The LLVM apt repository uses legacy SHA1 signatures which are now rejected by the stricter Sequoia PGP policy.
This change extends the sha1.second_preimage_resistance cutoff date to 9999-01-01 in the default Sequoia config. This effectively whitelists the legacy signature algorithm, preventing "OpenPGP signature verification failed" errors during apt-get update.
The LLVM apt repository uses legacy SHA1 signatures which are now
rejected by the stricter Sequoia PGP policy.
This change extends the 'sha1.second_preimage_resistance' cutoff date to
9999-01-01 in the default Sequoia config. This effectively whitelists
the legacy signature algorithm, preventing "OpenPGP signature
verification failed" errors during `apt-get update`.
See https://github.com/llvm/llvm-project/issues/153385.
<!--e57a25ab6845829454e8d69fc972939a-->
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
<!--021abf342d371248e50ceaed478a90ca-->
See the guideline for information on the review process. A summary of reviews will appear here.
<!--5faf32d7da4f0f540f40219e4f7537a3-->
28 | @@ -29,6 +29,10 @@ if [ -n "${APT_LLVM_V}" ]; then 29 | # shellcheck disable=SC2034 30 | source /etc/os-release 31 | echo "deb http://apt.llvm.org/${VERSION_CODENAME}/ llvm-toolchain-${VERSION_CODENAME}-${APT_LLVM_V} main" > "/etc/apt/sources.list.d/llvm-toolchain-${VERSION_CODENAME}-${APT_LLVM_V}.list" 32 | + # Temporarily work around Sequoia PGP policy deadline for legacy repositories. 33 | + # See https://github.com/llvm/llvm-project/issues/153385. 34 | + sed -i 's/\(sha1\.second_preimage_resistance =\).*/\1 9999-01-01/' /usr/share/apt/default-sequoia.config && \ 35 | + apt-get update && \
I don't like the && \ here. I think we should globally exit on non-zero exit code, but i guess this is needed in a sub-shell?
My preference would be to use set -o errexit -o pipefail -o xtrace
Though, this one is correct?
lgtm ACK 784cb9d2cc046602b9af26342af6f2b6991b3b7c
I don't think so? Running it locally is broken:
+ MAKEJOBS=-j16
+ '[' -n '' ']'
./ci/test/01_base_install.sh: line 36: syntax error near unexpected token `)'
Error: building at STEP "RUN bash -c cd /ci_container_base/ && set -o errexit && source ./ci/test/00_setup_env.sh && ./ci/test/01_base_install.sh": while running runtime: exit status 2
Command '['docker', 'buildx', 'build', '--file=/root/ci_scratch/ci/test_imagefile', '--build-arg=CI_IMAGE_NAME_TAG=mirror.gcr.io/ubuntu:24.04', '--build-arg=FILE_ENV=./ci/test/00_setup_env_native_fuzz.sh', '--build-arg=BASE_ROOT_DIR=/ci_container_base', '--platform=linux', '--label=bitcoin-ci-test', '--tag=ci_native_fuzz', '/root/ci_scratch']' returned non-zero exit status 2.