diff options
author | Lans Zhang <jia.zhang@windriver.com> | 2017-07-11 12:43:03 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2017-07-17 14:01:37 +0100 |
commit | 30ba8b6894fc332651eba1f2451eb5aba23a7251 (patch) | |
tree | f4d911b60d6b29f17975c1494f8d1754697c58ee /meta/lib/oe | |
parent | 946a3dae158ed4709915645ba06dc9bab159be34 (diff) | |
download | poky-30ba8b6894fc332651eba1f2451eb5aba23a7251.tar.gz |
sign_rpm: support signing files in RPM payload
Currently, RPM4 supports to sign the files in RPM payload with plugin
mechanism. We introduce more definitions to make the file signing
available for the users:
- RPM_FILE_CHECKSUM_DIGEST
Global switch to enable file signing.
- RPM_FSK_PATH
The file signing key.
- RPM_FSK_PASSWORD
The password of file signing key.
- RPM_FILE_CHECKSUM_DIGEST
The file checksum digest.
(From OE-Core rev: 95b9ee33d5595078e90c633f6155ec9ba3d184f0)
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/lib/oe')
-rw-r--r-- | meta/lib/oe/gpg_sign.py | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/meta/lib/oe/gpg_sign.py b/meta/lib/oe/gpg_sign.py index c53df54a5b..f4d8b10e4b 100644 --- a/meta/lib/oe/gpg_sign.py +++ b/meta/lib/oe/gpg_sign.py | |||
@@ -27,7 +27,7 @@ class LocalSigner(object): | |||
27 | raise bb.build.FuncFailed('Failed to export gpg public key (%s): %s' % | 27 | raise bb.build.FuncFailed('Failed to export gpg public key (%s): %s' % |
28 | (keyid, output)) | 28 | (keyid, output)) |
29 | 29 | ||
30 | def sign_rpms(self, files, keyid, passphrase): | 30 | def sign_rpms(self, files, keyid, passphrase, digest, fsk=None, fsk_password=None): |
31 | """Sign RPM files""" | 31 | """Sign RPM files""" |
32 | 32 | ||
33 | cmd = self.rpm_bin + " --addsign --define '_gpg_name %s' " % keyid | 33 | cmd = self.rpm_bin + " --addsign --define '_gpg_name %s' " % keyid |
@@ -35,10 +35,15 @@ class LocalSigner(object): | |||
35 | if self.gpg_version > (2,1,): | 35 | if self.gpg_version > (2,1,): |
36 | gpg_args += ' --pinentry-mode=loopback' | 36 | gpg_args += ' --pinentry-mode=loopback' |
37 | cmd += "--define '_gpg_sign_cmd_extra_args %s' " % gpg_args | 37 | cmd += "--define '_gpg_sign_cmd_extra_args %s' " % gpg_args |
38 | cmd += "--define '_binary_filedigest_algorithm %s' " % digest | ||
38 | if self.gpg_bin: | 39 | if self.gpg_bin: |
39 | cmd += "--define '__gpg %s' " % self.gpg_bin | 40 | cmd += "--define '__gpg %s' " % self.gpg_bin |
40 | if self.gpg_path: | 41 | if self.gpg_path: |
41 | cmd += "--define '_gpg_path %s' " % self.gpg_path | 42 | cmd += "--define '_gpg_path %s' " % self.gpg_path |
43 | if fsk: | ||
44 | cmd += "--signfiles --fskpath %s " % fsk | ||
45 | if fsk_password: | ||
46 | cmd += "--define '_file_signing_key_password %s' " % fsk_password | ||
42 | 47 | ||
43 | # Sign in chunks of 100 packages | 48 | # Sign in chunks of 100 packages |
44 | for i in range(0, len(files), 100): | 49 | for i in range(0, len(files), 100): |