fix: replace gpg --dearmor with direct .asc file usage for apt keys

.github/scripts/compute-image-tag.sh

@@ -9,7 +9,7 @@
 #
 # Arguments:
 #   version - The version for the tag (e.g., "1877.10.1", "pr-123")
-#   flavor  - The image flavor (e.g., "metal-sci-usi-amd64"). Defaults to "metal-sci-usi-amd64".
+#   flavor  - The image flavor (e.g., "baremetal-sci-usi-amd64"). Defaults to "baremetal-sci-usi-amd64".
 #
 # Environment:
 #   GITHUB_SHA - Git commit SHA (required, set automatically by GitHub Actions)
@@ -22,15 +22,15 @@
 #
 # Examples:
 #   ./compute-image-tag.sh "1877.10.1"
-#   # Output: 1877.10.1-metal-sci-usi-amd64-1877-10-1-abcd1234
+#   # Output: 1877.10.1-baremetal-sci-usi-amd64-1877-10-1-abcd1234
 #
-#   ./compute-image-tag.sh "pr-123" "metal-capi-amd64"
-#   # Output: pr-123-metal-capi-amd64-pr-123-abcd1234
+#   ./compute-image-tag.sh "pr-123" "baremetal-capi-amd64"
+#   # Output: pr-123-baremetal-capi-amd64-pr-123-abcd1234
 
 set -euo pipefail
 
 VERSION="${1:?Error: VERSION argument required}"
-FLAVOR="${2:-metal-sci-usi-amd64}"
+FLAVOR="${2:-baremetal-sci-usi-amd64}"
 
 if [ -z "${GITHUB_SHA:-}" ]; then
     echo "Error: GITHUB_SHA environment variable is required" >&2

.github/workflows/dev.yml

@@ -42,7 +42,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@19d89d573a9c05266f3db9233f4d68aaa131ce12
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@36078a576d0767433423289f2fa217b96cd951c9
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -82,7 +82,7 @@ jobs:
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       upload_version: ${{ needs.meta.outputs.UPLOAD_VERSION }}
-      flavor_filter: '--include-only "metal-sci_usi-amd64"'
+      flavor_filter: '--include-only "baremetal-sci_usi-amd64"'
     secrets: inherit
 
   test:

.github/workflows/nightly.yaml

@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@19d89d573a9c05266f3db9233f4d68aaa131ce12
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@36078a576d0767433423289f2fa217b96cd951c9
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@19d89d573a9c05266f3db9233f4d68aaa131ce12
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@36078a576d0767433423289f2fa217b96cd951c9
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}

.github/workflows/upload_oci.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@19d89d573a9c05266f3db9233f4d68aaa131ce12
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@36078a576d0767433423289f2fa217b96cd951c9
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:

features/_scicommon/exec.config

@@ -17,14 +17,14 @@ K8S_VERSION_REPO="${CAPI_VERSION%.*}"
 
 # key can be downloaded liek e.g.
 # curl -fsSL https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/Release.key > pkgs-k8s-io_${K8S_VERSION_REPO}_release.key
-gpg --dearmor -o "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg" <"/builder/features/_scicommon/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key"
+cp "/builder/features/_scicommon/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key" "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc"
 
 cat <<EOF | tee /etc/apt/sources.list.d/kubernetes-"${K8S_VERSION_REPO}".sources
 Types: deb
 Architectures: amd64
 URIs: https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/
 Suites: /
-Signed-By: /etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg
+Signed-By: /etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc
 EOF
 
 DEBIAN_FRONTEND=noninteractive apt update -y

features/baremetal

@@ -0,0 +1 @@
+../gardenlinux/features/baremetal

features/metal3/exec.config

@@ -26,7 +26,7 @@ apt-mark hold ${package_name}
 K8S_VERSION=v1.30.7
 K8S_VERSION_REPO="${K8S_VERSION%.*}"
 
-gpg --dearmor -o "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg" </builder/features/metal3/pkgs-k8s-io_1.30_release.key
-echo "deb [signed-by=/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes-${K8S_VERSION_REPO}.list
+cp "/builder/features/metal3/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key" "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc"
+echo "deb [signed-by=/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes-${K8S_VERSION_REPO}.list
 apt update -y
 apt install -y --no-install-recommends "cri-tools=${K8S_VERSION_REPO#v}*"

features/openstackCloud

@@ -0,0 +1 @@
+../gardenlinux/features/openstackCloud

features/openstackMetal

@@ -0,0 +1 @@
+../gardenlinux/features/openstackMetal

flavors.yaml

@@ -1,5 +1,5 @@
 targets:
-  - name: metal 
+  - name: baremetal
     category: baremetal
     flavors:
       - features: