linux/meta-secure-core.git/meta-integrity/classes, branch thud

sign_rpm_ext.bbclass: fix check_rpm_public_key racing at recipe parsing time

2018-05-31T03:26:13+00:00

All recipe will be parsed which caused lockfile of check_rpm_public_key racing issue. ... |WARNING: meta-secure-core/meta/recipes-core/images/secure-core-image-initramfs.bb: oe-core/bitbake/lib/bb/utils.py:400: ResourceWarning: unclosed file <_io.TextIOWrapper name='tmp-glibc/check_rpm_public_key.lock' mode='a+' encoding='UTF-8'> ... Refer do_package_write_rpm, add check_rpm_public_key to prefunc of do_rootfs, only the running image recipe will invoke check_rpm_public_key. Signed-off-by: Hongxu Jia

sign_rpm_ext.bbclass: check rpm public key at image recipe parsing time

2018-05-23T11:32:55+00:00

While multiple builds share a common sstate, the latter build failed to build image which the public key not found. ... |ERROR: initramfs-ostree-image-1.0-r0 do_rootfs: Importing GPG key failed. Command 'rpmkeys --root=/rootfs --import /rpm-key' returned 1: ... The latter build will not regenerate rpm packages and check_rpm_public_key will not be invoked. Explicitly invoke check_rpm_public_key at image recipe parsing time, which make sure gpg public key be imported. Signed-off-by: Hongxu Jia

sign_rpm_ext: make sure all target recipes are signed

2017-08-24T00:18:01+00:00

Placing the key import logic under signing-keys cannot ensure all target recipes are always signed. Instead, place it before do_package_write_rpm. Signed-off-by: Jia Zhang

sign_rpm_ext: define the location of default gpg keyring to TMPDIR

2017-08-20T07:00:05+00:00

Signed-off-by: Jia Zhang

sign_rpm_ext: fix permission warning

2017-08-20T03:18:24+00:00

Signed-off-by: Jia Zhang

sign_rpm_ext.bbclass: clean up

2017-08-19T13:52:51+00:00

Signed-off-by: Jia Zhang

sign_rpm_ext: Fix the GPG_PATH directory not exist issue (#4)

2017-08-19T07:18:58+00:00

If "GPG_PATH" is set in the init script, then "signing-keys" get_public_keys task will execute failed. So the "GPG_PATH" directory would be created when "GPG_PATH" is set. The do_get_public_keys failed to import gpg key error information is as following: ---------------------------------------------------------------------------------------- ERROR: signing-keys-1.0-r0 do_get_public_keys: Function failed: Failed to import gpg key (layers/meta-secure-core/meta-signing-key/files/rpm_keys/RPM-GPG-PRIVKEY-SecureCore): gpg: fatal: can't create directory `tmp/deploy/images/intel-corei7-64/.gnupg': No such file or directory Signed-off-by: Guojian Zhou

sign_rpm_ext.bbclass: use the default setting from meta-signing-key

2017-08-19T04:54:19+00:00

Signed-off-by: Jia Zhang

sign_rpm_ext: set default GPG_PATH if it is not specified (#2)

2017-08-19T04:44:39+00:00

commit 52bf3b6636f95a(meta-integrity: move gpg keyring initialization to signing-keys) tried to initialize keyring in the task check_public_keys of the recipe signing-keys. However, it does work with the recipe signing-keys only, and GPG_PATH can't be passed to other recipes. We bring the python anonymous function back, and it makes sure GPG_PATH is set before signing the packages for every recipe. Signed-off-by: Yunguo Wei

meta-integrity: move gpg keyring initialization to signing-keys

2017-08-17T15:29:26+00:00

Signed-off-by: Jia Zhang