8TQrhqGyBBtKB9wMxQmxOYFQjKShabkB48zxTl2mVLjpFOZRriPp3VUdGKxPU6r0 -UA5djGdEHL3fgG+Ab2mNINMxfzYc5NUPG3mBdm39uwKVOV1Xgz65Fy/kldD9TMxU -HS7CmE/F14LDsekjGjPpc4NbW19hWWZW41kkTTDsoYKsD/4iZibT2pmqfNKaBhxq -0bhi3iw5vseRvRsBIpP5tzwzKUVwV++vbPjShNAeMny2pAcCbW5vHd3khLFy3abA -53FjQu1hOr6SpHcttYm/+lHxxDcqHv49WPkCFV1APirYOK50jsihJqm+ej90gqQO -d8DcodpTTMX30PbUibxDNIO8G2s/zMIDLdy9OVvbLypCJ64bo22GVS4C7pHzXfOP -nRn7nOOTZi2kE8faU8hyE2ha2rJfpKIjwrFK5Jr6HMEcoKyKQMIst8u5CNGlBXMp -9VMHQvh6dZ5p0fLqUHci4CctPeRcJHUy2Cv65YSj9MzVPCbw/wSoPm0Ujk+h0SDd -rW/wVstQvaMBL29NaoJJ/P0awBXiMMF+ZFoaODYqruzlDh40WEIGy/iffjfOTcKw -eU4UKscTeZBGibeTs3kVKWVxCPYN0l7ywIU6aUql+CSFRpimrPYoqZEIuq5E+A/z -8QuUpaipmo4fcBJH9sRcIM9mWgW9QCVzCWUDjtDPN5wi3fBUw2viGX3XinbYzOU4 -Ro2DmZu9NJ9NKC4xY3Pqqdlb3aqP34h7ZkpoZ0hP14c9s1TbWK7k+p2W9PP+RECU -3GkIPpH0L4VQfKRifT0zorzMtQQUr611mJUqDKi8zQ/7VNRz3bXq6bp0eii/GDly -fxLEBYfkUUm4MQbq1aXQsEtyNQ== -=IRRF ------END PGP PUBLIC KEY BLOCK----- diff --git a/overlays/turnkey.d/keel-apt/etc/apt/preferences.d/keel b/overlays/turnkey.d/keel-apt/etc/apt/preferences.d/keel new file mode 100644 index 00000000..20ee4253 --- /dev/null +++ b/overlays/turnkey.d/keel-apt/etc/apt/preferences.d/keel @@ -0,0 +1,11 @@ +# Keel Linux: prefer the project's packages over Debian's, never by +# going backwards (tracker#23). +# +# 990 is above the 500 of every other archive, so the Keel version of a +# package is the candidate whatever version Debian publishes. It is below +# 1000, so apt never installs it over a newer installed version: above 1000 +# it would downgrade any package newer on the machine than in the archive. +# The pin is on the Origin of the signed Release, not the host name. +Package: * +Pin: release o=Keel Linux +Pin-Priority: 990 diff --git a/overlays/turnkey.d/keel-apt/etc/apt/sources.list.d/keel.sources b/overlays/turnkey.d/keel-apt/etc/apt/sources.list.d/keel.sources new file mode 100644 index 00000000..b364af72 --- /dev/null +++ b/overlays/turnkey.d/keel-apt/etc/apt/sources.list.d/keel.sources @@ -0,0 +1,19 @@ +# Keel Linux packages, from the Keel repository (handbook decision 0039). +# Debian's packages come from Debian: debian.sources and security.sources. +# +# trixie is the stable track, the one an installation follows by default. +# trixie-testing is the testing track, off unless the operator turns it on. +# Both are signed by the key keel-archive-keyring installs. +Types: deb +URIs: https://archive.keellinux.org +Suites: trixie +Components: main +Enabled: yes +Signed-By: /usr/share/keyrings/keel-archive-keyring.gpg + +Types: deb +URIs: https://archive.keellinux.org +Suites: trixie-testing +Components: main +Enabled: no +Signed-By: /usr/share/keyrings/keel-archive-keyring.gpg diff --git a/plans/turnkey/base b/plans/turnkey/base index 430ad550..ea948a1b 100644 --- a/plans/turnkey/base +++ b/plans/turnkey/base @@ -7,7 +7,7 @@ curl rsync zstd /* if installed will be used to compress initramfs */ -turnkey-keys /* TKL keys packaged for v19.x */ +keel-archive-keyring /* the key of archive.keellinux.org, overlays/turnkey.d/keel-apt */ // Grub packages // * 'grub-pc' is required for legacy BIOS boot install diff --git a/tests/apt-identity.bats b/tests/apt-identity.bats index 22970667..b4d85a17 100644 --- a/tests/apt-identity.bats +++ b/tests/apt-identity.bats @@ -3,14 +3,12 @@ # # overlays/turnkey.d/apt-identity/etc/apt/apt.conf.d/01keel the User-Agent # conf/turnkey.d/apt-identity keeps it the one in force -# conf/bootstrap_apt the source URIs # # Every User-Agent verdict is taken off the wire: a local server records the # header a real apt-get update sent it, so what is asserted is what apt # announces, not what the file says it should announce (docs/traps.md, # "Asserting the configuration is not asserting the behaviour"). The source -# URIs are likewise read back from apt, which is asked what it would fetch -# from the stanzas conf/bootstrap_apt generates. +# URIs conf/bootstrap_apt writes are tested in tests/apt-sources.bats. # # Every refutation is written "run ! cmd", never a bare "! cmd": bash does not # apply errexit to a negated command, so a bare one passes whatever happens @@ -23,7 +21,6 @@ setup() { REPO="$(cd "$TESTS_DIR/.." && pwd)" SCRIPT="$REPO/conf/turnkey.d/apt-identity" SHIPPED="$REPO/overlays/turnkey.d/apt-identity/etc/apt/apt.conf.d" - BOOTSTRAP="$REPO/conf/bootstrap_apt" RECORDER="$TESTS_DIR/ua-recorder.py" # a scratch apt root: everything apt reads and writes is under here @@ -176,83 +173,3 @@ sent_user_agents() { [ "$status" -eq 1 ] [[ "$output" == *apt.conf.d* ]] } - -# ------------------------------------------- the URIs the bootstrap generates - -# the body of the heredoc conf/bootstrap_apt writes to the named source file -stanza() { - sed -n "/^ *cat > \$SOURCES_LIST\/$1 <&2 - return 1 - } - local KEY_CODENAME=trixie CODENAME=trixie - local MIRROR_URL=http://deb.debian.org/debian - local SEC_MIRROR=http://security.debian.org/debian-security - local sec_repo=trixie-security - local tkl_apt_repo_enabled=yes tkl_apt_testing_enabled=yes - local debian_backports_enabled=yes - local SUPPORTED_ARCH=(amd64 arm64) - local debian_components=(main non-free-firmware) - eval "cat < "$APTROOT/etc/apt/sources.list.d/$f" - done -} - -@test "no source the bootstrap writes fetches the turnkey archive over plain