From: Ian Kelling <ian@iankelling.org>
Date: Mon, 11 Mar 2024 03:46:42 +0000 (-0400)
Subject: fix debian keys, start move toward debian 12 bookworm
X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=commitdiff_plain;h=86560196eb4ccc90a7c1d903de47fcb887656de4

fix debian keys, start move toward debian 12 bookworm
---

diff --git a/brc2 b/brc2
index 5c86f00..ec5969f 100644
--- a/brc2
+++ b/brc2
@@ -197,6 +197,20 @@ rm-docker-iptables() {
 
 # usage mkschroot [-] distro codename packages
 # - means no piping in of sources.list
+#
+# note some useful post mkschroot i've used in the past
+# tu /nocow/schroot/flidas/etc/sudoers <<EOF
+# $USER  ALL=(ALL)  NOPASSWD: ALL
+# Defaults  env_keep += SUDOD
+# Defaults always_set_home
+# Defaults !umask
+# EOF
+# sd /nocow/schroot/flidas//etc/locale.gen <<'EOF'
+# en_US.UTF-8 UTF-8
+# EOF
+# s schroot -c flidas locale-gen
+# s schroot -c flidas update-locale LANG=en_US.UTF-8
+
 mkschroot() {
   local sources force repo n distro
   force=false
@@ -368,11 +382,6 @@ cp-blocked-domains-to-ansible() {
 }
 
 
-anki() {
-  # crashes on adding new cards in t9
-  schroot -c buster -- anki
-}
-
 daycat() {
   ngset
   hrcat /m/md/daylert/{cur,new}/*
diff --git a/distro-end b/distro-end
index 721b2c1..acc1507 100755
--- a/distro-end
+++ b/distro-end
@@ -133,205 +133,38 @@ Explanation: Debian* includes Debian + Debian Backports
 Package: *
 Pin: release o=Debian*
 Pin-Priority: -100
-EOF
-    ;;&
-  # needed for debootstrap scripts for fai since fai requires debian
-  flidas)
-    # moved to fai
-    #curl http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg | s apt-key add -
-    sd /etc/apt/preferences.d/flidas-xenial <<EOF
-Package: *
-Pin: release a=xenial
-Pin-Priority: -100
-
-Package: *
-Pin: release a=xenial-updates
-Pin-Priority: -100
-
-Package: *
-Pin: release a=xenial-security
-Pin-Priority: -100
-
-Package: firefox
-Pin: release n=xenial
-Pin-Priority: 500
-EOF
-    sd /etc/apt/sources.list.d/xenial.list 2>/dev/null <<EOF
-deb http://us.archive.ubuntu.com/ubuntu/ xenial main
-deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main
-deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main
-EOF
-
-    if ! apt-key list | grep /C0B21F32 &>/dev/null; then
-      # moved to fai
-      #sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
-      sd /etc/apt/preferences.d/flidas-bionic <<EOF
-Package: *
-Pin: release a=bionic
-Pin-Priority: -100
-
-Package: *
-Pin: release a=bionic-updates
-Pin-Priority: -100
-
-Package: *
-Pin: release a=bionic-security
-Pin-Priority: -100
-EOF
-    fi
-
-    # better to run btrfs-progs which matches our kernel version
-    # (note, renamed from btrfs-tools)
-    sd /etc/apt/preferences.d/btrfs-progs <<EOF
-Package: btrfs-progs libzstd1
-Pin: release a=bionic
-Pin-Priority: 1005
-
-Package: btrfs-progs libzstd1
-Pin: release a=bionic-updates
-Pin-Priority: 1005
-
-Package: btrfs-progs libzstd1
-Pin: release a=bionic-security
-Pin-Priority: 1005
-EOF
-
-
-    t=$(mktemp)
-    cat >$t <<EOF
-deb http://us.archive.ubuntu.com/ubuntu/ bionic main
-deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates main
-deb http://us.archive.ubuntu.com/ubuntu/ bionic-security main
-EOF
-    f=/etc/apt/sources.list.d/bionic.list
-    if ! diff -q $t $f; then
-      sudo cp $t $f
-      sudo chmod 644 $f
-      m p update
-    fi
-
-    # no special reason, but its better for btrfs-progs to
-    # be closer to our kernel version
-    pi btrfs-progs
-
-    if [[ ! -e /usr/share/debootstrap/scripts/xenial ]]; then
-      t=$(mktemp -d)
-      cd $t
-      m aptitude download debootstrap/xenial
-      m ex ./*
-      sudo cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
-    fi
-
-    sd /etc/apt/preferences.d/flidas-etiona <<EOF
-Package: *
-Pin: release a=etiona
-Pin-Priority: -100
-
-Package: *
-Pin: release a=etiona-updates
-Pin-Priority: -100
-
-Package: *
-Pin: release a=etiona-security
-Pin-Priority: -100
-
-Package: *
-Pin: release a=etiona-backports
-Pin-Priority: -100
-EOF
-
-    t=$(mktemp)
-    cat >$t <<EOF
-deb http://mirror.fsf.org/trisquel/ etiona main
-deb http://mirror.fsf.org/trisquel/ etiona-updates main
-deb http://archive.trisquel.info/trisquel/ etiona-security main
-deb http://mirror.fsf.org/trisquel/ etiona-backports main
-EOF
-    f=/etc/apt/sources.list.d/etiona.list
-    if ! diff -q $t $f; then
-      sudo cp $t $f
-      n s chmod 644 $f
-      m p update
-    fi
-
-    sd /etc/apt/preferences.d/debian-goodies <<EOF
-Package: debian-goodies
-Pin: release n=etiona
-Pin-Priority: 1005
-EOF
 
