release: Avoid generating .pkgsave files in OCI images

This also installs the pkg key from the current source tree instead of
using the one currently installed on the host.

Reviewed by:		dch
MFC after:		1 day
Differential Revision:	https://reviews.freebsd.org/D52615

(cherry picked from commit e21e6e96b6)

release/scripts/make-oci-image.sh

@@ -39,10 +39,18 @@ install_packages() {
 	local abi=$1; shift
 	local workdir=$1; shift
 	local rootdir=${workdir}/rootfs
+
+	# Make sure we have the keys needed for verifying package integrity if
+	# not already added by a parent image.
 	if [ ! -d ${rootdir}/usr/share/keys/pkg/trusted ]; then
 		mkdir -p ${rootdir}/usr/share/keys/pkg/trusted
 	fi
-	cp /usr/share/keys/pkg/trusted/* ${rootdir}/usr/share/keys/pkg/trusted
+	for i in ${curdir}/../share/keys/pkg/trusted/pkg.*; do
+		if [ ! -f ${rootdir}/usr/share/keys/pkg/trusted/$(basename $i) ]; then
+			cp $i ${rootdir}/usr/share/keys/pkg/trusted
+		fi
+	done
+
 	# We install the packages and then remove repository metadata (keeping the
 	# metadata for what was installed). This trims more than 40Mb from the
 	# resulting image.

release/tools/oci-image-runtime.conf

@@ -9,6 +9,10 @@ OCI_BASE_IMAGE=dynamic
 
 oci_image_build() {
 	set_cmd ${workdir} /bin/sh
+	# The static image installed termcap.small into /usr/share/misc/termcap
+	# and we are replacing it with the full termcap file. We remove the
+	# small one first to avoid creating a .pkgsave file.
+	rm ${workdir}/rootfs/usr/share/misc/termcap
 	install_packages ${abi} ${workdir} \
 			 FreeBSD-runtime \
 			 FreeBSD-certctl \