http" { - write_all_sources - fetch_uris > "$BATS_TEST_TMPDIR/uris" - [ -s "$BATS_TEST_TMPDIR/uris" ] - run ! grep -q '^http://archive\.turnkeylinux\.org' "$BATS_TEST_TMPDIR/uris" -} - -@test "the turnkey archive is fetched over https, in all three suites" { - write_all_sources - run fetch_uris - [ "$status" -eq 0 ] - local suite - for suite in trixie trixie-security trixie-testing; do - grep -q "^https://archive\.turnkeylinux\.org/debian/dists/$suite/" <<< "$output" - done -} - -@test "the debian sources are left as Debian ships them" { - write_all_sources - run fetch_uris - [ "$status" -eq 0 ] - grep -q '^http://deb\.debian\.org/debian/dists/trixie/' <<< "$output" - grep -q '^http://security\.debian\.org/debian-security/dists/trixie-security/' <<< "$output" - grep -q '^http://deb\.debian\.org/debian/dists/trixie-backports/' <<< "$output" -} - -@test "the legacy sources.list the bootstrap writes for older releases is https too" { - # the pre deb822 branch of conf/bootstrap_apt, still reached for bookworm - grep -n 'deb .*archive\.turnkeylinux\.org' "$BOOTSTRAP" > "$BATS_TEST_TMPDIR/legacy" - [ -s "$BATS_TEST_TMPDIR/legacy" ] - run ! grep -q 'http://archive\.turnkeylinux\.org' "$BATS_TEST_TMPDIR/legacy" -} diff --git a/tests/apt-sources.bats b/tests/apt-sources.bats new file mode 100644 index 00000000..5ceb43bb --- /dev/null +++ b/tests/apt-sources.bats @@ -0,0 +1,380 @@ +#!/usr/bin/env bats +# Tests for the package sources a Keel image ships (handbook decisions 0016, +# 0039 and 0043, tracker#23): +# +# conf/bootstrap_apt Debian's sources: debian.sources, +# security.sources, debian-backports +# overlays/turnkey.d/keel-apt the Keel archive and its pin +# conf/turnkey.d/keel-apt refuses an image whose sources +# name the TurnKey archive or whose +# Keel keyring is missing +# conf/turnkey.d/cronapt the security-only cron-apt action +# plans/turnkey/base the keyring package +# +# Every verdict about what apt fetches or installs is taken from apt itself: +# it is asked which index files it would fetch, and which version it would +# install, from local archives with the Origin the real ones carry. +# +# Every refutation is written "run ! cmd", never a bare "! cmd" (SC2314). + +bats_require_minimum_version 1.5.0 + +setup() { + TESTS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")" && pwd)" + REPO="$(cd "$TESTS_DIR/.." && pwd)" + BOOTSTRAP="$REPO/conf/bootstrap_apt" + KEEL_OVERLAY="$REPO/overlays/turnkey.d/keel-apt" + KEEL_CONF="$REPO/conf/turnkey.d/keel-apt" + CRONAPT="$REPO/conf/turnkey.d/cronapt" + + APTROOT="$BATS_TEST_TMPDIR/aptroot" + SOURCES="$APTROOT/etc/apt/sources.list.d" + mkdir -p "$SOURCES" "$APTROOT/etc/apt/preferences.d" \ + "$APTROOT/etc/apt/apt.conf.d" \ + "$APTROOT/var/lib/apt/lists/partial" \ + "$APTROOT/var/cache/apt/archives/partial" "$APTROOT/var/lib/dpkg" \ + "$APTROOT/usr/share/keyrings" + : > "$APTROOT/var/lib/dpkg/status" + APT_CONFIG="$BATS_TEST_TMPDIR/apt.conf" + export APT_CONFIG + cat > "$APT_CONFIG" < \$SOURCES_LIST\/$1 <&2 + return 1 + } + local CODENAME=trixie + local MIRROR_URL=http://deb.debian.org/debian + local SEC_MIRROR=http://security.debian.org/debian-security + local sec_repo=trixie-security + local debian_backports_enabled=no + local debian_components=(main non-free-firmware) + local DEBIAN_KEYRING=/usr/share/keyrings/debian-archive-keyring.pgp + eval "cat < \$SOURCES_LIST/\([^ ]*\) < "$SOURCES/$f" + done < <(bootstrap_files) + cp -a "$KEEL_OVERLAY/etc/apt/." "$APTROOT/etc/apt/" +} + +# every index URI apt would fetch from what is in the scratch tree; $(URI) +# is apt's format field +# shellcheck disable=SC2016 +fetch_uris() { + apt-get indextargets --no-release-info --format '$(URI)' "$@" | sort -u +} + +# the hosts of those URIs +fetch_hosts() { + fetch_uris "$@" | sed -E 's|^[a-z]+://([^/]+)/.*|\1|' | sort -u +} + +# ------------------------------------------------- what the image fetches + +@test "the bootstrap writes debian, security and backports, and no TurnKey file" { + run bootstrap_files + [ "$status" -eq 0 ] + [ "$output" = "$(printf 'debian.sources\nsecurity.sources\ndebian-backports.sources')" ] +} + +@test "the bootstrap removes the files it used to write before writing its own" { + # left beside debian.sources, sources.sources names the same Debian + # archive with another Signed-By and apt refuses every source (measured + # on the step8 image: "Conflicting values set for option Signed-By") + local rm_line write_line + rm_line="$(grep -n '^rm -f \$SOURCES_LIST/sources.sources \$SOURCES_LIST/security.sources.sources \$SOURCES_LIST/turnkey-testing.sources$' "$BOOTSTRAP" | cut -d: -f1)" + write_line="$(grep -n '^cat > \$SOURCES_LIST/debian.sources <&2; return 1 ;; + esac + done <<< "$output" +} + +@test "no source or keyring names TurnKey, enabled or disabled" { + ship_sources + run ! grep -rniE 'turnkeylinux|tkl-' "$APTROOT/etc/apt" + run ! grep -niE 'turnkeylinux\.org/debian|tkl-.