chris/comodore-iec-emu
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 4 Wiki Activity

feat(kernel): Add trixie SHA1 signature workaround to Dockerfile
All checks were successful
Build kernel module / build (1:6.12.93-1+rpt1, bookworm) (pull_request) Successful in 8m4s
Details
Build kernel module / build (1:6.18.34-1+rpt1, trixie) (pull_request) Successful in 5m25s
Details
Build kernel module / release (pull_request) Has been skipped
Details

Browse Source 
Introduce a conditional `trusted=yes` setting for the Raspberry Pi
repository in the Dockerfile when `DEBIAN_SUITE=trixie`. This bypasses
SHA1 signature rejection by trixie's apt system using Sequoia. Ensure
that bookworm maintains full signature verification. Updated
documentation to explain the trixie-specific caveat.
This commit is contained in:
Christian Werner 2026-06-19 21:03:18 +02:00
parent 914c92bdea
commit de2fb56a59
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs/kernel-notes.md
View File

@ -182,6 +182,13 @@ only its own latest kernel, so a trixie-era version against a `bookworm` base
fails with `Version '…' was not found`. Find the Pi's suite with fails with `Version '…' was not found`. Find the Pi's suite with
`. /etc/os-release; echo "$VERSION_CODENAME"` (or `lsb_release -cs`). `. /etc/os-release; echo "$VERSION_CODENAME"` (or `lsb_release -cs`).
**trixie SHA1 caveat.** On trixie, apt verifies signatures with Sequoia (`sqv`),
whose crypto policy rejects SHA1 since 2026-02-01. The raspberrypi archive key's
binding self-signature is SHA1, so trixie's apt rejects the repo as *"not
signed"* (`Policy rejected … SHA1 is not considered secure …`). The Dockerfile
works around this by marking the raspberrypi repo `trusted=yes` **only when
`DEBIAN_SUITE=trixie`**; bookworm (gpgv) keeps full signature verification.
**Find the exact values for *your* Pi** — run this on the Pi (e.g. over SSH); it **Find the exact values for *your* Pi** — run this on the Pi (e.g. over SSH); it
prints the two lines ready to copy into the `build-in-docker.sh` invocation: prints the two lines ready to copy into the `build-in-docker.sh` invocation:

11
kernel/Dockerfile
View File

@ -27,11 +27,20 @@ FROM --platform=linux/arm64 debian:${DEBIAN_SUITE}
ARG DEBIAN_SUITE=bookworm ARG DEBIAN_SUITE=bookworm
# The raspberrypi kernel/headers live in the raspberrypi.com archive, not Debian. # The raspberrypi kernel/headers live in the raspberrypi.com archive, not Debian.
#
# On trixie, apt verifies signatures with Sequoia (sqv), whose crypto policy
# rejects SHA1 since 2026-02-01. The raspberrypi archive key's binding
# self-signature is SHA1, so trixie's apt refuses the repo as "not signed"
# (bookworm's gpgv doesn't enforce this). We mark the repo trusted=yes *only on
# trixie* to bypass that check; bookworm keeps full signature verification. The
# key is still fetched over HTTPS and pinned via signed-by where it is honoured.
RUN apt-get update \ RUN apt-get update \
&& apt-get install -y --no-install-recommends ca-certificates curl gnupg \ && apt-get install -y --no-install-recommends ca-certificates curl gnupg \
&& curl -fsSL https://archive.raspberrypi.com/debian/raspberrypi.gpg.key \ && curl -fsSL https://archive.raspberrypi.com/debian/raspberrypi.gpg.key \
| gpg --dearmor -o /usr/share/keyrings/raspberrypi-archive-keyring.gpg \ | gpg --dearmor -o /usr/share/keyrings/raspberrypi-archive-keyring.gpg \
&& echo "deb [signed-by=/usr/share/keyrings/raspberrypi-archive-keyring.gpg] http://archive.raspberrypi.com/debian/ ${DEBIAN_SUITE} main" \ && opts="signed-by=/usr/share/keyrings/raspberrypi-archive-keyring.gpg" \
&& if [ "$DEBIAN_SUITE" = "trixie" ]; then opts="$opts trusted=yes"; fi \
&& echo "deb [$opts] http://archive.raspberrypi.com/debian/ ${DEBIAN_SUITE} main" \
> /etc/apt/sources.list.d/raspi.list \ > /etc/apt/sources.list.d/raspi.list \
&& rm -rf /var/lib/apt/lists/* && rm -rf /var/lib/apt/lists/*