<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hello,<div><br></div><div>Just a comment about backward compatibility bellow:<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On 13 Jun 2024, at 11:40, Pierre-Elliott Bécue <peb@debian.org> wrote:</div><br class="Apple-interchange-newline"><div><div>Control: severity -1 important<br><br>Hi,<br><br>Thanks for the report.<br><br>Eppii <eppii@gandi.net> wrote on 13/06/2024 at 09:54:47+0200:<br><br><blockquote type="cite">Package: lxc-templates<br>Version: 3.0.4.48.g4765da8-1<br><br>||/ Name Version Architecture Description<br>+++-==============-===================-============-============================================<br>ii lxc-templates 3.0.4.48.g4765da8-1 amd64 Linux Containers userspace tools (templates)<br><br>Hello !<br><br>Context: we want to create a lxc with the lxc-debian template on a bookworm server without any access to internet.<br><br>We identified three issues preventing to achieve our goal and had to edit the /usr/share/lxc/templates/lxc-debian to succeed.<br><br>Description:<br><br>The download_debian() function states that it must verify signatures using /etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg<br>but since bookworm, debian-archive-keyring install gpg files into the /usr/share/keyrings folder only. See<br>https://packages.debian.org/bookworm/all/debian-archive-keyring/filelist versus bullseye version.<br><br>Path lreleasekeyring=/etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg does not exist hence it always tries to download<br>from http://ftp-master.debian.org. Which fails on a no internet access server.<br><br>A workaround is to add the --keyring /usr/share/keyrings/debian-archive-$release-stable.gpg args to the command as followed:<br> lxc-create -n test -t debian -- --mirror http://mymirror/debian --security-mirror http://mymirror/debian-security --release bookworm -<br>-keyring /usr/share/keyrings/debian-archive-buster-stable.gpg<br></blockquote><br>You can also create a symlink as a workaround.<br><br><blockquote type="cite">A solution would be to modify the line 436 from:<br>- lreleasekeyring=/etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg<br>+ lreleasekeyring=/usr/share/keyrings/debian-archive-$release-stable.gpg<br></blockquote><br>It'll require a bit more flexibility to stay backward compatible. :)<br></div></div></blockquote><br><div>It seems that pub keys lives into /usr/share/keyrings/ from a long time now, and will stay this way in the future; see <a href="https://packages.debian.org/buster/all/debian-archive-keyring/filelist">https://packages.debian.org/buster/all/debian-archive-keyring/filelist</a></div><div><br></div><div>Shouldn’t it source from the beginning into the /usr path?</div><div><br></div><blockquote type="cite"><div><div><br><blockquote type="cite">OR install the gpg keys back to etc/apt/trusted.gpg.d/ folder or whatever you see as a better fit ;).<br></blockquote><br>The motivation behind moving the keys to /usr is that /etc is for sysops to<br>maintain configuration/variable parts. These keys are not to be touched,<br>so they should go to a place that is not to be touched by sysops.<br><br>I'll design a patch.<br><br>-- <br>PEB<br></div></div></blockquote></div><br></div></body></html>