-
-    # dont use buster because it causes dist-upgrade to think its downgrading
-    # packages while really just reinstalling the same version.
-    f=/etc/apt/apt.conf.d/01iank
-    sudo rm -fv $f
-    #         # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
-    #         sd /etc/apt/apt.conf.d/01iank <<'EOF'
-    # Acquire::AllowInsecureRepositories "true";
-    # EOF
-
-    f=/etc/apt/sources.list.d/buster.list
-    sudo rm -fv $f
-
-    # newer version needed for false positive in checkrestart.
-    # I did buster at first, but other problem above with having
-    # buster repos. not sure if the false positive exists in etiona.
-    pi debian-goodies
-
-    sd /etc/apt/preferences.d/shellcheck <<EOF
-Package: shellcheck
-Pin: release a=etiona
-Pin-Priority: 1005
-
-Package: shellcheck
-Pin: release a=etiona-updates
-Pin-Priority: 1005
-
-Package: shellcheck
-Pin: release a=etiona-security
-Pin-Priority: 1005
-EOF
-
-    sd /etc/apt/preferences.d/bash <<EOF
-Package: bash
-Pin: release a=etiona
-Pin-Priority: 1005
-
-Package: bash
-Pin: release a=etiona-updates
-Pin-Priority: 1005
-
-Package: bash
-Pin: release a=etiona-security
-Pin-Priority: 1005
+Explanation: ubuntu's version is outdated
+Package: debian-archive-keyring
+Pin: release o=Debian*
+Pin-Priority: 1000
 EOF
-
-
     ;;&
+
   aramo|nabia|etiona)
     # for ziva
     #p install --no-install-recommends minetest/buster libleveldb1d/buster libncursesw6/buster libtinfo6/buster
     doupdate=false
     # shellcheck disable=SC2043 # in case we want more than 1 in the loop later.
-    for n in bullseye; do
+    for n in bookworm; do
       f=/etc/apt/sources.list.d/$n.list
       t=$(mktemp)
       case $n in
-        bullseye)
+        bookworm)
           cat >$t <<'EOF'
 EOF
           cat >$t <<EOF
-deb http://deb.debian.org/debian bullseye main
-deb-src http://deb.debian.org/debian bullseye main
+deb http://deb.debian.org/debian bookworm main
+deb-src http://deb.debian.org/debian bookworm main
 
-deb http://deb.debian.org/debian-security/ bullseye-security main
-deb-src http://deb.debian.org/debian-security/ bullseye-security main
+deb http://deb.debian.org/debian-security/ bookworm-security main
+deb-src http://deb.debian.org/debian-security/ bookworm-security main
 
-deb http://deb.debian.org/debian bullseye-updates main
-deb-src http://deb.debian.org/debian bullseye-updates main
+deb http://deb.debian.org/debian bookworm-updates main
+deb-src http://deb.debian.org/debian bookworm-updates main
 
-deb http://http.debian.net/debian bullseye-backports main
-deb-src http://http.debian.net/debian bullseye-backports main
+deb http://http.debian.net/debian bookworm-backports main
+deb-src http://http.debian.net/debian bookworm-backports main
 EOF
           ;;
       esac
@@ -343,15 +176,17 @@ EOF
       fi
     done
     if $doupdate; then
-      curl -s https://ftp-master.debian.org/keys/archive-key-10-security.asc | sudo apt-key add -
-      curl -s https://ftp-master.debian.org/keys/archive-key-10.asc | sudo apt-key add -
+      cd $(mktemp -d)
+      p download debian-archive-keyring
+      s dpkg -i debian-archive-keyring
       p update
+      cd -
     fi
 
-    if [[ ! -e /usr/share/debootstrap/scripts/bullseye ]]; then
+    if [[ ! -e /usr/share/debootstrap/scripts/bookworm ]]; then
       t=$(mktemp -d)
       cd $t
-      m aptitude download debootstrap/bullseye
+      m aptitude download debootstrap/bookworm
       m ex ./*
       sudo cp ./usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
     fi
@@ -1444,32 +1279,8 @@ sgo schrootupdate.timer
 # for my roommate
 case $distro in
   trisquel)
-    m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/bullseye.list/BULLSEYE_FREE \
-      debian bullseye firefox-esr pulseaudio chromium anki
-    case $(debian-codename) in
-      etiona|nabia)
-        # we have a lot of t8 stuff, useful to have
-        m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/flidas.list/FLIDAS \
-          trisquel flidas
-        tu /nocow/schroot/flidas/etc/sudoers <<EOF
-$USER  ALL=(ALL)  NOPASSWD: ALL
-Defaults  env_keep += SUDOD
-Defaults always_set_home
-Defaults !umask
-EOF
-        sd /nocow/schroot/flidas//etc/locale.gen <<'EOF'
-en_US.UTF-8 UTF-8
-EOF
-        s schroot -c flidas locale-gen
-        s schroot -c flidas update-locale LANG=en_US.UTF-8
-
-        m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/testing.list/TESTING_NONFREE debian unstable debootstrap
-        sudo cp -a /nocow/schroot/unstable/usr/share/debootstrap/scripts/* /usr/share/debootstrap/scripts
-
-        m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/impish.list/IMPISH ubuntu impish
-
-        ;;
-    esac
+    m mkschroot -s /a/bin/fai/fai/config/files/etc/apt/sources.list.d/bookworm.list/BOOKWORM_FREE \
+      debian bookworm firefox-esr pulseaudio chromium
     ;;
   debian)
     pi chromium