summaryrefslogtreecommitdiffstats
path: root/meta/lib/oe/gpg_sign.py
Commit message (Collapse)AuthorAgeFilesLines
* gpg_sign: depress the owership warnings on homedirJia Zhang2017-08-241-6/+6
| | | | | | | | | | | | | A gpg command, e.g, called by get_gpg_version(), may trigger such a warning: gpg: WARNING: unsafe ownership on homedir '/home/user/.gnupg' This sort of warning is harmless so it can be depressed through specifying --no-permission-warning. (From OE-Core rev: 0a740aa6f02deada56e0b7deb2bc1f7401e58726) Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sign_rpm: Allow pkg signing by chunks through RPM_GPG_SIGN_CHUNKLeonardo Sandoval2017-08-181-4/+4
| | | | | | | | | | | | | Commit d58b1d196 moved from chunk to serial signing, but neither of both approaches allowed the user to select the chunks size. This patch allows the user to select a chunk size through RPM_GPG_SIGN_CHUNK defaulting to BB_NUMBER_THREADS, considered a good default. Indirectly, this change reduces the number of processes spawn to number-of-packages/RPM_GPG_SIGN_CHUNK. (From OE-Core rev: f7f78e73f1cd15f4233a231364b14438af758628) Signed-off-by: Leonardo Sandoval <leonardo.sandoval.gonzalez@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gpg_sign: perform rpm signing seriallyLeonardo Sandoval2017-08-171-3/+3
| | | | | | | | | | | | | | | | | | | | | | gpg signing in file batches (which was default to 100) is a memory expensive computation, causing trouble in some host machines (even on production AB as seen on the bugzilla ID). Also, in terms of performance, there is no real gain when rpm signing is done in batches. Considering the latter issues, perform the rpm signing serially. Log showing errors observed recently at AB workers: | gpg: signing failed: Cannot allocate memory | gpg: signing failed: Cannot allocate memory | error: gpg exec failed (2) | /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-oe-selftest/build/build/tmp/work/core2-64-poky-linux/base-passwd/3.5.29-r0/deploy-rpms/core2_64/base-passwd-dev-3.5.29-r0.core2_64.rpm: [YOCTO #11914] (From OE-Core rev: d58b1d196f87128892b7b624bfb725afe01581f1) Signed-off-by: Leonardo Sandoval <leonardo.sandoval.gonzalez@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sign_rpm: support signing files in RPM payloadLans Zhang2017-07-171-1/+6
| | | | | | | | | | | | | | | | | | | | | Currently, RPM4 supports to sign the files in RPM payload with plugin mechanism. We introduce more definitions to make the file signing available for the users: - RPM_FILE_CHECKSUM_DIGEST Global switch to enable file signing. - RPM_FSK_PATH The file signing key. - RPM_FSK_PASSWORD The password of file signing key. - RPM_FILE_CHECKSUM_DIGEST The file checksum digest. (From OE-Core rev: 95b9ee33d5595078e90c633f6155ec9ba3d184f0) Signed-off-by: Lans Zhang <jia.zhang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gpg_sign.py: fix overwriting the RPM macro __gpg in a wrong wayLans Zhang2017-07-171-1/+1
| | | | | | | | | | The RPM macro used in --define option should not be prefixed by %%. (From OE-Core rev: 2fda41cef26b600d599dfb7f2e61c5829e2b309c) Signed-off-by: Lans Zhang <jia.zhang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gpg_sign.py: fix signing of rpm files using gpgAlexander Kanavin2017-03-141-3/+4
| | | | | | | | | | | | This means a) calling rpmkeys and rpmsign instead of rpm b) instructing gpg to run non-interactively; otherwise on my machine it pops up windows requesting a key passphrase (From OE-Core rev: f82f270df2da59702026721612563aea57cd77eb) Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lib/oe/gpg_sign: fix rpm signing with gpg > 2.1Markus Lehtonen2017-03-011-0/+2
| | | | | | | | | | | | | We need to check the gpg version and alter its command line options accordingly. [YOCTO #11054] (From OE-Core rev: 44a44b7e582a5a654baf21829d168568481c13d9) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lib/oe/gpg_sign: make gpg version a property of the signerMarkus Lehtonen2017-03-011-5/+5
| | | | | | | | (From OE-Core rev: a00a362e3dc18ba04230cbbd6f91264e5d76f40d) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lib/oe/gpg_sign: sign rpm packages in chunks of 100Markus Lehtonen2017-03-011-4/+5
| | | | | | | | | | | | | | | | Split the file list into chunks in order to avoid "OSError: [Errno 7] Argument list too long" This would happend when a package has huge amount of subpackages, e.g. glibc-locale. [YOCTO #11069] (From OE-Core rev: 874f5016fd4dc76bc867b68470297fe59e78a9e6) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: remove True option to getVar callsJoshua Lock2016-12-161-2/+2
| | | | | | | | | | | | | getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Search made with the following regex: getVar ?\(( ?[^,()]*), True\) (From OE-Core rev: 7c552996597faaee2fbee185b250c0ee30ea3b5f) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lib/oe/gpg_sign: fix output in error pathsRoss Burton2016-07-261-3/+2
