linux/poky.git/meta/classes/sign_rpm.bbclass, branch nanbield

classes: Add SPDX license identifiers

2022-08-12T10:58:01+00:00

As stated in our top level license files, the license is MIT unless otherwise stated. Add SPDX identifers accordingly. Replace older license statementa with the standardised syntax. Also drop "All Rights Reserved" expression as it isn't used now, doesn't mean anything and is confusing. (From OE-Core rev: 081a391fe09a21265881e39a2a496e4e10b4f80b) Signed-off-by: Richard Purdie

classes: Add copyright statements to files without one

2022-08-12T10:58:01+00:00

Where there isn't a copyright statement, add one to make it explicit. Also drop editor config lines where they were present. (From OE-Core rev: 880c1ea3edc8edef974e65b2d424fc36809ea034) Signed-off-by: Richard Purdie

sign_rpm.bbclass: ignore thread count

2020-06-17T10:10:28+00:00

Similar to sign_ipk, ignore the number of threads used for signing RPMs. (From OE-Core rev: 77be5fd7df96ebd5a07bfaa3921c074ef8c470c7) Signed-off-by: Daniel McGregor Signed-off-by: Richard Purdie

gnupg: use native version for signing, rather than one provided by host

2018-01-11T10:26:07+00:00

Using host gpg has been problematic, and particularly this removes the need to serialize package creation, as long as --auto-expand-secmem is passed to gpg-agent, and gnupg >= 2.2.4 is in use (https://dev.gnupg.org/T3530). Sadly, gpg-agent itself is single-threaded, so in the longer run we might want to seek alternatives: https://lwn.net/Articles/742542/ (a smaller issue is that rpm itself runs the gpg fronted in a serial fashion, which slows down the build in cases of recipes with very large amount of packages, e.g. glibc-locale) Note that sstate signing and verification continues to use host gpg, as depending on native gpg would create circular dependencies. [YOCTO #12022] (From OE-Core rev: 08fef6198122fe79d4c1213f9a64b862162ed6cd) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

sign_rpm.bbclass: force rpm serial signing

2017-09-26T10:05:01+00:00

Newer versions of gpg (at least 2.1.5 and 2.2.1) have issues when signing occurs in parallel so (unfortunately) the signing must be done serially. Once the upstream problem is fixed, this patch must be reverted, otherwise we loose all the intrinsic parallelism from bitbake. [YOCTO #12022] (From OE-Core rev: 5301712f9735fcf8d3dec756772668de930e53fe) Signed-off-by: Leonardo Sandoval Signed-off-by: Richard Purdie

sign_rpm: Allow pkg signing by chunks through RPM_GPG_SIGN_CHUNK

2017-08-18T22:46:37+00:00

Commit d58b1d196 moved from chunk to serial signing, but neither of both approaches allowed the user to select the chunks size. This patch allows the user to select a chunk size through RPM_GPG_SIGN_CHUNK defaulting to BB_NUMBER_THREADS, considered a good default. Indirectly, this change reduces the number of processes spawn to number-of-packages/RPM_GPG_SIGN_CHUNK. (From OE-Core rev: f7f78e73f1cd15f4233a231364b14438af758628) Signed-off-by: Leonardo Sandoval Signed-off-by: Richard Purdie

sign_rpm: support signing files in RPM payload

2017-07-17T13:01:37+00:00

Currently, RPM4 supports to sign the files in RPM payload with plugin mechanism. We introduce more definitions to make the file signing available for the users: - RPM_FILE_CHECKSUM_DIGEST Global switch to enable file signing. - RPM_FSK_PATH The file signing key. - RPM_FSK_PASSWORD The password of file signing key. - RPM_FILE_CHECKSUM_DIGEST The file checksum digest. (From OE-Core rev: 95b9ee33d5595078e90c633f6155ec9ba3d184f0) Signed-off-by: Lans Zhang Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sign_rpm.bbclass: do not set/use RPM_GPG_PUBKEY

2017-03-23T13:19:49+00:00

This is entirely unnecessary (we can ask the signer backend to export the key to a file when needed), and was causing confusing selftest failures due to the variable being set from two different places. [YOCTO #11191] (From OE-Core rev: 74ea979044368dc28c24325e7e77471b70aa8fe8) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

meta: remove True option to getVar calls

2016-12-16T10:23:23+00:00

getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Search made with the following regex: getVar ?\(( ?[^,()]*), True\) (From OE-Core rev: 7c552996597faaee2fbee185b250c0ee30ea3b5f) Signed-off-by: Joshua Lock Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

gpg_sign.py: get rid of pexpect

2016-03-25T10:29:14+00:00

The python-expect is not installed on the distro such as Ubuntu by default, and we can get rid of it. Use RPM_GPG_PASSPHRASE to replace of RPM_GPG_PASSPHRASE_FILE which is more straightforward. (From OE-Core rev: 4a8a74c62836a20610daf029d4cec0b3087758b2) Signed-off-by: Robert Yang Signed-off-by: Richard Purdie