*keyring|tkl-archive' "$BOOTSTRAP" + [ -z "$(find "$REPO/overlays/bootstrap_apt" -name 'tkl-*')" ] + [ ! -e "$REPO/overlays/bootstrap_apt/etc/apt/preferences" ] +} + +@test "the base plan installs the Keel keyring package, not turnkey-keys" { + grep -qE '^keel-archive-keyring([[:space:]]|$)' "$REPO/plans/turnkey/base" + run ! grep -qE '^turnkey-keys' "$REPO/plans/turnkey/base" +} + +# ------------------------------------------------ the security-only upgrade + +@test "security.sources alone, as the upgrade reads it, is Debian security only" { + ship_sources + run fetch_hosts -o Dir::Etc::sourcelist="$SOURCES/security.sources" \ + -o Dir::Etc::sourceparts=/dev/null + [ "$status" -eq 0 ] + [ "$output" = security.debian.org ] +} + +@test "cron-apt's install actions read the security.sources the bootstrap writes" { + local named + named="$(grep -o 'Dir::Etc::sourcelist=[^ ]*' "$CRONAPT" | sort -u)" + [ "$named" = "Dir::Etc::sourcelist=/etc/apt/sources.list.d/security.sources" ] + [ "$(grep -c 'Dir::Etc::sourcelist=' "$CRONAPT")" -eq 2 ] + bootstrap_files | grep -qx security.sources + run ! grep -q 'security\.sources\.sources' "$CRONAPT" +} + +# ----------------------------------------------------------- the pin, live + +# make_archive NAME ORIGIN LABEL SUITE PKG=VER...: a local archive whose +# Release carries the Origin and Label given, as the real ones do +make_archive() { + local name="$1" origin="$2" label="$3" suite="$4" spec dir pkg ver + shift 4 + dir="$BATS_TEST_TMPDIR/archives/$name" + mkdir -p "$dir/dists/$suite/main/binary-amd64" + : > "$dir/dists/$suite/main/binary-amd64/Packages" + for spec in "$@"; do + pkg="${spec%%=*}" ver="${spec#*=}" + cat >> "$dir/dists/$suite/main/binary-amd64/Packages" < +Filename: pool/${pkg}_${ver}_amd64.deb +Size: 1 +SHA256: 0000000000000000000000000000000000000000000000000000000000000000 +Description: $pkg + +EOF + done + (cd "$dir/dists/$suite" && apt-ftparchive \ + -o APT::FTPArchive::Release::Origin="$origin" \ + -o APT::FTPArchive::Release::Label="$label" \ + -o APT::FTPArchive::Release::Suite="$suite" \ + -o APT::FTPArchive::Release::Codename="$suite" \ + release . > Release) + printf 'Types: deb\nURIs: file:%s\nSuites: %s\nComponents: main\nTrusted: yes\n' \ + "$dir" "$suite" > "$SOURCES/$name.sources" +} + +# installed PKG=VER...: dpkg status entries +installed() { + local spec + for spec in "$@"; do + printf 'Package: %s\nStatus: install ok installed\nVersion: %s\nArchitecture: amd64\nMaintainer: t \nDescription: x\n\n' \ + "${spec%%=*}" "${spec#*=}" >> "$APTROOT/var/lib/dpkg/status" + done +} + +candidate() { + apt-cache policy "$1" | sed -n 's/^ *Candidate: //p' +} + +pin_setup() { + cp -a "$KEEL_OVERLAY/etc/apt/preferences.d/." "$APTROOT/etc/apt/preferences.d/" + make_archive debian Debian Debian trixie \ + rebuilt=1.2-1 plain=3.0-1 ahead=2.0-1 + make_archive keel "Keel Linux" "Keel Linux" trixie \ + rebuilt=1.1-1+keel1 ahead=2.0+keel5 ours=0.3.5 + apt-get update -qq 2>/dev/null +} + +@test "the pin is on the Origin of the Keel archive, at 990" { + local pin="$KEEL_OVERLAY/etc/apt/preferences.d/keel" + grep -qx 'Package: \*' "$pin" + grep -qx 'Pin: release o=Keel Linux' "$pin" + grep -qx 'Pin-Priority: 990' "$pin" +} + +@test "a Keel package wins over a higher Debian version of the same name" { + pin_setup + installed rebuilt=1.0-1 + [ "$(candidate rebuilt)" = 1.1-1+keel1 ] + [ "$(candidate plain)" = 3.0-1 ] + [ "$(candidate ours)" = 0.3.5 ] +} + +@test "a Keel rebuild is kept when Debian publishes a higher version" { + pin_setup + installed rebuilt=1.1-1+keel1 + [ "$(candidate rebuilt)" = 1.1-1+keel1 ] + run apt-get -s upgrade + run ! grep -q '^Inst rebuilt' <<< "$output" +} + +@test "nothing newer than the Keel archive is downgraded (tracker#23)" { + pin_setup + # what a test build installs: newer than what the archive publishes + installed ours=0.10.2 ahead=2.0+keel11 + [ "$(candidate ours)" = 0.10.2 ] + [ "$(candidate ahead)" = 2.0+keel11 ] + run apt-get -s upgrade + [ "$status" -eq 0 ] + run ! grep -qE '^Inst (ours|ahead) .*\[' <<< "$output" + run apt-get -s dist-upgrade + [ "$status" -eq 0 ] + run ! grep -q 'DOWNGRADED' <<< "$output" +} + +@test "a package only Debian carries is left to Debian's own policy" { + pin_setup + installed plain=2.0-1 + [ "$(candidate plain)" = 3.0-1 ] + run apt-get -s upgrade + grep -q '^Inst plain \[2\.0-1\] (3\.0-1 ' <<< "$output" +} + +# ---------------------------------------------------- conf/turnkey.d/keel-apt + +conf_tree() { + ship_sources + : > "$APTROOT/usr/share/keyrings/keel-archive-keyring.gpg" +} + +@test "the conf script passes a tree with Keel's sources and keyring" { + conf_tree + APT_ROOT="$APTROOT" run "$KEEL_CONF" + [ "$status" -eq 0 ] +} + +@test "the conf script refuses an image without the Keel keyring" { + conf_tree + rm "$APTROOT/usr/share/keyrings/keel-archive-keyring.gpg" + APT_ROOT="$APTROOT" run "$KEEL_CONF" + [ "$status" -eq 1 ] + [[ "$output" == *keel-archive-keyring* ]] +} + +@test "the conf script refuses an image without keel.sources" { + conf_tree + rm "$SOURCES/keel.sources" + APT_ROOT="$APTROOT" run "$KEEL_CONF" + [ "$status" -eq 1 ] + [[ "$output" == *keel.sources* ]] +} + +@test "the conf script removes TurnKey's files a parent layer left" { + conf_tree + # what a layer built on a bootstrap from before this change inherits + printf 'Types: deb\nURIs: https://archive.turnkeylinux.org/debian\n' \ + > "$SOURCES/sources.sources" + cp "$SOURCES/sources.sources" "$SOURCES/security.sources.sources" + cp "$SOURCES/sources.sources" "$SOURCES/turnkey-testing.sources" + printf 'Package: *\nPin: release o=turnkeylinux\nPin-Priority: 999\n' \ + > "$APTROOT/etc/apt/preferences" + : > "$APTROOT/usr/share/keyrings/tkl-archive-keyring.gpg" + : > "$APTROOT/usr/share/keyrings/tkl-trixie-main.asc" + APT_ROOT="$APTROOT" run "$KEEL_CONF" + [ "$status" -eq 0 ] + [ ! -e "$SOURCES/sources.sources" ] + [ ! -e "$SOURCES/security.sources.sources" ] + [ ! -e "$SOURCES/turnkey-testing.sources" ] + [ ! -e "$APTROOT/etc/apt/preferences" ] + [ ! -e "$APTROOT/usr/share/keyrings/tkl-trixie-main.asc" ] + run fetch_hosts + [ "$output" = "$(printf 'archive.keellinux.org\ndeb.debian.org\nsecurity.debian.org')" ] +} + +@test "the conf script refuses any other source that names the TurnKey archive" { + conf_tree + printf 'deb https://archive.turnkeylinux.org/debian trixie main\n' \ + > "$SOURCES/recipe.list" + APT_ROOT="$APTROOT" run "$KEEL_CONF" + [ "$status" -eq 1 ] + [[ "$output" == *recipe.list* ]] +} + +@test "the conf script leaves an operator's own preferences file alone" { + conf_tree + printf 'Package: foo\nPin: release a=trixie-backports\nPin-Priority: 500\n' \ + > "$APTROOT/etc/apt/preferences" + APT_ROOT="$APTROOT" run "$KEEL_CONF" + [ "$status" -eq 0 ] + [ -e "$APTROOT/etc/apt/preferences" ] +} diff --git a/tests/coverage.sh b/tests/coverage.sh index f860daf4..5062e1b1 100755 --- a/tests/coverage.sh +++ b/tests/coverage.sh @@ -21,6 +21,7 @@ targets=( "conf/turnkey.d/locale:tests/locale.bats" "conf/turnkey.d/dpkg-vendor:tests/dpkg-vendor.bats" "conf/turnkey.d/apt-identity:tests/apt-identity.bats" + "conf/turnkey.d/keel-apt:tests/apt-sources.bats" "conf/samba-rootpass:tests/samba-rootpass.bats" "conf/desktop:tests/desktop.bats" "conf/turnkey.d/rootpass:tests/rootpass.bats" diff --git a/overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-main.asc b/tests/fixtures/tkl-trixie-main.asc similarity index 100% rename from overlays/bootstrap_apt/usr/share/keyrings/tkl-trixie-main.asc rename to tests/fixtures/tkl-trixie-main.asc From 9e18ea3f2676171ce113c4b14ac4deb100107cc0 Mon Sep 17 00:00:00 2001 From: navigator Date: Fri, 2 Oct 2026 13:55:44 +0000 Subject: [PATCH 2/5] fix: keel-apt purges turnkey-keys and checks every apt trust path Review of #30: - turnkey-keys is purged with dpkg -P instead of its files being deleted by hand, so the package's files go with its dpkg record. - The build fails when anything still names TurnKey: /etc/apt/sources.list, sources.list.d, preferences, preferences.d, a tkl-* keyring no package owns, or a key in trusted.gpg or trusted.gpg.d whose user id is TurnKey's (read with gpg, so a renamed file is caught). - keel.sources must hold an enabled archive.keellinux.org trixie stanza: seven appliance recipes ship their own keel.sources, apt.keellinux.org and disabled, at the same path, and a recipe overlay wins. - keel-archive-keyring must be installed and at least 0.1.1. --- COVERAGE.md | 2 +- changes/turnkey.changelog | 14 +++- conf/turnkey.d/keel-apt | 83 ++++++++++++++++--- tests/apt-sources.bats | 163 +++++++++++++++++++++++++++++++++++--- 4 files changed, 234 insertions(+), 28 deletions(-) diff --git a/COVERAGE.md b/COVERAGE.md index 17684c53..da5050f9 100644 --- a/COVERAGE.md +++ b/COVERAGE.md @@ -6,7 +6,7 @@ file our changes touch). ## Branch fix/keel-apt-sources: 100 percent, one new file (2026-10-02) -`conf/turnkey.d/keel-apt` is measured for the first time: 11 of 11 lines, +`conf/turnkey.d/keel-apt` is measured for the first time: 35 of 35 lines, kcov 43 on Debian 13, from `tests/apt-sources.bats`. The suite also reads back from apt what the sources of `conf/bootstrap_apt` and `overlays/turnkey.d/keel-apt` fetch, and which version the pin makes the diff --git a/changes/turnkey.changelog b/changes/turnkey.changelog index 163bf3e0..5f0692a1 100644 --- a/changes/turnkey.changelog +++ b/changes/turnkey.changelog @@ -37,10 +37,16 @@ turnkey-core-19.0 (1) turnkey; urgency=low pin above 1000 does (tracker#23). tests/apt-sources.bats asserts both against apt itself, and fails at 1001 and at 500. - * conf/turnkey.d/keel-apt stops a build whose image lacks keel.sources or - the Keel keyring, or has a source naming the TurnKey archive. It - removes, by name, TurnKey's files a layer inherits from a parent built - before this change, as conf/turnkey.d/apt-identity does for 01turnkey. + * conf/turnkey.d/keel-apt stops a build whose image lacks an enabled + archive.keellinux.org trixie stanza in keel.sources (seven appliance + recipes ship their own keel.sources, disabled, at that path), whose + keel-archive-keyring is missing or older than 0.1.1, or where anything + still names TurnKey: /etc/apt/sources.list, sources.list.d, + preferences, preferences.d, a tkl-* keyring, or a key in trusted.gpg or + trusted.gpg.d whose user id is TurnKey's. turnkey-keys a parent layer + installed is purged with dpkg -P, so its files go with its record; the + source files TurnKey's bootstrap wrote are removed by name, as + conf/turnkey.d/apt-identity does for 01turnkey. * cron-apt's install actions read security.sources. diff --git a/conf/turnkey.d/keel-apt b/conf/turnkey.d/keel-apt index 8a4f5934..a6b2e610 100755 --- a/conf/turnkey.d/keel-apt +++ b/conf/turnkey.d/keel-apt @@ -6,33 +6,90 @@ # keel-archive-keyring package installs. # # A layer built on a bootstrap or a parent layer from before this change -# still carries TurnKey's apt files by their