diff --git a/keyrings/ros.gpg b/keyrings/ros.gpg index ac18cb4729..be60e15986 100644 Binary files a/keyrings/ros.gpg and b/keyrings/ros.gpg differ diff --git a/keyrings/ros_old.gpg b/keyrings/ros_old.gpg new file mode 100644 index 0000000000..ac18cb4729 Binary files /dev/null and b/keyrings/ros_old.gpg differ diff --git a/snapcraft/plugins/catkin.py b/snapcraft/plugins/catkin.py index bc4497d734..7e6ce62241 100644 --- a/snapcraft/plugins/catkin.py +++ b/snapcraft/plugins/catkin.py @@ -99,6 +99,13 @@ _ROS_KEYRING_PATH = os.path.join(snapcraft.internal.common.get_keyringsdir(), "ros.gpg") +# This needs to be removed once ROS finishes rolling out key rotation. See +# https://discourse.ros.org/t/security-issue-on-ros-build-farm/9342 for more +# details. +_OLD_ROS_KEYRING_PATH = os.path.join( + snapcraft.internal.common.get_keyringsdir(), "ros_old.gpg" +) + class CatkinInvalidSystemDependencyError(errors.SnapcraftError): fmt = ( @@ -268,7 +275,7 @@ def PLUGIN_STAGE_SOURCES(self): @property def PLUGIN_STAGE_KEYRINGS(self): - return [_ROS_KEYRING_PATH] + return [_ROS_KEYRING_PATH, _OLD_ROS_KEYRING_PATH] def __init__(self, name, options, project): super().__init__(name, options, project) diff --git a/snapcraft/plugins/colcon.py b/snapcraft/plugins/colcon.py index 8e1f27b1d8..064b3d19e8 100644 --- a/snapcraft/plugins/colcon.py +++ b/snapcraft/plugins/colcon.py @@ -78,6 +78,13 @@ _ROS_KEYRING_PATH = os.path.join(snapcraft.internal.common.get_keyringsdir(), "ros.gpg") +# This needs to be removed once ROS finishes rolling out key rotation. See +# https://discourse.ros.org/t/security-issue-on-ros-build-farm/9342 for more +# details. +_OLD_ROS_KEYRING_PATH = os.path.join( + snapcraft.internal.common.get_keyringsdir(), "ros_old.gpg" +) + class ColconInvalidSystemDependencyError(errors.SnapcraftError): fmt = ( @@ -233,7 +240,7 @@ def PLUGIN_STAGE_SOURCES(self): @property def PLUGIN_STAGE_KEYRINGS(self): - return [_ROS_KEYRING_PATH] + return [_ROS_KEYRING_PATH, _OLD_ROS_KEYRING_PATH] def __init__(self, name, options, project): super().__init__(name, options, project)