Merge remote branch 'mhy/master'

diff --git a/dak/admin.py b/dak/admin.py
index 2183c2293b2ad4c039d1658362b1f72ad318c22b..4e3dff26110d003f353c38f167bfef634c29a62d 100755 (executable)
--- a/dak/admin.py
+++ b/dak/admin.py
@@ -80,8 +80,10 @@ Perform administrative work on the dak database.
      s show SUITE           show config details for a suite
      s add SUITE VERSION [ label=LABEL ] [ description=DESCRIPTION ]
                          [ origin=ORIGIN ] [ codename=CODENAME ]
-                            add suite SUITE, version VERSION. label,
-                            description, origin and codename are optional.
+                         [ signingkey=SIGNINGKEY ]
+                            add suite SUITE, version VERSION.
+                            label, description, origin, codename
+                            and signingkey are optional.
 
      s add-all-arches SUITE VERSION... as "s add" but adds suite-architecture
                             relationships for all architectures
@@ -219,6 +221,9 @@ def __suite_add(d, args, addallarches=False):
             suite.description = get_field('description')
             suite.origin = get_field('origin')
             suite.codename = get_field('codename')
+            signingkey = get_field('signingkey')
+            if signingkey is not None:
+                suite.signingkeys = [signingkey.upper()]
             s.add(suite)
             s.flush()
         except IntegrityError, e:

diff --git a/dak/init_dirs.py b/dak/init_dirs.py
index 71a3831115f55540131e8bbe1682a9b1ea7c2cdb..a4703bb88b5170ef8597ea18d3eb675bacf23a0a 100755 (executable)
--- a/dak/init_dirs.py
+++ b/dak/init_dirs.py
@@ -77,6 +77,29 @@ def process_morguesubdir(subdir):
         target = os.path.join(Cnf["Dir::Morgue"], Cnf[config_name])
         do_dir(target, config_name)
 
+def process_keyring(fullpath, secret=False):
+    """Create empty keyring if necessary."""
+
+    if os.path.exists(fullpath):
+        return
+
+    keydir = os.path.dirname(fullpath)
+
+    if not os.path.isdir(keydir):
+        print "Creating %s ..." % (keydir)
+        os.makedirs(keydir)
+        if secret:
+            # Make sure secret keyring directories are 0700
+            os.chmod(keydir, 0700)
+
+    # Touch the file
+    print "Creating %s ..." % (fullpath)
+    file(fullpath, 'w')
+    if secret:
+        os.chmod(fullpath, 0600)
+    else:
+        os.chmod(fullpath, 0644)
+
 ######################################################################
 
 def create_directories():
@@ -100,6 +123,17 @@ def create_directories():
 
     suite_suffix = "%s" % (Cnf.Find("Dinstall::SuiteSuffix"))
 
+    # Process secret keyrings
+    if Cnf.has_key('Dinstall::SigningKeyring'):
+        process_keyring(Cnf['Dinstall::SigningKeyring'], secret=True)
+
+    if Cnf.has_key('Dinstall::SigningPubKeyring'):
+        process_keyring(Cnf['Dinstall::SigningPubKeyring'], secret=True)
+
+    # Process public keyrings
+    for keyring in session.query(Keyring).all():
+        process_keyring(keyring.keyring_name)
+
     # Process pool directories
     for component in session.query(Component):
         directory = os.path.join( Cnf['Dir::Pool'], component.component_name )

diff --git a/docs/README.config b/docs/README.config
index c7a59659f40bfbf4a3203c6c06fe1d59c7f9e975..7fabb4ee281b245a20afbf1f54cde999ab7d3b95 100644 (file)
--- a/docs/README.config
+++ b/docs/README.config
@@ -146,7 +146,7 @@ Dinstall
 
     //// KeyAutoFetch (optional): boolean (default: false), which if set (and
     //// not overriden by explicit argument to check_signature()) will enable
-    //// auto key retrieval.  Requires KeyServer and SigningKeyIds variables be
+    //// auto key retrieval.  Requires KeyServer variable be
     //// set.  NB: you should only enable this variable on production systems
     //// if you have strict control of your upload queue.
     // KeyAutoFetch "false";

diff --git a/setup/README b/setup/README
index 886b390e72e6094979da1a686e74a41c5b3a024f..37d0be4460f18f5a4075100d6b6a472fcff0d3a8 100644 (file)
--- a/setup/README
+++ b/setup/README
@@ -52,10 +52,19 @@ Set up a symlink somewhere
 # mkdir ~dak/bin
 # ln -s /path/to/dak.py ~dak/bin/dak
 
+Set up a private signing key
+# gpg --no-default-keyring --secret-keyring /srv/dak/keyrings/s3kr1t/dot-gnupg/secring.gpg --keyring /srv/dak/keyrings/s3kr1t/dot-gnupg/pubring.gpg --gen-key
+Remember the signing key id for when creating the suite below.
+Here we'll pretend it is DDDDDDDD for convenience
+
+Import some developer keys (here AAAAAAAA)
+# gpg --no-default-keyring --keyring /srv/dak/keyrings/upload-keyring.gpg --recv-key AAAAAAAA
+
 Add some architectures you care about:
 # dak admin architecture add i386 "Intel x86 port"
 # dak admin architecture add amd64 "AMD64 port"
 
 Add a suite (origin=, label= and codename= are optional)
-# dak admin suite add-all-arches unstable x.y.z origin=MyDistro label=Master codename=sid
+signingkey= will ensure that Release files are signed
+# dak admin suite add-all-arches unstable x.y.z origin=MyDistro label=Master codename=sid signingkey=DDDDDDDD
 

diff --git a/setup/dak-minimal.conf.template b/setup/dak-minimal.conf.template
index 45c5d0f1f20023d55f5909a572bcb938138d2eb0..7b4f9d254a8ca302185b0923db176e56a80b208d 100644 (file)
--- a/setup/dak-minimal.conf.template
+++ b/setup/dak-minimal.conf.template
@@ -18,7 +18,6 @@ Dinstall
 {
    SigningKeyring "__DAKBASE__/keyrings/s3kr1t/dot-gnupg/secring.gpg";
    SigningPubKeyring "__DAKBASE__/keyrings/s3kr1t/dot-gnupg/pubring.gpg";
-   SigningKeyIds "__ARCHIVEKEYID__";
 
    Options
    {