known names, the same way a -# stale 01turnkey outlived 01keel (conf/turnkey.d/apt-identity). Those are -# removed by name. Any other source that names the TurnKey archive stops -# the build, because it was written by something this script does not know. +# still carries TurnKey's apt files: the source files TurnKey's bootstrap +# wrote, removed by their names as conf/turnkey.d/apt-identity removes +# 01turnkey, and turnkey-keys, which is purged through dpkg so that what it +# owns goes with its record. Anything else that names TurnKey as a source, +# a key or a pin stops the build, because something this script does not +# know put it there. # # APT_ROOT is a test hook; a build leaves it unset. fatal() { echo "'$(basename "$0")' Error: $*" >&2; exit 1; } root="${APT_ROOT:-}" -sources="$root/etc/apt/sources.list.d" +apt="$root/etc/apt" +sources="$apt/sources.list.d" keyrings="$root/usr/share/keyrings" +dpkg_root=() +[ -z "$root" ] || dpkg_root=(--root="$root") + +# 0.1.0 shipped the key with a signing subkey that 0.1.1 ships revoked +KEYRING_MIN=0.1.1 + +# pkg_state NAME: "status version", empty when dpkg has no record of NAME +pkg_state() { + # ${...} is dpkg-query's format, not the shell's + # shellcheck disable=SC2016 + dpkg-query "${dpkg_root[@]}" -W -f='${db:Status-Status} ${Version}\n' "$1" 2>/dev/null || true +} + +# turnkey_keys FILE: true when the OpenPGP keys in FILE name TurnKey +turnkey_keys() { + local home + home="$(mktemp -d)" + gpg --homedir "$home" --batch --quiet --show-keys --with-colons "$1" 2>/dev/null \ + | grep -E '^uid:' | grep -qi turnkey + local found=$? + rm -rf "$home" + return $found +} + +# --- the Keel source and its key [ -f "$sources/keel.sources" ] \ || fatal "'$sources/keel.sources' is missing - it is shipped by overlays/turnkey.d/keel-apt" +# a recipe overlay at the same path wins over common's, so what is there is +# read, not assumed +# (one stanza a record: URIs the Keel archive, Suites trixie, not disabled) +stable='BEGIN { RS = "" } /(^|\n)URIs:[ \t]*https:\/\/archive\.keellinux\.org\/?[ \t]*(\n|$)/ && /(^|\n)Suites:[ \t]*trixie[ \t]*(\n|$)/ && !/(^|\n)Enabled:[ \t]*no[ \t]*(\n|$)/ { found = 1 } END { exit !found }' +awk "$stable" "$sources/keel.sources" \ + || fatal "'$sources/keel.sources' has no enabled https://archive.keellinux.org trixie stanza - a recipe overlay may have replaced common's" + [ -f "$keyrings/keel-archive-keyring.gpg" ] \ || fatal "'$keyrings/keel-archive-keyring.gpg' is missing - install keel-archive-keyring (plans/turnkey/base)" +read -r state version <<< "$(pkg_state keel-archive-keyring)" +[ "$state" = installed ] \ + || fatal "keel-archive-keyring is not installed, so nothing owns '$keyrings/keel-archive-keyring.gpg'" +dpkg --compare-versions "$version" ge "$KEYRING_MIN" \ + || fatal "keel-archive-keyring $version is older than $KEYRING_MIN" + +# --- what a parent layer from before this change left -# TurnKey's own files, by the names its bootstrap gave them +read -r state _ <<< "$(pkg_state turnkey-keys)" +if [ -n "$state" ] && [ "$state" != not-installed ]; then + dpkg "${dpkg_root[@]}" -P turnkey-keys +fi rm -f "$sources/sources.sources" "$sources/security.sources.sources" \ "$sources/turnkey-testing.sources" -rm -f "$keyrings"/tkl-*.asc "$keyrings"/tkl-*.gpg -if [ -f "$root/etc/apt/preferences" ] \ - && grep -q '^Pin: release o=turnkeylinux$' "$root/etc/apt/preferences"; then - rm -f "$root/etc/apt/preferences" +if [ -f "$apt/preferences" ] \ + && grep -q '^Pin: release o=turnkeylinux$' "$apt/preferences"; then + rm -f "$apt/preferences" fi -found="$(grep -rlE 'turnkeylinux\.org' "$sources" 2>/dev/null || true)" -[ -z "$found" ] \ - || fatal "these apt sources name the TurnKey archive, which is no package source of a Keel image: $found" +# --- nothing names TurnKey as a source, a key or a pin + +found=() +named="$(grep -rlsE 'turnkeylinux\.org|o=turnkeylinux' "$apt/sources.list" "$sources" "$apt/preferences" "$apt/preferences.d" || true)" +while IFS= read -r f; do + [ -z "$f" ] || found+=("$f") +done <<< "$named" +for f in "$keyrings"/tkl-*; do + [ -e "$f" ] && found+=("$f") +done +for f in "$apt/trusted.gpg" "$apt"/trusted.gpg.d/*; do + [ -f "$f" ] && turnkey_keys "$f" && found+=("$f") +done +[ "${#found[@]}" -eq 0 ] \ + || fatal "these name TurnKey, which is no package source of a Keel image: ${found[*]}" +exit 0 diff --git a/tests/apt-sources.bats b/tests/apt-sources.bats index 5ceb43bb..6ca4ac6c 100644 --- a/tests/apt-sources.bats +++ b/tests/apt-sources.bats @@ -116,6 +116,8 @@ fetch_hosts() { [ "$output" = "$(printf 'debian.sources\nsecurity.sources\ndebian-backports.sources')" ] } +# the \$ in the patterns are grep's, not the shell's +# shellcheck disable=SC2016 @test "the bootstrap removes the files it used to write before writing its own" { # left beside debian.sources, sources.sources names the same Debian # archive with another Signed-By and apt refuses every source (measured @@ -312,34 +314,130 @@ pin_setup() { # ---------------------------------------------------- conf/turnkey.d/keel-apt +# dpkg-query and dpkg as the conf script sees them in the image: the +# installed packages are the lines of $PKGS ("name status version"). dpkg +# records its calls, and its purge of turnkey-keys removes what that package +# owns, as