summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
diff options
context:
space:
mode:
authoryzhu1 <yanjun.zhu@windriver.com>2015-07-08 11:30:57 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2015-07-09 18:00:19 +0100
commit8b3666ea2dbba3bc9523ff499dc50d52096d1c3e (patch)
tree7549419431901af72d16558158f64f41f0e4ff65 /meta/recipes-devtools
parent925397f6a1ff6dcfbaa32cb4540ba2d5681998f4 (diff)
downloadpoky-8b3666ea2dbba3bc9523ff499dc50d52096d1c3e.tar.gz
rpm: disable external key server
When RPM experiences a signed package, with a signature that it does NOT know. By default it will send the -fingerprint- (and only the 16 digit fingerprint) to an external HKP server, trying to get the key down. This is probably not a reasonable default behavior for the system to do, instead it should simply fail the key lookup. If someone wants to enable the HKP server it's easy enough to do by enabling the necessary macros. (From OE-Core rev: fdaa9115fb20d4af49ce8407b5785096c66ecf6c) Signed-off-by: yzhu1 <yanjun.zhu@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools')
-rw-r--r--meta/recipes-devtools/rpm/rpm/rpm-macros.in-disable-external-key-server.patch27
-rw-r--r--meta/recipes-devtools/rpm/rpm_5.4.14.bb1
2 files changed, 28 insertions, 0 deletions
diff --git a/meta/recipes-devtools/rpm/rpm/rpm-macros.in-disable-external-key-server.patch b/meta/recipes-devtools/rpm/rpm/rpm-macros.in-disable-external-key-server.patch
new file mode 100644
index 0000000000..07a0cfa300
--- /dev/null
+++ b/meta/recipes-devtools/rpm/rpm/rpm-macros.in-disable-external-key-server.patch
@@ -0,0 +1,27 @@
1disable external key server
2
3Upstream-Status: Pending
4
5When RPM experiences a signed package, with a signature that it does NOT know.
6By default it will send the -fingerprint- (and only the 16 digit fingerprint) to
7an external HKP server, trying to get the key down.
8
9This is probably not a reasonable default behavior for the system to do, instead
10it should simply fail the key lookup. If someone wants to enable the HKP server
11it's easy enough to do by enabling the necessary macros.
12
13Signed-off-by: yzhu1 <yanjun.zhu@windriver.com>
14Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
15--- a/macros/macros.in
16+++ b/macros/macros.in
17@@ -546,8 +546,8 @@ $_arbitrary_tags_tests Foo:Bar
18 # Horowitz Key Protocol server configuration
19 #
20 #%_hkp_keyserver hkp://keys.n3npq.net
21-%_hkp_keyserver hkp://pool.sks-keyservers.net
22-%_hkp_keyserver_query %{_hkp_keyserver}/pks/lookup?op=get&search=
23+#%_hkp_keyserver hkp://pool.sks-keyservers.net
24+#%_hkp_keyserver_query %{_hkp_keyserver}/pks/lookup?op=get&search=
25
26
27 %_nssdb_path /etc/pki/nssdb
diff --git a/meta/recipes-devtools/rpm/rpm_5.4.14.bb b/meta/recipes-devtools/rpm/rpm_5.4.14.bb
index 2e17a91137..bff0687e6c 100644
--- a/meta/recipes-devtools/rpm/rpm_5.4.14.bb
+++ b/meta/recipes-devtools/rpm/rpm_5.4.14.bb
@@ -94,6 +94,7 @@ SRC_URI = "http://www.rpm5.org/files/rpm/rpm-5.4/rpm-5.4.14-0.20131024.src.rpm;e
94 file://no-ldflags-in-pkgconfig.patch \ 94 file://no-ldflags-in-pkgconfig.patch \
95 file://rpm-lua-fix-print.patch \ 95 file://rpm-lua-fix-print.patch \
96 file://rpm-check-rootpath-reasonableness.patch \ 96 file://rpm-check-rootpath-reasonableness.patch \
97 file://rpm-macros.in-disable-external-key-server.patch \
97 " 98 "
98 99
99# Uncomment the following line to enable platform score debugging 100# Uncomment the following line to enable platform score debugging