Add templating for simplified maintenance

[tianon]

No description provided.

[tianon]

I'm wondering if the long-term fix for #319 really needs to be downloading their .asc file, importing it, verifying that we got exactly the list of keys we expected, then moving on from there. 😞

[yosifkit]

I'm wondering if the long-term fix for #319 really needs to be downloading their .asc file, importing it, verifying that we got exactly the list of keys we expected, then moving on from there.

I think the current "fix" is fine for now, but maybe swap to that approach by 2020-01-05? 🤷‍♂️

pub   rsa4096 2016-01-11 [SC] [expires: 2020-01-05]
      0C49 F373 0359 A145 1858  5931 BC71 1F9B A157 03C6
uid           [ unknown] MongoDB 3.4 Release Signing Key <packaging@mongodb.com>

pub   rsa4096 2016-12-14 [SC] [expires: 2023-12-09]
      2930 ADAE 8CAF 5059 EE73  BB4B 5871 2A22 91FA 4AD5
uid           [ unknown] MongoDB 3.6 Release Signing Key <packaging@mongodb.com>

pub   rsa4096 2018-04-18 [SC] [expires: 2023-04-17]
      9DA3 1620 334B D75D 9DCB  49F3 6881 8C72 E525 29D4
uid           [ unknown] MongoDB 4.0 Release Signing Key <packaging@mongodb.com>

pub   rsa4096 2018-04-18 [SC] [expires: 2023-04-17]
      E162 F504 A20C DF15 827F  718D 4B7C 549A 058F 8B6B
uid           [ unknown] MongoDB 4.2 Release Signing Key <packaging@mongodb.com>

[tianon]

Just for my future self's sake:

diff --git a/4.0/Dockerfile b/4.0/Dockerfile
index e95d6a4..7e683fa 100644
--- a/4.0/Dockerfile
+++ b/4.0/Dockerfile
@@ -20,7 +20,10 @@ ENV GOSU_VERSION 1.10
 # grab "js-yaml" for parsing mongod's YAML config files (https://github.com/nodeca/js-yaml/releases)
 ENV JSYAML_VERSION 3.10.0
 
-RUN set -ex; \
+ENV GPG_KEYS 9DA31620334BD75D9DCB49F368818C72E52529D4
+ENV GPG_KEYS_URL https://www.mongodb.org/static/pgp/server-4.0.asc
+
+RUN set -eux; \
 	\
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
@@ -45,20 +48,21 @@ RUN set -ex; \
 	wget -O /js-yaml.js "https://github.com/nodeca/js-yaml/raw/${JSYAML_VERSION}/dist/js-yaml.js"; \
 # TODO some sort of download verification here
 	\
-	apt-get purge -y --auto-remove wget
-
-RUN mkdir /docker-entrypoint-initdb.d
-
-ENV GPG_KEYS 9DA31620334BD75D9DCB49F368818C72E52529D4
-RUN set -ex; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	for key in $GPG_KEYS; do \
-		gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$key"; \
-	done; \
-	gpg --batch --export $GPG_KEYS > /etc/apt/trusted.gpg.d/mongodb.gpg; \
+	wget -O gpg.asc "$GPG_KEYS_URL"; \
+	gpg --batch --import gpg.asc; \
+	rm gpg.asc; \
+	importedKeys="$(gpg --batch --fingerprint --with-colons | grep "^fpr:" | cut -d: -f10 | sort -u | xargs)"; \
+	expectedKeys="$(echo "$GPG_KEYS" | xargs -n1 | sort -u | xargs)"; \
+	[ "$importedKeys" = "$expectedKeys" ]; \
+	gpg --batch --export $expectedKeys > /etc/apt/trusted.gpg.d/mongodb.gpg; \
 	command -v gpgconf && gpgconf --kill all || :; \
 	rm -r "$GNUPGHOME"; \
-	apt-key list
+	apt-key list | grep MongoDB; \
+	\
+	apt-get purge -y --auto-remove wget
+
+RUN mkdir /docker-entrypoint-initdb.d
 
 # Allow build-time overrides (eg. to build image with MongoDB Enterprise version)
 # Options for MONGO_PACKAGE: mongodb-org OR mongodb-enterprise