Fix: trashman: tor: ensure seamless deb.torproject.org-keyring upgrades

2 files changed, 20 insertions, 8 deletions

diff --git a/share/trashman/tor/unix/linux/debian/files/etc/apt/trusted.gpg.d/torproject.org.gpg b/share/trashman/tor/unix/linux/debian/files/usr/share/keyrings/deb.torproject.org-keyring.gpg
index 7614b20..738ef5d 100644
--- a/share/trashman/tor/unix/linux/debian/files/etc/apt/trusted.gpg.d/torproject.org.gpg
+++ b/share/trashman/tor/unix/linux/debian/files/usr/share/keyrings/deb.torproject.org-keyring.gpg
diff --git a/share/trashman/tor/unix/linux/debian/install b/share/trashman/tor/unix/linux/debian/install
index 6676c8d..5b70819 100755
--- a/share/trashman/tor/unix/linux/debian/install
+++ b/share/trashman/tor/unix/linux/debian/install
@@ -7,6 +7,7 @@
 SHARE="$1"
 LIB="$2"
 REQUIREMENTS="apt-transport-https wget gnupg"
+KEYRING="/usr/share/keyrings/deb.torproject.org-keyring.gpg"
 
 # Include basic functions
 . $LIB/trashman/functions || exit 1
@@ -19,16 +20,27 @@ trashman_apt_install $REQUIREMENTS
 DISTRIBUTION="`trashman_debian_major_version_name`"
 
 cat <<-EOF > /etc/apt/sources.list.d/tor.list
-   deb     [signed-by=/etc/apt/trusted.gpg.d/torproject.org.gpg] https://deb.torproject.org/torproject.org $DISTRIBUTION main
-   deb-src [signed-by=/etc/apt/trusted.gpg.d/torproject.org.gpg] https://deb.torproject.org/torproject.org $DISTRIBUTION main
+   deb     [signed-by=${KEYRING}] https://deb.torproject.org/torproject.org $DISTRIBUTION main
+   deb-src [signed-by=${KEYRING}] https://deb.torproject.org/torproject.org $DISTRIBUTION main
 EOF
 
-# Remove key from old location
+# Remove key from old locations
 rm -f /usr/share/keyrings/tor-archive-keyring.gpg
-
-#wget -O- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | tee /usr/share/keyrings/tor-archive-keyring.gpg >/dev/null
-cp $SHARE/tor/unix/linux/debian/files/etc/apt/trusted.gpg.d/torproject.org.gpg /etc/apt/trusted.gpg.d/
-
-apt update && apt install -y tor deb.torproject.org-keyring
+rm -f /etc/apt/trusted.gpg.d/ /etc/apt/trusted.gpg.d/torproject.org.gpg
+
+# Install temporary keyring
+# Details at https://support.torproject.org/apt/tor-deb-repo/
+#wget -O- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | \
+#  gpg --dearmor | tee /usr/share/keyrings/deb.torproject.org-keyring.gpg > /dev/null
+if [ ! -e "${KEYRING}" ]; then
+  cp $SHARE/tor/unix/linux/debian/files/${KEYRING} ${KEYRING}
+fi
+
+# Now that we have the config and the keyring, leave it to be managed by
+# deb.torproject.org-keyring package.
+#
+# Do an upgrade first to make sure we have the latest keyring package
+# installed if that's not the first time this script is running.
+apt update && apt upgrade -y && apt install -y tor deb.torproject.org-keyring
 
 #rm -rf /var/lib/apt/lists/*