pmbootstrap install --no-local-pkgs: new option

Don't install locally compiled packages and package signing keys. This
will be used for the official images generated with pmbootstrap.

pmb/helpers/frontend.py

@@ -1,5 +1,6 @@
 # Copyright 2020 Oliver Smith
 # SPDX-License-Identifier: GPL-3.0-or-later
+import glob
 import json
 import logging
 import os
@@ -228,6 +229,18 @@ def install(args):
         if flasher.get("split", False):
             args.split = True
 
+    # Don't install locally compiled packages and package signing keys
+    if not args.install_local_pkgs:
+        # Implies that we don't build outdated packages (overriding the answer
+        # in 'pmbootstrap init')
+        args.install_build_pkgs = False
+
+        # Safest way to avoid installing local packages is having none
+        if glob.glob(f"{args.work}/packages/*"):
+            raise ValueError("--no-local-pkgs specified, but locally built"
+                             " packages found. Consider 'pmbootstrap zap -p'"
+                             " to delete them.")
+
     pmb.install.install(args)
 
 

pmb/install/_install.py

@@ -154,12 +154,20 @@ def create_home_from_skel(args):
 
 def configure_apk(args):
     """
-    Copies over all keys used locally to compile packages, and disables the
-    /mnt/pmbootstrap-packages repository.
+    Copy over all official keys, and the keys used to compile local packages
+    (unless --no-local-pkgs is set). Then disable the /mnt/pmbootstrap-packages
+    repository.
     """
+    # Official keys
+    pattern = f"{pmb.config.apk_keys_path}/*.pub"
+
+    # Official keys + local keys
+    if args.install_local_pkgs:
+        pattern = f"{args.work}/config_apk_keys/*.pub"
+
     # Copy over keys
     rootfs = args.work + "/chroot_native/mnt/install"
-    for key in glob.glob(args.work + "/config_apk_keys/*.pub"):
+    for key in glob.glob(pattern):
         pmb.helpers.run.root(args, ["cp", key, rootfs + "/etc/apk/keys/"])
 
     # Disable pmbootstrap repository

pmb/parse/arguments.py

@@ -562,6 +562,9 @@ def arguments():
                          help="wrap the resulting image in a graphical"
                               " on-device installer, so the installation can"
                               " be customized after flashing")
+    install.add_argument("--no-local-pkgs", dest="install_local_pkgs",
+                         help="do not install locally compiled packages and"
+                              " package signing keys", action="store_false")
     group = install.add_mutually_exclusive_group()
     group.add_argument("--sparse", help="generate sparse image file"
                        " (even if unsupported by device)", default=None,