imsd: sign from a readable copy of the abuild key

Run 49 died in section 3b: pmbootstrap's abuild-keygen runs inside the
chroot as its own user (uid 12345), so the key in config_abuild/ is 0600 to
that uid and the build user cannot read it; openssl dgst -sign exited 1 and
apk-resign.py swallowed its stderr. Take a private copy via sudo for the
duration of the re-sign, and make the script name an unreadable key and let
openssl's stderr through instead of hiding it.

apk-resign.py

@@ -11,6 +11,7 @@ This is what abuild-sign does to the control segment when abuild packages.
 """
 import gzip
 import io
+import os
 import subprocess
 import sys
 import tarfile
@@ -53,10 +54,17 @@ def main(path, privkey, pubname):
     kind = name.split(".")[2] if name.startswith(".SIGN.") else ""
     if kind not in DIGEST:
         sys.exit(f"{path}: unexpected signature entry {name!r}")
-    sig = subprocess.run(
+    if not os.access(privkey, os.R_OK):
-        ["openssl", "dgst", f"-{DIGEST[kind]}", "-sign", privkey],
+        sys.exit(f"{privkey}: not readable by uid {os.getuid()} (pmbootstrap's "
-        input=control, capture_output=True, check=True,
+                 "abuild-keygen runs as the chroot user, uid 12345, and leaves "
-    ).stdout
+                 "the key 0600 to it - sign from a readable copy)")
+    try:
+        sig = subprocess.run(
+            ["openssl", "dgst", f"-{DIGEST[kind]}", "-sign", privkey],
+            input=control, stdout=subprocess.PIPE, check=True,
+        ).stdout
+    except subprocess.CalledProcessError as e:
+        sys.exit(f"openssl dgst -sign exited {e.returncode} signing {path}")
     buf = io.BytesIO()
     with tarfile.open(fileobj=buf, mode="w", format=tarfile.USTAR_FORMAT) as tar:
         info = tarfile.TarInfo(f".SIGN.{kind}.{pubname}")

build.sh

@@ -268,9 +268,15 @@ if [ ! -f "$ABUILD_KEY" ]; then
 	echo "expected exactly one abuild key in $WORKDIR/config_abuild" >&2
 	exit 1
 fi
+# abuild-keygen ran inside the chroot as pmbootstrap's user (uid 12345), so
+# the key is 0600 to that uid and unreadable here (run 49 died on exactly
+# this); sign from a private copy taken via sudo, then drop it.
+KEYCOPY="$IMSD_DL/abuild-key.rsa"
+sudo install -m 0600 -o "$(id -un)" "$ABUILD_KEY" "$KEYCOPY"
 for _f in "$IMSD_DL"/*.apk; do
-	python3 ./apk-resign.py "$_f" "$ABUILD_KEY" "$(basename "$ABUILD_KEY").pub"
+	python3 ./apk-resign.py "$_f" "$KEYCOPY" "$(basename "$ABUILD_KEY").pub"
 done
+rm -f "$KEYCOPY"
 mkdir -p "$WORKDIR/packages/edge/aarch64"
 mv "$IMSD_DL"/*.apk "$WORKDIR/packages/edge/aarch64/"
 pmbootstrap index