From 1acf531abd39968951d7ae0324185c9d7c86e5f3 Mon Sep 17 00:00:00 2001
From: Fabian Koller <github@kthxbye.cyou>
Date: Thu, 26 Feb 2026 16:46:49 +0100
Subject: [PATCH] fix: replace gpg --dearmor with direct .asc file usage for
 apt keys

Replace gpg --dearmor operations with direct cp to .asc files for APT
repository key handling. APT natively supports ASCII-armored .asc files,
eliminating the need for GPG conversion and avoiding MD5 digest issues.

This change applies the solution from upstream PR gardenlinux/gardenlinux#4388
to the gardenlinux-ccloud repository files.

Changes:
- features/_scicommon/exec.config: Use cp to .asc for Kubernetes keyring
- features/metal3/exec.config: Use cp to .asc with generic filename
- features/khost/exec.late: Use cp to .asc for Kubernetes keyring

Note: Changes to gardenlinux submodule features will be handled independently.
---
 features/_scicommon/exec.config | 4 ++--
 features/khost/exec.late        | 4 ++--
 features/metal3/exec.config     | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/features/_scicommon/exec.config b/features/_scicommon/exec.config
index c67667e1..5efda446 100755
--- a/features/_scicommon/exec.config
+++ b/features/_scicommon/exec.config
@@ -17,14 +17,14 @@ K8S_VERSION_REPO="${CAPI_VERSION%.*}"
 
 # key can be downloaded liek e.g.
 # curl -fsSL https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/Release.key > pkgs-k8s-io_${K8S_VERSION_REPO}_release.key
-gpg --dearmor -o "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg" <"/builder/features/_scicommon/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key"
+cp "/builder/features/_scicommon/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key" "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc"
 
 cat <<EOF | tee /etc/apt/sources.list.d/kubernetes-"${K8S_VERSION_REPO}".sources
 Types: deb
 Architectures: amd64
 URIs: https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/
 Suites: /
-Signed-By: /etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg
+Signed-By: /etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc
 EOF
 
 DEBIAN_FRONTEND=noninteractive apt update -y
diff --git a/features/khost/exec.late b/features/khost/exec.late
index 69bcfa62..f0ea8caf 100755
--- a/features/khost/exec.late
+++ b/features/khost/exec.late
@@ -4,8 +4,8 @@ set -Eeuo pipefail
 K8S_VERSION=v1.34.3
 K8S_VERSION_REPO="${K8S_VERSION%.*}"
 
-gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg < /builder/features/khost/release.key
-echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list
+cp /builder/features/khost/release.key /etc/apt/keyrings/kubernetes-apt-keyring.asc
+echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.asc] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list
 apt update -y
 apt install -y --no-install-recommends "kubelet=${K8S_VERSION#v}*" "kubectl=${K8S_VERSION#v}*" "kubeadm=${K8S_VERSION#v}*" "cri-tools=${K8S_VERSION_REPO#v}*"
 
diff --git a/features/metal3/exec.config b/features/metal3/exec.config
index b15043a1..4fdb8e0f 100755
--- a/features/metal3/exec.config
+++ b/features/metal3/exec.config
@@ -26,7 +26,7 @@ apt-mark hold ${package_name}
 K8S_VERSION=v1.30.7
 K8S_VERSION_REPO="${K8S_VERSION%.*}"
 
-gpg --dearmor -o "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg" </builder/features/metal3/pkgs-k8s-io_1.30_release.key
-echo "deb [signed-by=/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes-${K8S_VERSION_REPO}.list
+cp "/builder/features/metal3/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key" "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc"
+echo "deb [signed-by=/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes-${K8S_VERSION_REPO}.list
 apt update -y
 apt install -y --no-install-recommends "cri-tools=${K8S_VERSION_REPO#v}*"