From 56d7e30356aad8adc72d4cc45d4bd565bf065ceb Mon Sep 17 00:00:00 2001
From: Serge Schneider <serge@raspberrypi.com>
Date: Thu, 5 Jun 2025 22:04:34 +0100
Subject: [PATCH] stage0: modernise apt sources

---
 stage0/00-configure-apt/00-run.sh             |  12 +++----
 .../files/raspberrypi-archive-keyring.pgp     | Bin 0 -> 1229 bytes
 .../files/raspberrypi.gpg.key                 |  30 ------------------
 .../00-configure-apt/files/raspbian.sources   |   6 ++++
 stage0/00-configure-apt/files/raspi.list      |   3 --
 stage0/00-configure-apt/files/raspi.sources   |   5 +++
 stage0/00-configure-apt/files/sources.list    |   3 --
 7 files changed, 17 insertions(+), 42 deletions(-)
 create mode 100644 stage0/00-configure-apt/files/raspberrypi-archive-keyring.pgp
 delete mode 100644 stage0/00-configure-apt/files/raspberrypi.gpg.key
 create mode 100644 stage0/00-configure-apt/files/raspbian.sources
 delete mode 100644 stage0/00-configure-apt/files/raspi.list
 create mode 100644 stage0/00-configure-apt/files/raspi.sources
 delete mode 100644 stage0/00-configure-apt/files/sources.list

diff --git a/stage0/00-configure-apt/00-run.sh b/stage0/00-configure-apt/00-run.sh
index 1b7e03f..8e47893 100755
--- a/stage0/00-configure-apt/00-run.sh
+++ b/stage0/00-configure-apt/00-run.sh
@@ -1,9 +1,10 @@
 #!/bin/bash -e
 
-install -m 644 files/sources.list "${ROOTFS_DIR}/etc/apt/"
-install -m 644 files/raspi.list "${ROOTFS_DIR}/etc/apt/sources.list.d/"
-sed -i "s/RELEASE/${RELEASE}/g" "${ROOTFS_DIR}/etc/apt/sources.list"
-sed -i "s/RELEASE/${RELEASE}/g" "${ROOTFS_DIR}/etc/apt/sources.list.d/raspi.list"
+true > "${ROOTFS_DIR}/etc/apt/sources.list"
+install -m 644 files/raspbian.sources "${ROOTFS_DIR}/etc/apt/sources.list.d/"
+install -m 644 files/raspi.sources "${ROOTFS_DIR}/etc/apt/sources.list.d/"
+sed -i "s/RELEASE/${RELEASE}/g" "${ROOTFS_DIR}/etc/apt/sources.list.d/raspbian.sources"
+sed -i "s/RELEASE/${RELEASE}/g" "${ROOTFS_DIR}/etc/apt/sources.list.d/raspi.sources"
 
 if [ -n "$APT_PROXY" ]; then
 	install -m 644 files/51cache "${ROOTFS_DIR}/etc/apt/apt.conf.d/51cache"
@@ -19,8 +20,7 @@ else
 	rm -f "${ROOTFS_DIR}/etc/apt/sources.list.d/00-temp.list"
 fi
 
-cat files/raspberrypi.gpg.key | gpg --dearmor > "${STAGE_WORK_DIR}/raspberrypi-archive-stable.gpg"
-install -m 644 "${STAGE_WORK_DIR}/raspberrypi-archive-stable.gpg" "${ROOTFS_DIR}/etc/apt/trusted.gpg.d/"
+install -m 644 files/raspberrypi-archive-keyring.pgp "${ROOTFS_DIR}/usr/share/keyrings/"
 on_chroot <<- \EOF
 	ARCH="$(dpkg --print-architecture)"
 	if [ "$ARCH" = "armhf" ]; then
diff --git a/stage0/00-configure-apt/files/raspberrypi-archive-keyring.pgp b/stage0/00-configure-apt/files/raspberrypi-archive-keyring.pgp
new file mode 100644
index 0000000000000000000000000000000000000000..e0ada06a3ab4633137053188d6cc1f77b77237a8
GIT binary patch
literal 1229
zcmV;;1Ty=X0SyFC-R_S82mq_Xq#AHyU!QwtGcm4<sju2n@nO3TyD$Dzis~|9gu0F4
z_HTCIK{gWHsj`Kf&OmE=+{;iQZ~0XY#h^N|Uw)?K>R@PLL6L4LMVuSDD}S^bWgD(f
z8w646R_0hcFid6w?MWv(jM768U&qzSWkZrTA!qok;;q3v<pL$O2|B?(kgxjkMY^45
zVZk6Hd^mLJusOo|7dAF14cXFXC0%iVj}Vo_gP7kJ|EHQEN->aYXnZGm3m&Gv>jivG
za7)9LBadobb$$<YDSC44NvnHR908UIbqAJkd%Itos3#xH8<Kp9&Vs>-gJ~#86|Z)G
z%BB^`+S8w<rkOkG`zHVq0RRECAW~s-aAIY0a(N(7X&^yzV`yo1Wgt^&XKrb3XCO;u
zd5Hl}1QP)Y067910|pBT2nPcK1{DYb2?`4Y76JnS0v-VZ7l0Na1kZ{Z^#Y=*Ep|Ju
zeuA+nl7FKxJ_Q13LH`i|3JDN`u_=;&qcA>sy9fV7c=WY-joOX{Q!R*+W?gmROUaxU
z7FsW6NcFPo9igUgK9i3uQv@!2+^Ene@Q!|sQbt<1n_aq8A>(K6%j}w_L80^CnKFMj
z){NawuVg<F+NLCD{~`QAD7W4IAc1>!ZH9w?iKeQD_v$lmfzcq@GI|!jDN)JB!0*E|
zR1S`BKj&MV(O&7-57t+4t7(S#K^v_)vnqI8r(oL8R#GI!m}O0r?XO2?0EunbM%80{
zy)JFF;NA|)C5U6IEtW4rLBj8RaigBr#On)CH2eNTSk_%FZ2qA{o1MuzL#IzbO3cID
ziM-hNZXJW9S${egg+LewIUiFAOnO_U;ZuaU0SyFC-R_S82msBMTR~+`w|;K@N-^Q&
z0SXq)0^Up-(qo~g+8VR?S`G*%h9%w2;P>OwR?pT`$Lr-ztt|MDry(6$`mcsB=y77+
z2ZtH}>iI)4=oNnUO3tL$^xF1Tq#8?tv)yh~F8?*R4c4Oqx{E^lrl97$I-r}q<}tSM
zd~ozjB<=I(<nE>V0u8BWhP`FdM#k_Gk{t|iYFl8KWYuN^`RI6lq4y!DiHodlHiTVs
zmKVD+3!a~fXq=A|kddiIIVL8~4|<XBFylW<o<H5=E~%(0TS9c+e#wCZ#?-LSnOB}D
zm^hkzEnz}}{$ZQOm|jN-OI%e~((Rs&w_^4AdE7lgjv)XM0RRDs0X75}0SW*h0vik#
zAq3Bg8ubFAsx5Xqu6}~CDUyGqFg^tWXhHuO0162Zg0U%*f1@xyI%Eg_EQbuB{lU!C
zEk$o(`-``;Ztn6@NL<1f@VtD7b?U(Is^?y%0Rr92>AHQ-Gq^WJda`2Ha2rlRKM%_V
z{StVH?cZ8Y6gC3}xRmnG8V9&HJo|#$+H`ZU^qJt@!iD7b@X@?=l417nkhPm^VkoI)
z<`gPBPN@NhO_I`W#Gh4OIK-h;0U7F8b%5s9LY+%2LlpNH7gBK<M=M9S4SW;m<B-;H
z2Aq!?QRVV3C)zd>--b4G$k|T33u+z^X-@uF=}@y}U?3zm5}_g}8BLJaY04{3y5jAK
rq0n^PVPsRhSmx5asCT{8;kQBkkMMxVk~}~jdn$g9KdA&yNRPmcGkH4)