the real one does; --compare-versions is the real dpkg. +stub_dpkg() { + PKGS="$BATS_TEST_TMPDIR/pkgs" + : > "$PKGS" + local bin="$BATS_TEST_TMPDIR/bin" + mkdir -p "$bin" + cat > "$bin/dpkg-query" <&2; exit 1; } +echo "\$line" +STUB + cat > "$bin/dpkg" <> "$BATS_TEST_TMPDIR/dpkg.calls" +if [ "\${@: -1}" = turnkey-keys ] && [[ " \$* " == *" -P "* ]]; then + rm -f "$APTROOT"/usr/share/keyrings/tkl-* + sed -i '/^turnkey-keys /d' "$PKGS" +fi +STUB + chmod +x "$bin/dpkg-query" "$bin/dpkg" + PATH="$bin:$PATH" +} + +installed_pkg() { + echo "$1 installed $2" >> "$PKGS" +} + conf_tree() { + stub_dpkg ship_sources : > "$APTROOT/usr/share/keyrings/keel-archive-keyring.gpg" + installed_pkg keel-archive-keyring 0.1.1 +} + +run_conf() { + APT_ROOT="$APTROOT" run "$KEEL_CONF" } @test "the conf script passes a tree with Keel's sources and keyring" { conf_tree - APT_ROOT="$APTROOT" run "$KEEL_CONF" + run_conf [ "$status" -eq 0 ] + [ ! -e "$BATS_TEST_TMPDIR/dpkg.calls" ] } @test "the conf script refuses an image without the Keel keyring" { conf_tree rm "$APTROOT/usr/share/keyrings/keel-archive-keyring.gpg" - APT_ROOT="$APTROOT" run "$KEEL_CONF" + run_conf [ "$status" -eq 1 ] [[ "$output" == *keel-archive-keyring* ]] } +@test "the conf script refuses a keyring package older than 0.1.1" { + # 0.1.0 carries the signing subkey that 0.1.1 ships revoked + conf_tree + sed -i 's/^keel-archive-keyring installed .*/keel-archive-keyring installed 0.1.0/' "$PKGS" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"0.1.0"* ]] + [[ "$output" == *"0.1.1"* ]] +} + +@test "the conf script refuses a keyring file no package installed" { + conf_tree + : > "$PKGS" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"keel-archive-keyring is not installed"* ]] +} + @test "the conf script refuses an image without keel.sources" { conf_tree rm "$SOURCES/keel.sources" - APT_ROOT="$APTROOT" run "$KEEL_CONF" + run_conf [ "$status" -eq 1 ] [[ "$output" == *keel.sources* ]] } -@test "the conf script removes TurnKey's files a parent layer left" { +@test "the conf script refuses a keel.sources whose stable track is not enabled" { + # what seven appliance recipes ship in their overlay at the same path, + # which wins over common's: apt.keellinux.org, Enabled: no + conf_tree + printf 'Types: deb\nURIs: https://apt.keellinux.org\nSuites: trixie\nComponents: main\nEnabled: no\nSigned-By: /usr/share/keyrings/keel-archive-keyring.gpg\n' \ + > "$SOURCES/keel.sources" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"no enabled https://archive.keellinux.org trixie stanza"* ]] +} + +@test "the conf script purges turnkey-keys, never deleting its files by hand" { + conf_tree + installed_pkg turnkey-keys 0.1 + : > "$APTROOT/usr/share/keyrings/tkl-archive-keyring.gpg" + : > "$APTROOT/usr/share/keyrings/tkl-trixie-main.asc" + run_conf + [ "$status" -eq 0 ] + [ "$(cat "$BATS_TEST_TMPDIR/dpkg.calls")" = "--root=$APTROOT -P turnkey-keys" ] + [ ! -e "$APTROOT/usr/share/keyrings/tkl-trixie-main.asc" ] +} + +@test "the conf script purges turnkey-keys left as config-files too" { + conf_tree + echo "turnkey-keys config-files 0.1" >> "$PKGS" + run_conf + [ "$status" -eq 0 ] + grep -qx -- "--root=$APTROOT -P turnkey-keys" "$BATS_TEST_TMPDIR/dpkg.calls" +} + +@test "the conf script refuses a TurnKey keyring no package owns" { + conf_tree + : > "$APTROOT/usr/share/keyrings/tkl-trixie-main.asc" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *tkl-trixie-main.asc* ]] +} + +@test "the conf script removes TurnKey's source files a parent layer left" { conf_tree # what a layer built on a bootstrap from before this change inherits printf 'Types: deb\nURIs: https://archive.turnkeylinux.org/debian\n' \ @@ -348,15 +446,12 @@ conf_tree() { cp "$SOURCES/sources.sources" "$SOURCES/turnkey-testing.sources" printf 'Package: *\nPin: release o=turnkeylinux\nPin-Priority: 999\n' \ > "$APTROOT/etc/apt/preferences" - : > "$APTROOT/usr/share/keyrings/tkl-archive-keyring.gpg" - : > "$APTROOT/usr/share/keyrings/tkl-trixie-main.asc" - APT_ROOT="$APTROOT" run "$KEEL_CONF" + run_conf [ "$status" -eq 0 ] [ ! -e "$SOURCES/sources.sources" ] [ ! -e "$SOURCES/security.sources.sources" ] [ ! -e "$SOURCES/turnkey-testing.sources" ] [ ! -e "$APTROOT/etc/apt/preferences" ] - [ ! -e "$APTROOT/usr/share/keyrings/tkl-trixie-main.asc" ] run fetch_hosts [ "$output" = "$(printf 'archive.keellinux.org\ndeb.debian.org\nsecurity.debian.org')" ] } @@ -365,16 +460,64 @@ conf_tree() { conf_tree printf 'deb https://archive.turnkeylinux.org/debian trixie main\n' \ > "$SOURCES/recipe.list" - APT_ROOT="$APTROOT" run "$KEEL_CONF" + run_conf [ "$status" -eq 1 ] [[ "$output" == *recipe.list* ]] } +@test "the conf script refuses a TurnKey source in /etc/apt/sources.list" { + conf_tree + printf 'deb http://archive.turnkeylinux.org/debian trixie main\n' \ + > "$APTROOT/etc/apt/sources.list" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"/etc/apt/sources.list"* ]] +} + +@test "the conf script refuses a TurnKey key in trusted.gpg.d, by its user id" { + # renamed, so only the key itself says whose it is + conf_tree + mkdir -p "$APTROOT/etc/apt/trusted.gpg.d" + cp "$TESTS_DIR/fixtures/tkl-trixie-main.asc" "$APTROOT/etc/apt/trusted.gpg.d/vendor.asc" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *trusted.gpg.d/vendor.asc* ]] +} + +@test "the conf script refuses a TurnKey key in the legacy trusted.gpg" { + conf_tree + gpg --dearmor < "$TESTS_DIR/fixtures/tkl-trixie-main.asc" > "$APTROOT/etc/apt/trusted.gpg" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"/etc/apt/trusted.gpg"* ]] +} + +@test "the conf script accepts Debian's keys in trusted.gpg.d" { + conf_tree + mkdir -p "$APTROOT/etc/apt/trusted.gpg.d" + local k + for k in /usr/share/keyrings/debian-archive-trixie-*.pgp; do + [ -e "$k" ] || skip "no Debian archive keys on this host" + cp "$k" "$APTROOT/etc/apt/trusted.gpg.d/" + done + run_conf + [ "$status" -eq 0 ] +} + +@test "the conf script refuses a TurnKey pin in preferences.d" { + conf_tree + printf 'Package: *\nPin: release o=turnkeylinux\nPin-Priority: 999\n' \ + > "$APTROOT/etc/apt/preferences.d/turnkey" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *preferences.d/turnkey* ]] +} + @test "the conf script leaves an operator's own preferences file alone" { conf_tree printf 'Package: foo\nPin: release a=trixie-backports\nPin-Priority: 500\n' \ > "$APTROOT/etc/apt/preferences" - APT_ROOT="$APTROOT" run "$KEEL_CONF" + run_conf [ "$status" -eq 0 ] [ -e "$APTROOT/etc/apt/preferences" ] } From b85acee1cd52a8fc4ecbcf53dc15ab90795db880 Mon Sep 17 00:00:00 2001 From: navigator Date: Fri, 2 Oct 2026 14:43:57 +0000 Subject: [PATCH 3/5] fix: keel-apt fails the build unless the Keel pin is 990 Seven appliance recipes ship /etc/apt/preferences.d/keel at 1001 in their overlay, which wins over common's 990 at the same path, and 1001 downgrades every package newer than the archive's (tracker#23). Every stanza pinning o=Keel Linux in /etc/apt/preferences and preferences.d must say 990, and there must be one. The build's own pool pin, o=Keel Linux Pool at 1001, is not matched: removelists-final takes it out. --- COVERAGE.md | 2 +- changes/turnkey.changelog | 5 ++++- conf/turnkey.d/keel-apt | 22 ++++++++++++++++++ tests/apt-sources.bats | 47 +++++++++++++++++++++++++++++++++++++++ 4 files changed, 74 insertions(+), 2 deletions(-) diff --git a/COVERAGE.md b/COVERAGE.md index da5050f9..714ce819 100644 --- a/COVERAGE.md +++ b/COVERAGE.md @@ -6,7 +6,7 @@ file our changes touch). ## Branch fix/keel-apt-sources: 100 percent, one new file (2026-10-02) -`conf/turnkey.d/keel-apt` is measured for the first time: 35 of 35 lines, +`conf/turnkey.d/keel-apt` is measured for the first time: 44 of 44 lines, kcov 43 on Debian 13, from `tests/apt-sources.bats`. The suite also reads back from apt what the sources of `conf/bootstrap_apt` and `overlays/turnkey.d/keel-apt` fetch, and which version the pin makes the diff --git a/changes/turnkey.changelog b/changes/turnkey.changelog index 5f0692a1..fef31ab6 100644 --- a/changes/turnkey.changelog +++ b/changes/turnkey.changelog @@ -40,7 +40,10 @@ turnkey-core-19.0 (1) turnkey; urgency=low * conf/turnkey.d/keel-apt stops a build whose image lacks an enabled archive.keellinux.org trixie stanza in keel.sources (seven appliance recipes ship their own keel.sources, disabled, at that path), whose - keel-archive-keyring is missing or older than 0.1.1, or where anything + keel-archive-keyring is missing or older than 0.1.1, whose pin on + o=Keel Linux is missing or anything but 990 in /etc/apt/preferences or + preferences.d (seven recipes shipped preferences.d/keel at 1001; the + build's o=Keel Linux Pool pin is the removelist's), or where anything still names TurnKey: /etc/apt/sources.list, sources.list.d, preferences, preferences.d, a tkl-* keyring, or a key in trusted.gpg or trusted.gpg.d whose user id is TurnKey's. turnkey-keys a parent layer diff --git a/conf/turnkey.d/keel-apt b/conf/turnkey.d/keel-apt index a6b2e610..a2abd961 100755 --- a/conf/turnkey.d/keel-apt +++ b/conf/turnkey.d/keel-apt @@ -26,6 +26,8 @@ dpkg_root=() # 0.1.0 shipped the key with a signing subkey that 0.1.1 ships revoked KEYRING_MIN=0.1.1 +# the one priority the Keel pin may have, overlays/turnkey.d/keel-apt's +KEEL_PIN_PRIORITY=990 # pkg_state NAME: "status version", empty when dpkg has no record of NAME pkg_state() { @@ -64,6 +66,26 @@ read -r state version <<< "$(pkg_state keel-archive-keyring)" dpkg --compare-versions "$version" ge "$KEYRING_MIN" \ || fatal "keel-archive-keyring $version is older than $KEYRING_MIN" +# --- the Keel pin is 990 wherever it is (tracker#23): above 1000 it +# downgrades every package newer than the archive's, and a recipe overlay +# at preferences.d/keel wins over common's + +pin_files=() +for f in "$apt/preferences" "$apt"/preferences.d/*; do + [ -f "$f" ] && pin_files+=("$f") +done +# each stanza pinning o=Keel Linux (not the build's o=Keel Linux Pool), as +# "FILE: PRIORITY"; the $ are awk's +# shellcheck disable=SC2016 +pin_prog='BEGIN { RS = "" } /(^|\n)Pin:[ \t]*release[ \t]+o=Keel Linux[ \t]*(,[^\n]*)?