From 32228926056ca0b782d1e3800c63220e56ebfa4c Mon Sep 17 00:00:00 2001
From: Bendik Aagaard Lynghaug <bendik.lynghaug@gmail.com>
Date: Mon, 28 Sep 2026 20:53:41 +0200
Subject: [PATCH] gdo image: trust the registry's key instead of skipping the
 check

---
 gdo/Dockerfile        | 19 ++++++++++++++++++-
 gdo/uhhm-registry.asc | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 gdo/uhhm-registry.asc

diff --git a/gdo/Dockerfile b/gdo/Dockerfile
index 8df2ad2..0636220 100644
--- a/gdo/Dockerfile
+++ b/gdo/Dockerfile
@@ -4,7 +4,23 @@
 # is built from that instead.
 FROM archlinux:base
 ARG GDO_RELEASE
-RUN printf '%s\n' \
+
+# The registry's signing key, vendored beside this file. A fresh
+# container trusts nothing, and the key is on no public keyserver, so
+# `pacman-key --recv-keys` cannot find it - which is why this is here
+# rather than fetched. It is a public key: checked in, not a secret.
+#
+# Vendored rather than turning the signature check off: the packages
+# come over HTTPS from a host we run, and it would be easy to call that
+# good enough, but then nothing would notice a package that host did
+# not sign. Locally signed, the check stays real.
+COPY uhhm-registry.asc /tmp/uhhm-registry.asc
+RUN pacman-key --init \
+ && pacman-key --populate archlinux \
+ && pacman-key --add /tmp/uhhm-registry.asc \
+ && pacman-key --lsign-key 1BCBE90F04AD9859D7BCC9BB53CBF90AA4C56211 \
+ && rm /tmp/uhhm-registry.asc \
+ && printf '%s\n' \
       '[uhhm]' \
       'SigLevel = Required DatabaseOptional' \
       'Server = https://project.uhhm.no/api/packages/bl/arch/$repo/$arch' \
@@ -12,6 +28,7 @@ RUN printf '%s\n' \
  && pacman -Sy --noconfirm --needed ca-certificates gdo \
  && pacman -Scc --noconfirm \
  && rm -rf /var/cache/pacman/pkg/* /var/lib/pacman/sync/*
+
 # A non-root user; gdo writes nothing and holds no state - what it has
 # not yet delivered is on the stream, not on disk.
 RUN useradd --system --no-create-home gdo
diff --git a/gdo/uhhm-registry.asc b/gdo/uhhm-registry.asc
new file mode 100644
index 0000000..bbbbbb7
--- /dev/null
+++ b/gdo/uhhm-registry.asc
@@ -0,0 +1,32 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBGqmbiMBCADQstH5C75cvJgFcshUOdUV6Gg8djazEz8mDWBFxqXWfSO9I0ht
+IrZvcH193TykLI6vjEv+yIhhQXDWwLMeFy6Os/tUHm9J2AasziZ/P2TkJw3/aVr5
+iTptkJmH0JdLacG4w6Rhsu8nVhxvSVjsOCMaxMpjs3W7A5U0g4EkgFdht7/cFitT
+1sJNpGF4OyDIuY81L6HqSbgZsmHHpi86qe9nQNKzQiIqkld0v7trx68HTAjlOEYp
+A8SLFzDGijXL0vbHgP+dAyvzYNffQpRud8tEisH7C8gNMdwWMrUyMKbwH+KqvTQb
+e8iauGpEisBN/hjcAT/1op9dT0TM0HKppdM7ABEBAAG0DyhBcmNoIFJlZ2lzdHJ5
+KYkBewQTAQgAbwWCaqZuIwILBwkQU8v5CqTFYhE1FAAAAAAAHAAQc2FsdEBub3Rh
+dGlvbnMub3BlbnBncGpzLm9yZ9fHjPBNwHWVxRgwyphNJykCFQgCFgACGQECmwMC
+HgEWIQQby+kPBK2YWde8ybtTy/kKpMViEQAAcUYH/iQUP36gpeP5diiaPDBceNJP
+6tFW/MAT9igc1XCb0gWOBlR9iK43Jf8ff23a1CObuPnkOtsfIC96njx4J2gqHUdB
+y07Az/zewTw1yZl0FehNAF8bOR1pdqFaeRj3+OV/ZL1oyTXPGIHkUePLnAMIqU1Z
+H9o5ys5EHC82BvXhMgNG5oPLJgcmbQRErkLca81QDaDunAEFuOVDACMPDeFCC/pa
+9u85W6hAJQyuiP0Q5WzO30P5qnqqHp3vDx3u0b0bmzEMAiA/Pf1BFHzE9dKWYLWQ
+mtWpDV6x+rwusgKaaQNTvWWtI6rjPUPZDjO7n98cN3bD5MHHA3x6TlF0MJCwoCq5
+AQ0EaqZuIwEIAMGed6Ygl1NmCUar1/ZvOy48FzZpjImz0Rwe4HcDyVOUvrlRqUSZ
+FEqIGc9+T+1z/Xq8aXZSYQLGBViuymSNBZZXLhHhqrHsUXjqc5LL4XeTgn9woN9r
+0PFA8xEb5u7mV2KGBoHoI0sg2xsl42wft59TK5COJYwBRwVmynR0Q4KWUk9B+rAX
+GuAqxG0q9C9lrSnLhkyiBZm+Oi/hkY+TxTaA12+k0Qvv3J6vjLgfON3YUQbFEFDW
+g5WwX+g0GM2Z4W4WYQwckb0EaQ7IMN6UoLx/Efn4cQdRWDvyzHNxKhXiOYqmqadK
+NjTNc9Kbzxid39sBQpTKZXNoZt5DiqZ+owkAEQEAAYkBbAQYAQgAYAWCaqZuIwkQ
+U8v5CqTFYhE1FAAAAAAAHAAQc2FsdEBub3RhdGlvbnMub3BlbnBncGpzLm9yZ7ok
+Qb6LY+xTTkrXwUWwvtACmwwWIQQby+kPBK2YWde8ybtTy/kKpMViEQAAl6QH/jK3
+RooaaOr/n3xzIZTRCCwmoLI/EZhMxg3pZElCCJVwiQemsGLUmdw9Y0PlsDaHcSNO
+PffkYrTuJm3bQBo2qYduA55pfE17BXT+eHlG21qekBiZVYYUUBsYGLluWGnAApVR
+BAnNhStfxqRew0Vmol6OZayuOnNKstG12jjoki9Ik9sye2Slrlo6tZf+ckP7mFZy
+a/iGOhVmQy6dHvc27duKY/fXplZR02eKDia435bCHcsHEnMWPyOKC1m+ep/KxShi
+FsLI9Ts90GBSf7evhlbKE3M7HZZ+glWBObQ1V9XVOCaY1piGFuHAVTDCAnoiXFUb
+2jMINzb4RrlA65VyNzg=
+=09+J
+-----END PGP PUBLIC KEY BLOCK-----