coffey-labs/ubuntu2mint
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Refactor key fetching and validation logic

Browse Source
This commit is contained in:
LINUXexpert.org
2026-01-22 18:01:07 -07:00
committed by GitHub
parent d6550cf325
commit a093c5a4b4
1 changed files with 62 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ubuntu-to-mint-convert-v3.sh
+40 -11
View File
@@ -309,8 +309,9 @@ if ! curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid
|| die "Unable to fetch Mint repo key via keyserver or HTTPS fallback." || die "Unable to fetch Mint repo key via keyserver or HTTPS fallback."
fi fi
# Sanity: ensure it's a PGP public key block # Sanity: ensure it's a PGP public key block (avoid proxy HTML portals)
grep -q "BEGIN PGP PUBLIC KEY BLOCK" "$armored" || die "Downloaded key is not a PGP public key block (proxy portal/HTML?)" grep -q "BEGIN PGP PUBLIC KEY BLOCK" "$armored" \
|| die "Downloaded key is not a PGP public key block (proxy portal/HTML?)"
# Validate: the expected keyid appears in the key block (pub OR sub) # Validate: the expected keyid appears in the key block (pub OR sub)
local found="no" local found="no"
@@ -323,9 +324,9 @@ done < <(gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="pub"||
[[ "$found" == "yes" ]] || die "Fetched key does not contain expected keyid ${keyid^^}" [[ "$found" == "yes" ]] || die "Fetched key does not contain expected keyid ${keyid^^}"
# (Optional) extra guard: make sure the UID looks like Linux Mint repo key # Optional guard: check UID contains expected label
if ! gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="uid"{print $10}' | grep -qi "Linux Mint Repository Signing Key"; then if ! gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="uid"{print $10}' | grep -qi "Linux Mint Repository Signing Key"; then
warn "Keyid matched but UID did not match expected Mint repo UID; review /tmp key block if concerned." warn "Keyid matched but UID did not match expected Mint repo UID; review the downloaded key if concerned."
fi fi
gpg --batch --dearmor -o "$out_keyring" "$armored" gpg --batch --dearmor -o "$out_keyring" "$armored"
@@ -340,7 +341,6 @@ return 0
rm -rf "$gnupghome" rm -rf "$gnupghome"
} }
mint_repo_key_install() { mint_repo_key_install() {
local keyring="/usr/share/keyrings/linuxmint-repo.gpg" local keyring="/usr/share/keyrings/linuxmint-repo.gpg"
info "Installing Linux Mint repo signing key into ${keyring}" info "Installing Linux Mint repo signing key into ${keyring}"
@@ -381,22 +381,40 @@ write_mint_pinning_system() {
info "Writing conservative APT pinning to ${pref}" info "Writing conservative APT pinning to ${pref}"
cat > "$pref" <<'EOF' cat > "$pref" <<'EOF'
# Default: do NOT prefer Mint for everything.
Package: * Package: *
Pin: origin "packages.linuxmint.com" Pin: release o=LinuxMint
Pin-Priority: 100 Pin-Priority: 100
# Prefer Mint for Mint tooling
Package: mint* mintsources* mintupdate* mintsystem* mintstick* mintmenu* mintlocale* mintdrivers* mintreport* mintwelcome* Package: mint* mintsources* mintupdate* mintsystem* mintstick* mintmenu* mintlocale* mintdrivers* mintreport* mintwelcome*
Pin: origin "packages.linuxmint.com" Pin: release o=LinuxMint
Pin-Priority: 700 Pin-Priority: 700
Package: cinnamon* nemo* muffin* cjs* xapp* slick-greeter* lightdm* pix* xviewer* mint-themes* mint-y-icons* mint-x-icons* # Prefer Mint for Cinnamon/Nemo stack (apps)
Pin: origin "packages.linuxmint.com" Package: cinnamon* nemo* muffin* cjs* slick-greeter* lightdm* pix* xviewer* mint-themes* mint-y-icons* mint-x-icons*
Pin-Priority: 700 Pin: release o=LinuxMint
Pin-Priority: 900
# Prefer Mint for XApp stack (critical deps for mintreport + nemo/cinnamon)
Package: python3-xapp* python-xapp* libxapp* gir1.2-xapp* xapps* xapps-common xapp-symbolic-icons xapp-status-icon
Pin: release o=LinuxMint
Pin-Priority: 1001
# Prefer Mint for Cinnamon/Nemo libraries that must match exact versions
Package: libnemo-extension1* nemo-data*
Pin: release o=LinuxMint
Pin-Priority: 1001
Package: libcinnamon-control-center1* libcinnamon-menu-3-0* libcinnamon-desktop4* cinnamon-desktop-data* cinnamon-control-center-data* cinnamon-l10n*
Pin: release o=LinuxMint
Pin-Priority: 1001
EOF EOF
ok "Pinning written." ok "Pinning written."
} }
disable_thirdparty_sources_system() { disable_thirdparty_sources_system() {
local backup_dir="$1" local backup_dir="$1"
local disabled_dir="${backup_dir}/disabled-sources" local disabled_dir="${backup_dir}/disabled-sources"
@@ -404,15 +422,26 @@ disable_thirdparty_sources_system() {
info "Disabling 3rd-party sources into: ${disabled_dir}" info "Disabling 3rd-party sources into: ${disabled_dir}"
shopt -s nullglob shopt -s nullglob
local allow_re='(crowdstrike|falcon|globalprotect|paloalto|pan(gp)?|cortex|prisma)'
for f in /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do for f in /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
[[ "$(basename "$f")" == "official-package-repositories.list" ]] && continue [[ "$(basename "$f")" == "official-package-repositories.list" ]] && continue
# Preserve known security/VPN vendor repos
if echo "$(basename "$f")" | grep -Eiq "$allow_re" || grep -Eiq "$allow_re" "$f"; then
info "Preserving vendor repo: $f"
continue
fi
mv -v "$f" "${disabled_dir}/" || true mv -v "$f" "${disabled_dir}/" || true
done done
shopt -u nullglob
shopt -u nullglob
ok "Third-party sources disabled (restorable via rollback)." ok "Third-party sources disabled (restorable via rollback)."
} }
backup_system_state() { backup_system_state() {
local backup_dir="/root/ubuntu-to-mint-backup-$(date +%Y%m%d-%H%M%S)" local backup_dir="/root/ubuntu-to-mint-backup-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$backup_dir" mkdir -p "$backup_dir"