lueschem / edi

Embedded development infrastructure.
https://www.get-edi.io
GNU Lesser General Public License v3.0
38 stars 12 forks source link

Replace sources.list inherited from debootstrap with a full fledged {{ansible_distribution_release}}.list in .d folder #80

Closed lueschem closed 1 year ago

lueschem commented 1 year ago

Within the base system setup (https://github.com/lueschem/edi/blob/develop/edi/plugins/playbooks/debian/base_system/roles/apt_setup/tasks/main.yml) the sources.list file added by debootstrap could be replaced by a full fledged sources.list (including debian-security).

The same stuff is currently done within individual projects: https://github.com/lueschem/edi-pi/blob/master/plugins/playbooks/board_support/roles/repositories/tasks/main.yml

Requirements:

Requirements for projects:

lueschem commented 1 year ago

Security issue: The edi-pi/edi-cl/edi-var project configurations had the issue that packages that got installed during debootstrap did not get upgraded with eventually available security updates provided by the debian-security repository. With the new functionality implemented within the scope of this issue the project configurations can opt in for an early replacement of the Debian sources list. A subsequent dist upgrade will take care of the upgrade of packages that got already installed during debootstrap.