(\n|$)/ { p = "none"; n = split($0, l, "\n"); for (i = 1; i <= n; i++) if (l[i] ~ /^Pin-Priority:/) { p = l[i]; sub(/^Pin-Priority:[ \t]*/, "", p) } print FILENAME ": " p }' +pins="" +[ "${#pin_files[@]}" -eq 0 ] || pins="$(awk "$pin_prog" "${pin_files[@]}")" +[ -n "$pins" ] \ + || fatal "no pin on o=Keel Linux in $apt/preferences or preferences.d - it is shipped by overlays/turnkey.d/keel-apt" +bad="$(grep -v ": $KEEL_PIN_PRIORITY\$" <<< "$pins" || true)" +[ -z "$bad" ] \ + || fatal "the Keel pin must be Pin-Priority $KEEL_PIN_PRIORITY (tracker#23): $(tr '\n' ' ' <<< "$bad")" + # --- what a parent layer from before this change left read -r state _ <<< "$(pkg_state turnkey-keys)" diff --git a/tests/apt-sources.bats b/tests/apt-sources.bats index 6ca4ac6c..df485d7e 100644 --- a/tests/apt-sources.bats +++ b/tests/apt-sources.bats @@ -521,3 +521,50 @@ run_conf() { [ "$status" -eq 0 ] [ -e "$APTROOT/etc/apt/preferences" ] } + +# ------------------------------------------------- the Keel pin must be 990 + +@test "the conf script refuses a Keel pin at 1001, as recipe overlays shipped" { + conf_tree + printf 'Package: *\nPin: release o=Keel Linux\nPin-Priority: 1001\n' \ + > "$APTROOT/etc/apt/preferences.d/keel" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"preferences.d/keel"* ]] + [[ "$output" == *1001* ]] +} + +@test "the conf script refuses an image with no Keel pin" { + conf_tree + rm "$APTROOT/etc/apt/preferences.d/keel" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"no pin on o=Keel Linux"* ]] +} + +@test "the conf script refuses a second Keel pin at another priority anywhere" { + conf_tree + printf 'Package: *\nPin: release o=Keel Linux\nPin-Priority: 1001\n' \ + > "$APTROOT/etc/apt/preferences" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"/etc/apt/preferences"* ]] +} + +@test "the conf script refuses a Keel pin without a priority line" { + conf_tree + printf 'Package: *\nPin: release o=Keel Linux\n' > "$APTROOT/etc/apt/preferences.d/keel" + run_conf + [ "$status" -eq 1 ] + [[ "$output" == *"preferences.d/keel"* ]] +} + +@test "the conf script leaves the build's pool pin, o=Keel Linux Pool at 1001, to the removelist" { + # the captured pool a pinned build reads (decision 0012): its pin is the + # pool's, removed by removelists-final/turnkey before the image is packed + conf_tree + printf 'Package: *\nPin: release o=Keel Linux Pool\nPin-Priority: 1001\n' \ + > "$APTROOT/etc/apt/preferences.d/keel-pool" + run_conf + [ "$status" -eq 0 ] +} From 2a0e470993321c3f6f05adc77e01704b44456f08 Mon Sep 17 00:00:00 2001 From: navigator Date: Fri, 2 Oct 2026 15:04:28 +0000 Subject: [PATCH 4/5] fix: the final removelist takes out the recipes' build-only staging pin The seven recipes that read the staging archive now pin it at 1001 for the build only, in /etc/apt/preferences.d/keel-staging, instead of shipping /etc/apt/preferences.d/keel at 1001 in their overlay. The removelist takes it out with the staging source, whether or not a recipe remembers to. --- removelists-final/turnkey | 5 ++++- tests/apt-sources.bats | 13 +++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/removelists-final/turnkey b/removelists-final/turnkey index 438d713d..22826320 100644 --- a/removelists-final/turnkey +++ b/removelists-final/turnkey @@ -41,8 +41,11 @@ # arrangement that holds whether or not a recipe remembers to, which is why it # belongs here: the same defect has now had to be fixed in four recipes. The # '~' prefix is a glob, so a build that used no staging archive passes over -# these three silently. +# these silently. preferences.d/keel-staging is the build-only pin at 1001 +# the recipes give the staging archive so it wins over TurnKey's 999 pin +# during their upgrade; left in an image, it would pin a source that is gone. ~/etc/apt/sources.list.d/keel-staging.list +~/etc/apt/preferences.d/keel-staging ~/etc/apt/keyrings/keel-staging-keyring.asc ~/srv/keel-apt diff --git a/tests/apt-sources.bats b/tests/apt-sources.bats index df485d7e..65548417 100644 --- a/tests/apt-sources.bats +++ b/tests/apt-sources.bats @@ -568,3 +568,16 @@ run_conf() { run_conf [ "$status" -eq 0 ] } + +@test "the final removelist takes out every build time apt file, the staging pin included" { + # the recipes pin the staging archive at 1001 for the build only + # (preferences.d/keel-staging); the removelist is what holds whether or + # not a recipe remembers to remove it + local list="$REPO/removelists-final/turnkey" path + for path in /etc/apt/sources.list.d/keel-staging.list \ + /etc/apt/preferences.d/keel-staging \ + /etc/apt/keyrings/keel-staging-keyring.asc /srv/keel-apt \ + /etc/apt/sources.list.d/keel-pool.sources /etc/apt/preferences.d/keel-pool; do + grep -qxF "~$path" "$list" + done +} From 1ba96a039b72c9eb18c9086c45ce01ce574d4a66 Mon Sep 17 00:00:00 2001 From: navigator Date: Fri, 2 Oct 2026 15:04:39 +0000 Subject: [PATCH 5/5] docs: changelog entry for the staging pin in the final removelist --- changes/turnkey.changelog | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/turnkey.changelog b/changes/turnkey.changelog index fef31ab6..b2e365ea 100644 --- a/changes/turnkey.changelog +++ b/changes/turnkey.changelog @@ -53,6 +53,11 @@ turnkey-core-19.0 (1) turnkey; urgency=low * cron-apt's install actions read security.sources. + * removelists-final/turnkey also takes out + /etc/apt/preferences.d/keel-staging, the build-only pin at 1001 the + seven recipes that read the staging archive now write instead of + shipping /etc/apt/preferences.d/keel at 1001 in their overlay. + * A login gets a UTF-8 locale. 'conf/turnkey.d/locale' wrote LC_ALL=C and LC_CTYPE=C into /etc/default/locale, which pam_env gives every login, so a shell ran in an ASCII locale and dialog, confconsole after