From 0b4231b597618e18668b8340f4209cd364b2b2d0 Mon Sep 17 00:00:00 2001 From: Ferry Toth Date: Sun, 3 Apr 2022 21:50:45 +0200 Subject: package_manager: sign DEB package feeds Implement debian package repository signature. For each Release file created in repository subdirectory, a signature Release.gpg is created. Signature is performed using gpg backend when the following variables are set in local.conf: PACKAGE_CLASSES += "sign_package_feed" PACKAGE_FEED_GPG_NAME = "" PACKAGE_FEED_GPG_PASSPHRASE_FILE="" (From OE-Core rev: fcc3cee276999efe6402959eb295e7a0e1e96f96) Signed-off-by: Xavier Berger Signed-off-by: Ferry Toth Signed-off-by: Richard Purdie --- meta/lib/oe/package_manager/deb/__init__.py | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) (limited to 'meta') diff --git a/meta/lib/oe/package_manager/deb/__init__.py b/meta/lib/oe/package_manager/deb/__init__.py index 9f112ae25b..86ddb130ad 100644 --- a/meta/lib/oe/package_manager/deb/__init__.py +++ b/meta/lib/oe/package_manager/deb/__init__.py @@ -53,6 +53,7 @@ class DpkgIndexer(Indexer): index_cmds = [] deb_dirs_found = False + index_sign_files = set() for arch in arch_list: arch_dir = os.path.join(self.deploy_dir, arch) if not os.path.isdir(arch_dir): @@ -62,7 +63,10 @@ class DpkgIndexer(Indexer): cmd += "%s -fcn Packages > Packages.gz;" % gzip - with open(os.path.join(arch_dir, "Release"), "w+") as release: + release_file = os.path.join(arch_dir, "Release") + index_sign_files.add(release_file) + + with open(release_file, "w+") as release: release.write("Label: %s\n" % arch) cmd += "PSEUDO_UNLOAD=1 %s release . >> Release" % apt_ftparchive @@ -76,8 +80,17 @@ class DpkgIndexer(Indexer): return oe.utils.multiprocess_launch(create_index, index_cmds, self.d) - if self.d.getVar('PACKAGE_FEED_SIGN') == '1': - raise NotImplementedError('Package feed signing not implementd for dpkg') + if self.d.getVar('PACKAGE_FEED_SIGN', True) == '1': + signer = get_signer(self.d, self.d.getVar('PACKAGE_FEED_GPG_BACKEND', True)) + else: + signer = None + if signer: + for f in index_sign_files: + signer.detach_sign(f, + self.d.getVar('PACKAGE_FEED_GPG_NAME', True), + self.d.getVar('PACKAGE_FEED_GPG_PASSPHRASE_FILE', True), + output_suffix="gpg", + use_sha256=True) class PMPkgsList(PkgsList): -- cgit v1.2.3-54-g00ecf