[sysadmin/neon-tooling] /: rework gpg exporting and ensure correct permissions

Git commit 14de7898f53c657357eedbc3f1d431b4f02bfa9a by Carlos De Maine.
Committed on 19/07/2026 at 09:13.
Pushed by carlosdem into branch 'master'.

rework gpg exporting and ensure correct permissions

M  +1    -1    data
M  +7    -0    deploy_in_container.rake
M  +14   -22   lib/apt/key.rb

https://invent.kde.org/sysadmin/neon-tooling/-/commit/14de7898f53c657357eedbc3f1d431b4f02bfa9a

diff --git a/data b/data
index 9a849e8e..ab1eb64c 160000
--- a/data
+++ b/data
@@ -1 +1 @@
-Subproject commit 9a849e8e1fa4492370a436309da6cc350081a6e6
+Subproject commit ab1eb64ce75af042facd84e2862e9c123d6bcf2f
diff --git a/deploy_in_container.rake b/deploy_in_container.rake
index 7a7d4095..51847bf2 100644
--- a/deploy_in_container.rake
+++ b/deploy_in_container.rake
@@ -296,6 +296,13 @@ update: --no-document
 
     Apt.install(*EARLY_DEPS) || raise
 
+    dir_path = File.expand_path('~/.gnupg/')
+    files = Dir.glob("#{dir_path}/*")
+    FileUtils.mkdir_p(dir_path)
+    FileUtils.chown_R('root', 'root', dir_path)
+    FileUtils.chmod(0600, files)
+    FileUtils.chmod(0700, dir_path)
+
     if NCI.series.keys.include?(DIST)
       puts "DIST in NCI, adding key"
       # Pre-seed NCI keys to speed up all builds and prevent transient
diff --git a/lib/apt/key.rb b/lib/apt/key.rb
index 214efd62..3056c6d1 100644
--- a/lib/apt/key.rb
+++ b/lib/apt/key.rb
@@ -54,32 +54,24 @@ module Apt
       end
 
       def add_fingerprint(id_or_fingerprint)
-        tmp_key = "/tmp/#{id_or_fingerprint}.key"
-        success = system('gpg', '--no-tty', '--batch', '--no-default-keyring', '--keyring', tmp_key,
-                         '--keyserver', 'keyserver.ubuntu.com', '--recv-keys', id_or_fingerprint)
-        return false unless success && File.exist?(tmp_key)
-
-        data = File.read(tmp_key)
-        File.delete(tmp_key)
-
-        save_dearmored_key(data, id_or_fingerprint)
-      end
-
-      private
-
-      def save_dearmored_key(raw_data, base_name)
-        clean_name = base_name.gsub(/[^a-zA-Z0-9.\-_]/, '_')
-        clean_name += '.gpg' unless clean_name.end_with?('.gpg')
-        target_path = File.join(KEYRINGS_DIR, clean_name)
-
         FileUtils.mkdir_p(KEYRINGS_DIR)
-
-        IO.popen(['gpg', '--yes', '--no-tty', '--batch', '--dearmor', '-o', target_path], 'w') do |io|
-          io.write(raw_data)
-        end
+        #File.chown('root', 'root', KEYRINGS_DIR)
+        clean_name = id_or_fingerprint.gsub(/[^a-zA-Z0-9.\-_]/, '_')
+        gpg_key = "#{KEYRINGS_DIR}/#{clean_name}.gpg"
+        asc_key = "#{KEYRINGS_DIR}/#{clean_name}.asc"
+
+        success = system('gpg', '--no-tty', '--batch', '--no-default-keyring', '--export-options', 'export-minimal', '--keyring', gpg_key, '--output', gpg_key, '--keyserver', 'keyserver.ubuntu.com', '--recv-keys', id_or_fingerprint)
+        return false unless success && File.exist?(gpg_key)
+        FileUtils.chmod(0600, gpg_key)
+
+        dearmour = system('gpg', '--yes', '--no-tty', '--batch', '--export', '--export-options', 'export-minimal', '--keyring', gpg_key, '--armor', '--output', asc_key)
+        return false unless dearmour && File.exist?(asc_key)
+        FileUtils.chmod(0600, asc_key)
         $?.success?
       end
 
+      private
+
       def fingerprint_added?(str)
         return false unless Dir.exist?(KEYRINGS_DIR)
         Dir.glob(File.join(KEYRINGS_DIR, '*.gpg')).each do |keyring|