literal 0
HcmV?d00001

diff --git a/stage0/00-configure-apt/files/raspberrypi.gpg.key b/stage0/00-configure-apt/files/raspberrypi.gpg.key
deleted file mode 100644
index 60b5f65..0000000
--- a/stage0/00-configure-apt/files/raspberrypi.gpg.key
+++ /dev/null
@@ -1,30 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.12 (GNU/Linux)
-
-mQENBE/d7o8BCACrwqQacGJfn3tnMzGui6mv2lLxYbsOuy/+U4rqMmGEuo3h9m92
-30E2EtypsoWczkBretzLUCFv+VUOxaA6sV9+puTqYGhhQZFuKUWcG7orf7QbZRuu
-TxsEUepW5lg7MExmAu1JJzqM0kMQX8fVyWVDkjchZ/is4q3BPOUCJbUJOsE+kK/6
-8kW6nWdhwSAjfDh06bA5wvoXNjYoDdnSZyVdcYCPEJXEg5jfF/+nmiFKMZBraHwn
-eQsepr7rBXxNcEvDlSOPal11fg90KXpy7Umre1UcAZYJdQeWcHu7X5uoJx/MG5J8
-ic6CwYmDaShIFa92f8qmFcna05+lppk76fsnABEBAAG0IFJhc3BiZXJyeSBQaSBB
-cmNoaXZlIFNpZ25pbmcgS2V5iQE4BBMBAgAiBQJP3e6PAhsDBgsJCAcDAgYVCAIJ
-CgsEFgIDAQIeAQIXgAAKCRCCsSmSf6MwPk6vB/9pePB3IukU9WC9Bammh3mpQTvL
-OifbkzHkmAYxzjfK6D2I8pT0xMxy949+ThzJ7uL60p6T/32ED9DR3LHIMXZvKtuc
-mQnSiNDX03E2p7lIP/htoxW2hDP2n8cdlNdt0M9IjaWBppsbO7IrDppG2B1aRLni
-uD7v8bHRL2mKTtIDLX42Enl8aLAkJYgNWpZyPkDyOqamjijarIWjGEPCkaURF7g4
-d44HvYhpbLMOrz1m6N5Bzoa5+nq3lmifeiWKxioFXU+Hy5bhtAM6ljVb59hbD2ra
-X4+3LXC9oox2flmQnyqwoyfZqVgSQa0B41qEQo8t1bz6Q1Ti7fbMLThmbRHiuQEN
-BE/d7o8BCADNlVtBZU63fm79SjHh5AEKFs0C3kwa0mOhp9oas/haDggmhiXdzeD3
-49JWz9ZTx+vlTq0s+I+nIR1a+q+GL+hxYt4HhxoA6vlDMegVfvZKzqTX9Nr2VqQa
-S4Kz3W5ULv81tw3WowK6i0L7pqDmvDqgm73mMbbxfHD0SyTt8+fk7qX6Ag2pZ4a9
-ZdJGxvASkh0McGpbYJhk1WYD+eh4fqH3IaeJi6xtNoRdc5YXuzILnp+KaJyPE5CR
-qUY5JibOD3qR7zDjP0ueP93jLqmoKltCdN5+yYEExtSwz5lXniiYOJp8LWFCgv5h
-m8aYXkcJS1xVV9Ltno23YvX5edw9QY4hABEBAAGJAR8EGAECAAkFAk/d7o8CGwwA
-CgkQgrEpkn+jMD5Figf/dIC1qtDMTbu5IsI5uZPX63xydaExQNYf98cq5H2fWF6O
-yVR7ERzA2w33hI0yZQrqO6pU9SRnHRxCFvGv6y+mXXXMRcmjZG7GiD6tQWeN/3wb
-EbAn5cg6CJ/Lk/BI4iRRfBX07LbYULCohlGkwBOkRo10T+Ld4vCCnBftCh5x2OtZ
-TOWRULxP36y2PLGVNF+q9pho98qx+RIxvpofQM/842ZycjPJvzgVQsW4LT91KYAE
-4TVf6JjwUM6HZDoiNcX6d7zOhNfQihXTsniZZ6rky287htsWVDNkqOi5T3oTxWUo
-m++/7s3K3L0zWopdhMVcgg6Nt9gcjzqN1c0gy55L/g==
-=mNSj
------END PGP PUBLIC KEY BLOCK-----
diff --git a/stage0/00-configure-apt/files/raspbian.sources b/stage0/00-configure-apt/files/raspbian.sources
new file mode 100644
index 0000000..0f2e26f
--- /dev/null
+++ b/stage0/00-configure-apt/files/raspbian.sources
@@ -0,0 +1,6 @@
+Types: deb
+URIs: http://raspbian.raspberrypi.com/raspbian/
+Arch: armhf
+Suites: RELEASE
+Components: main contrib non-free rpi
+Signed-By: /usr/share/keyrings/raspbian-archive-keyring.gpg
diff --git a/stage0/00-configure-apt/files/raspi.list b/stage0/00-configure-apt/files/raspi.list
deleted file mode 100644
index 5f889b1..0000000
--- a/stage0/00-configure-apt/files/raspi.list
+++ /dev/null
@@ -1,3 +0,0 @@
-deb http://archive.raspberrypi.com/debian/ RELEASE main
-# Uncomment line below then 'apt-get update' to enable 'apt-get source'
-#deb-src http://archive.raspberrypi.com/debian/ RELEASE main
diff --git a/stage0/00-configure-apt/files/raspi.sources b/stage0/00-configure-apt/files/raspi.sources
new file mode 100644
index 0000000..1ec8b97
--- /dev/null
+++ b/stage0/00-configure-apt/files/raspi.sources
@@ -0,0 +1,5 @@
+Types: deb
+URIs: http://archive.raspberrypi.com/debian/
+Suites: RELEASE
+Components: main
+Signed-By: /usr/share/keyrings/raspberrypi-archive-keyring.pgp
diff --git a/stage0/00-configure-apt/files/sources.list b/stage0/00-configure-apt/files/sources.list
deleted file mode 100644
index 3ef0699..0000000
--- a/stage0/00-configure-apt/files/sources.list
+++ /dev/null
@@ -1,3 +0,0 @@
-deb [ arch=armhf ] http://raspbian.raspberrypi.com/raspbian/ RELEASE main contrib non-free rpi
-# Uncomment line below then 'apt-get update' to enable 'apt-get source'
-#deb-src http://raspbian.raspberrypi.com/raspbian/ RELEASE main contrib non-free rpi