| | | | | | | | | | oe.utils.getstatusoutput() is a wrapper for subprocess.getstatusoutput() which uses Universal Newlines, so the output is a str() not bytes(). (From OE-Core rev: ce24d4c3632b71939ad198268a900ee823a89b27) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/lib: Update to use python3 command pipeline decodingRichard Purdie2016-06-021-5/+5
| | | | | | | | | | | In python3, strings are unicode by default. We need to encode/decode from command pipelines and other places where we interface with the real world using the correct locales. This patch updates various call sites to use the correct encoding/decodings. (From OE-Core rev: bb4685af1bffe17b3aa92a6d21398f38a44ea874) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gpg_sign.py: get rid of pexpectRobert Yang2016-03-251-18/+6
| | | | | | | | | | | | | The python-expect is not installed on the distro such as Ubuntu by default, and we can get rid of it. Use RPM_GPG_PASSPHRASE to replace of RPM_GPG_PASSPHRASE_FILE which is more straightforward. (From OE-Core rev: 4a8a74c62836a20610daf029d4cec0b3087758b2) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gpg_sign: export_pubkey: add signature type supportIoan-Adrian Ratiu2016-03-111-2/+4
| | | | | | | | | | | Add support for multiple types of signatures (binary or ascii) in export_pubkey(). There is no change in behaviour for the function, the previous implicit default is the new parameter "armor" default. (From OE-Core rev: 95ba4a982b887444908207e3180fe4bc46281d3b) Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gpg_sign: detach_sign: fix gpg > 2.1 STDIN file descriptorIoan-Adrian Ratiu2016-03-111-0/+16
| | | | | | | | | | | | | | | | | | Starting from v2.1 passing passwords directly to gpg does not work anymore [1], instead a loopback interface must be used otherwise gpg >2.1 will error out with: "gpg: signing failed: Inappropriate ioctl for device" gpg <2.1 does not work with the new --pinentry-mode arg and gives an invalid option error, so we detect what is the running version of gpg and pass it accordingly. [1] https://wiki.archlinux.org/index.php/GnuPG#Unattended_passphrase (From OE-Core rev: 0413bd8e294ca8ac972ac68662b43a981952f5ae) Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gpg_sign: add local ipk package signing functionalityIoan-Adrian Ratiu2016-03-111-12/+26
| | | | | | | | | | | | | | | | | | | | Implement ipk signing inside the sign_ipk bbclass using the gpg_sign module and configure signing similar to how rpm does it. sign_ipk uses gpg_sign's detach_sign because its functionality is identical to package feed signing. IPK signing process is a bit different from rpm: - Signatures are stored outside ipk files; opkg connects to a feed server and downloads them to verify a package. - Signatures are of two types (both supported by opkg): binary or ascii armoured. By default we sign using ascii armoured. - Public keys are stored on targets to verify ipks using the opkg-keyrings recipe. (From OE-Core rev: a40f27aa7802e8a0bd87a5417e35adbface62d05) Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oe/gpg_sign: add 'passphrase' argument to detach_sign methodMarkus Lehtonen2016-02-191-10/+20
| | | | | | | | | | | | | This allows directly giving the passphrase, instead of reading from a file. [YOCTO #9006] (From OE-Core rev: fd55c6e86b38b33f62006324e73678a13a534220) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sign_rpm.bbclass: do not store key details in signer instanceMarkus Lehtonen2016-02-191-13/+11
| | | | | | | | | | | | | Refactor the LocalSigner class. Do not store keyid or passphrase file in the signer object as they are only needed for some of the methods. For example, the newly added verify() method does not need any key parameters and export_pubkey only uses keyid. (From OE-Core rev: e2412294b6b1d3a80ee97a0706613349edc51d33) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oe/gpg_sign: add 'armor' argument to detach_sign()Markus Lehtonen2016-02-191-2/+4
| | | | | | | | | | [YOCTO #9006] (From OE-Core rev: ce653694a87fd77d79ec3d28ed3365a2c8e57ad6) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oe/gpg_sign: add verify() methodMarkus Lehtonen2016-02-191-0/+10
| | | | | | | | | | | | A new method for verifying detached signatures. [YOCTO #9006] (From OE-Core rev: 4445c645c71151bd56ff7e133343a6f1e30cc3b3) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oe/gpg_sign: fix incorrect variable nameMarkus Lehtonen2016-02-111-1/+1
| | | | | | | | | | Prevents crash in signing if GPG_PATH is defined. (From OE-Core rev: 0ecd748258abfe5ed9e9e2505aeb42b232389968) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/lib: new module for handling GPG signingMarkus Lehtonen2016-01-261-0/+76
Add a new Python module (oe.gpg_sign) for handling GPG signing operations, i.e. currently package and package feed signing. The purpose is to be able to more easily support various signing backends and to be able to centralise signing functionality into one place (e.g. package signing and sstate signing). Currently, only local signing with gpg is implemented. [YOCTO #8755] (From OE-Core rev: 9b3dc1bd4b8336423a3f8f7db0ab5fa6fa0e7257) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-09 09:17:00 +0000