Specifying a keyring for debootstrap

[kempfsn]

This is essentially the same issue as #104 reported by @mischelebuha. But let me explain the problem again.

When using a custom signed Debian repo as a primary mirror, running debootstrap fails unless signature checking of the repo is disabled.

However, we could run debootstrap with the --keyring option to specify a custom key. Somewhere around here, ELBE would have to construct the debootstrap command invocation accordingly: https://github.com/Linutronix/elbe/blob/v14.8/elbepack/rfs.py#L183

What would be the preferred way to implement this?

• add a <primary_key> tag in the <mirror> section as specified in #104 and make use of it in debootstrap
• add an tag in the <debootstrap> section so that we can specify the --keyring option manually (the custom keyring could be added to the initvm via a package when the initvm is created)

Currently the raw-keys are not evaluated for the debootstrap call. As I understood, they are also only used for the additional mirrors, not for the primary one. However, debootstrap can fetch packages only from a single mirror (the primary one).

[bene42]

Dublicate. Tracked in https://github.com/Linutronix/elbe/issues/104