MIME-Version: 1.0
References: <Y25+RkZxiZKBOKio@msg.df7cb.de>
In-Reply-To: <Y25+RkZxiZKBOKio@msg.df7cb.de>
From: Aaron Pavely <aaron@pavely.net>
Date: Mon, 14 Nov 2022 14:06:58 -0600
Message-ID: 
 <CAGs4muUPqUY9iW-c3309C2H5Q8zrH4E1oA4oBaKK933EftggHw@mail.gmail.com>
Subject: Re: Repository key handling changed
To: Christoph Berg <myon@debian.org>,
	PostgreSQL in Debian <pgsql-pkg-debian@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000cff84305ed73c80e"
Archived-At: 
 <https://www.postgresql.org/message-id/CAGs4muUPqUY9iW-c3309C2H5Q8zrH4E1oA4oBaKK933EftggHw%40mail.gmail.com>
Precedence: bulk

--000000000000cff84305ed73c80e
Content-Type: text/plain; charset="UTF-8"

On Fri, Nov 11, 2022 at 10:54 AM Christoph Berg <myon@debian.org> wrote:

> Hi,
>
> previously, when installing postgresql-common from apt.postgresql.org,
> it would pull in the pgdg-keyring package that contains the key for
> the repository:
>
> /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc
> /usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg
> /etc/apt/trusted.gpg.d/apt.postgresql.org.gpg ->
> /usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg
>
> In postgresql-common 246, this has been changed such that
> postgresql-common itself contains the key files, and the trusted.gpg.d
> symlink is created when a /etc/apt/sources.list.d/pgdg.list is found.
>
> On upgrade, pgdg-keyring will be removed, but since the same set of
> files is provided, nothing should change.
>
> One caveat is that pgdg-keyring has
> /etc/apt/trusted.gpg.d/apt.postgresql.org.gpg
> marked as conffile, so if the package is purged after the removal, the
> .gpg file
> will be removed. (Workaround: reinstall postgresql-common, or don't
> purge pgdg-keyring, or use an explicit key file (see below))
>
>
> Additionally the apt.postgresql.org.sh installer script [1] has been
> updated to write /etc/apt/sources.list.d/pgdg.sources in the modern
> deb-822 style. By default it looks like this:
>
> $ cat /etc/apt/sources.list.d/pgdg.sources
> Types: deb
> URIs: https://apt.postgresql.org/pub/repos/apt
> Suites: bullseye-pgdg
> Components: main
> Signed-By: /usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg
>
> [1]
> https://salsa.debian.org/postgresql/postgresql-common/-/raw/master/pgdg/apt.postgresql.org.sh
>
> The advantage is that the key for the repository is explicitly
> specified, and the URI scheme has been upgraded to https://.
> (Make sure systems have ca-certificates installed!)
>
>
> I have not yet upgraded the installation instructions on
> https://wiki.postgresql.org/wiki/Apt yet, since they are compatible
> with either version of the key/scripts, but will do so over the next
> days.
>
>
> If you have questions, follow up here or ask on #postgresql-apt on
> libera.
>
> Christoph
>

I am wondering if the repository keys should have gone into
postgresql-client-common, since there are cases where one will have
postgresql-client-common installed, but not postgresql-common (e.g., hosts
needing only the client libraries).

-- Aaron

--000000000000cff84305ed73c80e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"></div><div class=3D"gmail_quote"><div dir=
=3D"ltr" class=3D"gmail_attr">On Fri, Nov 11, 2022 at 10:54 AM Christoph Be=
rg &lt;<a href=3D"mailto:myon@debian.org">myon@debian.org</a>&gt; wrote:<br=
></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;=
border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
previously, when installing postgresql-common from <a href=3D"http://apt.po=
stgresql.org" rel=3D"noreferrer" target=3D"_blank">apt.postgresql.org</a>,<=
br>
it would pull in the pgdg-keyring package that contains the key for<br>
the repository:<br>
<br>
/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc<br>
/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg<br>
/etc/apt/trusted.gpg.d/apt.postgresql.org.gpg -&gt; /usr/share/postgresql-c=
ommon/pgdg/apt.postgresql.org.gpg<br>
<br>
In postgresql-common 246, this has been changed such that<br>
postgresql-common itself contains the key files, and the trusted.gpg.d<br>
symlink is created when a /etc/apt/sources.list.d/pgdg.list is found.<br>
<br>
On upgrade, pgdg-keyring will be removed, but since the same set of<br>
files is provided, nothing should change.<br>
<br>
One caveat is that pgdg-keyring has /etc/apt/trusted.gpg.d/apt.postgresql.o=
rg.gpg<br>
marked as conffile, so if the package is purged after the removal, the .gpg=
 file<br>
will be removed. (Workaround: reinstall postgresql-common, or don&#39;t<br>
purge pgdg-keyring, or use an explicit key file (see below))<br>
<br>
<br>
Additionally the <a href=3D"http://apt.postgresql.org.sh" rel=3D"noreferrer=
" target=3D"_blank">apt.postgresql.org.sh</a> installer script [1] has been=
<br>
updated to write /etc/apt/sources.list.d/pgdg.sources in the modern<br>
deb-822 style. By default it looks like this:<br>
<br>
$ cat /etc/apt/sources.list.d/pgdg.sources<br>
Types: deb<br>
URIs: <a href=3D"https://apt.postgresql.org/pub/repos/apt" rel=3D"noreferre=
r" target=3D"_blank">https://apt.postgresql.org/pub/repos/apt</a><br>
Suites: bullseye-pgdg<br>
Components: main<br>
Signed-By: /usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg<br>
<br>
[1] <a href=3D"https://salsa.debian.org/postgresql/postgresql-common/-/raw/=
master/pgdg/apt.postgresql.org.sh" rel=3D"noreferrer" target=3D"_blank">htt=
ps://salsa.debian.org/postgresql/postgresql-common/-/raw/master/pgdg/apt.po=
stgresql.org.sh</a><br>
<br>
The advantage is that the key for the repository is explicitly<br>
specified, and the URI scheme has been upgraded to https://.<br>
(Make sure systems have ca-certificates installed!)<br>
<br>
<br>
I have not yet upgraded the installation instructions on<br>
<a href=3D"https://wiki.postgresql.org/wiki/Apt" rel=3D"noreferrer" target=
=3D"_blank">https://wiki.postgresql.org/wiki/Apt</a> yet, since they are co=
mpatible<br>
with either version of the key/scripts, but will do so over the next<br>
days.<br>
<br>
<br>
If you have questions, follow up here or ask on #postgresql-apt on<br>
libera.<br>
<br>
Christoph<br></blockquote><div><br></div><div>I am wondering if the reposit=
ory keys should have gone into postgresql-client-common, since there are ca=
ses where one will have postgresql-client-common installed, but not postgre=
sql-common (e.g., hosts needing only the client libraries).</div><div><br><=
/div><div>-- Aaron</div></div></div>

--000000000000cff84305ed73c80e--