Skip to content

Fix apt-get ascii GPG key #19138

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 25, 2024
Merged

Fix apt-get ascii GPG key #19138

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions content/engine/install/debian.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,12 +98,11 @@ Docker from the repository.
sudo apt-get update
sudo apt-get install ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL {{% param "download-url-base" %}}/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg
curl -fsSL {{% param "download-url-base" %}}/gpg -O /etc/apt/keyrings/docker.asc
Copy link
Member

@thaJeztah thaJeztah Jan 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, erm, silly question; would need sudo curl now? (or | sudo tee)? Looks like /etc/apt/keyrings may not be accessible by everyone;

ls -l /etc/apt/keyrings
total 4
-rw-r--r-- 1 root root 2760 Jan 25 21:02 docker.gpg

The sudo chmod a+r /etc/apt/keyrings/docker.gpg was added for some cloud systems where permissions were not allowing traversing the directories, causing things to fail; #17070 (comment)

Copy link
Member

@thaJeztah thaJeztah Jan 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

^ @dvdksn @tianon

Copy link
Contributor

@dvdksn dvdksn Jan 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah, yes. Would sudo curl do or do we need tee?

Copy link
Member

@thaJeztah thaJeztah Jan 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sudo curl is probably the easy one, but thinking if cURL depends on user-directories (therefore sudo potentially looking for config in root's home-dir and such. running cURL as root may have a slightly bigger attack surface (vs tee) as well, but perhaps that's just looking for issues.

I'm sure @tianon has opinions as well if curl | sudo tee is preferred over sudo curl

Copy link
Contributor

@tianon tianon Jan 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, attack surface is all that came to mind for me (generally, running curl as root is probably safe, but not the best idea). That being said, if we use tee, we should probably also send the output to /dev/null, so I'd personally think sudo curl is probably the simpler answer to keep the docs easier to understand (users that paranoid are hopefully not even using this line and are instead doing things like fetching the key by full fingerprint from elsewhere and/or doing deeper verification after download).

Copy link
Member

@thaJeztah thaJeztah Jan 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, sudo curl is definitely easier to grasp, so perhaps it's an ok trade-off (readability over "fully correct").

We should look at the directory permissions though (the sudo chmod a+r /etc/apt/keyrings/docker.gpg)

as I recall there were some real-life scenarios outside of the user's control where things broke without #17070


# Add the repository to Apt sources:
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] {{% param "download-url-base" %}} \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] {{% param "download-url-base" %}} \
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
Expand Down
5 changes: 2 additions & 3 deletions content/engine/install/raspberry-pi-os.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,12 +100,11 @@ Docker from the repository.
sudo apt-get update
sudo apt-get install ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL {{% param "download-url-base" %}}/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg
curl -fsSL {{% param "download-url-base" %}}/gpg -O /etc/apt/keyrings/docker.asc

# Set up Docker's APT repository:
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] {{% param "download-url-base" %}} \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] {{% param "download-url-base" %}} \
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
Expand Down
7 changes: 3 additions & 4 deletions content/engine/install/ubuntu.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,12 +109,11 @@ Docker from the repository.
sudo apt-get update
sudo apt-get install ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL {{% param "download-url-base" %}}/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

curl -fsSL {{% param "download-url-base" %}}/gpg -O /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] {{% param "download-url-base" %}} \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] {{% param "download-url-base" %}} \
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
Expand Down