linux/poky.git/meta/lib/oe/gpg_sign.py, branch master-test

lib/oe/gpg_sign.py: Remove unwanted import

2019-09-06T13:58:09+00:00

Remove unwanted import of oe.utils. (From OE-Core rev: 42e9de68384fb24d5c9a5f161810be90c45942d2) Signed-off-by: Vijai Kumar K Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

classes/lib: Remove bb.build.FuncFailed

2019-08-06T10:24:26+00:00

Whilst seemingly a good idea, this exception doesn't really serve any purpose that bb.fatal() doesn't cover. Wrapping exceptions within exceptions isn't pythonic. Its not used in many places, lets clean up those and remove usage of it entirely. It may ultimately be dropped form bitbake entirely. (From OE-Core rev: efe87ce4b2154c6f1c591ed9d8f770c229b044ad) Signed-off-by: Richard Purdie

gpg_sign/selftest: Fix secmem parameter handling

2019-06-07T08:11:49+00:00

We keep seeing "cannot allocate memory" errors from rpm when signing packages on the autobuilder. The following were tried: * checking locked memory use (isn't hitting limits) * Restricting RPM_GPG_SIGN_CHUNK to 1 * Limiting to 10 parallel do_package_write_rpm tasks * Allowing unlimied memory overcommit * Disabling rpm parallel compression and the test still failed. Further invetigation showed that the --auto-expand-secmem wasn't being passed to gpg-agent which meant the secmem couldn't be expanded hence the errors when there was pressure on the agent. The reason this happens is that some of the early gpg commands can start the agent without the option and it sticks around in memory so a version with the correct option may or may not get started. We therefore add the option to all the key gpg calls. (From OE-Core rev: c7e131a76e522503df55e211dd261829feacfa28) Signed-off-by: Richard Purdie

meta/lib+scripts: Convert to SPDX license headers

2019-05-09T15:31:55+00:00

This adds SPDX license headers in place of the wide assortment of things currently in our script headers. We default to GPL-2.0-only except for the oeqa code where it was clearly submitted and marked as MIT on the most part or some scripts which had the "or later" GPL versioning. The patch also drops other obsolete bits of file headers where they were encoountered such as editor modelines, obsolete maintainer information or the phrase "All rights reserved" which is now obsolete and not required in copyright headers (in this case its actually confusing for licensing as all rights were not reserved). More work is needed for OE-Core but this takes care of the bulk of the scripts and meta/lib directories. The top level LICENSE files are tweaked to match the new structure and the SPDX naming. (From OE-Core rev: f8c9c511b5f1b7dbd45b77f345cb6c048ae6763e) Signed-off-by: Richard Purdie

lib/oe/gpg_sign.py: Clean up getstatusoutput usage

2018-08-23T17:02:23+00:00

Replace usage of oe.utils.getstatusoutput() with direct subprocess calls. (From OE-Core rev: 90c730a898f11adb2ecd377cdd913af83123bcb7) Signed-off-by: Robert Yang Signed-off-by: Richard Purdie

gnupg: use native version for signing, rather than one provided by host

2018-01-11T10:26:07+00:00

Using host gpg has been problematic, and particularly this removes the need to serialize package creation, as long as --auto-expand-secmem is passed to gpg-agent, and gnupg >= 2.2.4 is in use (https://dev.gnupg.org/T3530). Sadly, gpg-agent itself is single-threaded, so in the longer run we might want to seek alternatives: https://lwn.net/Articles/742542/ (a smaller issue is that rpm itself runs the gpg fronted in a serial fashion, which slows down the build in cases of recipes with very large amount of packages, e.g. glibc-locale) Note that sstate signing and verification continues to use host gpg, as depending on native gpg would create circular dependencies. [YOCTO #12022] (From OE-Core rev: 08fef6198122fe79d4c1213f9a64b862162ed6cd) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

gpg_sign: depress the owership warnings on homedir

2017-08-24T12:48:10+00:00

A gpg command, e.g, called by get_gpg_version(), may trigger such a warning: gpg: WARNING: unsafe ownership on homedir '/home/user/.gnupg' This sort of warning is harmless so it can be depressed through specifying --no-permission-warning. (From OE-Core rev: 0a740aa6f02deada56e0b7deb2bc1f7401e58726) Signed-off-by: Jia Zhang Signed-off-by: Richard Purdie

sign_rpm: Allow pkg signing by chunks through RPM_GPG_SIGN_CHUNK

2017-08-18T22:46:37+00:00

Commit d58b1d196 moved from chunk to serial signing, but neither of both approaches allowed the user to select the chunks size. This patch allows the user to select a chunk size through RPM_GPG_SIGN_CHUNK defaulting to BB_NUMBER_THREADS, considered a good default. Indirectly, this change reduces the number of processes spawn to number-of-packages/RPM_GPG_SIGN_CHUNK. (From OE-Core rev: f7f78e73f1cd15f4233a231364b14438af758628) Signed-off-by: Leonardo Sandoval Signed-off-by: Richard Purdie

gpg_sign: perform rpm signing serially

2017-08-16T23:21:14+00:00

gpg signing in file batches (which was default to 100) is a memory expensive computation, causing trouble in some host machines (even on production AB as seen on the bugzilla ID). Also, in terms of performance, there is no real gain when rpm signing is done in batches. Considering the latter issues, perform the rpm signing serially. Log showing errors observed recently at AB workers: | gpg: signing failed: Cannot allocate memory | gpg: signing failed: Cannot allocate memory | error: gpg exec failed (2) | /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-oe-selftest/build/build/tmp/work/core2-64-poky-linux/base-passwd/3.5.29-r0/deploy-rpms/core2_64/base-passwd-dev-3.5.29-r0.core2_64.rpm: [YOCTO #11914] (From OE-Core rev: d58b1d196f87128892b7b624bfb725afe01581f1) Signed-off-by: Leonardo Sandoval Signed-off-by: Richard Purdie

sign_rpm: support signing files in RPM payload

2017-07-17T13:01:37+00:00

Currently, RPM4 supports to sign the files in RPM payload with plugin mechanism. We introduce more definitions to make the file signing available for the users: - RPM_FILE_CHECKSUM_DIGEST Global switch to enable file signing. - RPM_FSK_PATH The file signing key. - RPM_FSK_PASSWORD The password of file signing key. - RPM_FILE_CHECKSUM_DIGEST The file checksum digest. (From OE-Core rev: 95b9ee33d5595078e90c633f6155ec9ba3d184f0) Signed-off-by: Lans Zhang Signed-off-by: Ross Burton Signed-off-by: Richard Purdie