summaryrefslogtreecommitdiffstats
path: root/meta/lib/oe/gpg_sign.py
AgeCommit message (Collapse)Author
2023-03-31lib/oe/gpg_sign.py: Avoid race when creating .sig files in detach_signTobias Hagelborn
Move the signature file into place only after it is successfully signed. This to avoid race and corrupted .sig files in cases multiple onging builds write to a shared sstate-cache dir. Signed-off-by: Tobias Hagelborn <tobiasha@axis.com> Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-12lib: Add copyright statements to files without oneRichard Purdie
Where there isn't a copyright statement, add one to make it explicit. Also add license identifiers as MIT if there isn't one. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-05gpg-sign: Add parameters to gpg signature functionXavier Berger
output_suffix: If defined, add output_suffix as file name extension. use_sha256: If True, use sha256 for gpg as digest algorithm Signed-off-by: Xavier Berger <xavier.berger@bio-logic.net> Signed-off-by: Ferry Toth <ftoth@exalondelft.nl> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-14sstate: Allow validation of sstate singatures against list of keysDaniel McGregor
Allow a user to validate sstate objects against a list of keys, instead of just any known key in the user's keychain. Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-05-21lib/oe/gpg_sign.py: Fix gpg verificationDaniel McGregor
A stray space made it into the command for verifying gpg signatures. This caused verification to fail, at least on my host. Removing the space makes it work as expected. Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-06lib/oe/gpg_sign.py: Remove unwanted importVijai Kumar K
Remove unwanted import of oe.utils. Signed-off-by: Vijai Kumar K <Vijaikumar_Kanagarajan@mentor.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-08-03classes/lib: Remove bb.build.FuncFailedRichard Purdie
Whilst seemingly a good idea, this exception doesn't really serve any purpose that bb.fatal() doesn't cover. Wrapping exceptions within exceptions isn't pythonic. Its not used in many places, lets clean up those and remove usage of it entirely. It may ultimately be dropped form bitbake entirely. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-06-07gpg_sign/selftest: Fix secmem parameter handlingRichard Purdie
We keep seeing "cannot allocate memory" errors from rpm when signing packages on the autobuilder. The following were tried: * checking locked memory use (isn't hitting limits) * Restricting RPM_GPG_SIGN_CHUNK to 1 * Limiting to 10 parallel do_package_write_rpm tasks * Allowing unlimied memory overcommit * Disabling rpm parallel compression and the test still failed. Further invetigation showed that the --auto-expand-secmem wasn't being passed to gpg-agent which meant the secmem couldn't be expanded hence the errors when there was pressure on the agent. The reason this happens is that some of the early gpg commands can start the agent without the option and it sticks around in memory so a version with the correct option may or may not get started. We therefore add the option to all the key gpg calls. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-09meta/lib+scripts: Convert to SPDX license headersRichard Purdie
This adds SPDX license headers in place of the wide assortment of things currently in our script headers. We default to GPL-2.0-only except for the oeqa code where it was clearly submitted and marked as MIT on the most part or some scripts which had the "or later" GPL versioning. The patch also drops other obsolete bits of file headers where they were encoountered such as editor modelines, obsolete maintainer information or the phrase "All rights reserved" which is now obsolete and not required in copyright headers (in this case its actually confusing for licensing as all rights were not reserved). More work is needed for OE-Core but this takes care of the bulk of the scripts and meta/lib directories. The top level LICENSE files are tweaked to match the new structure and the SPDX naming. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23lib/oe/gpg_sign.py: Clean up getstatusoutput usageRobert Yang
Replace usage of oe.utils.getstatusoutput() with direct subprocess calls. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-01-10gnupg: use native version for signing, rather than one provided by hostAlexander Kanavin
Using host gpg has been problematic, and particularly this removes the need to serialize package creation, as long as --auto-expand-secmem is passed to gpg-agent, and gnupg >= 2.2.4 is in use (https://dev.gnupg.org/T3530). Sadly, gpg-agent itself is single-threaded, so in the longer run we might want to seek alternatives: https://lwn.net/Articles/742542/ (a smaller issue is that rpm itself runs the gpg fronted in a serial fashion, which slows down the build in cases of recipes with very large amount of packages, e.g. glibc-locale) Note that sstate signing and verification continues to use host gpg, as depending on native gpg would create circular dependencies. [YOCTO #12022] Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-24gpg_sign: depress the owership warnings on homedirJia Zhang
A gpg command, e.g, called by get_gpg_version(), may trigger such a warning: gpg: WARNING: unsafe ownership on homedir '/home/user/.gnupg' This sort of warning is harmless so it can be depressed through specifying --no-permission-warning. Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18sign_rpm: Allow pkg signing by chunks through RPM_GPG_SIGN_CHUNKLeonardo Sandoval
Commit d58b1d196 moved from chunk to serial signing, but neither of both approaches allowed the user to select the chunks size. This patch allows the user to select a chunk size through RPM_GPG_SIGN_CHUNK defaulting to BB_NUMBER_THREADS, considered a good default. Indirectly, this change reduces the number of processes spawn to number-of-packages/RPM_GPG_SIGN_CHUNK. Signed-off-by: Leonardo Sandoval <leonardo.sandoval.gonzalez@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-16gpg_sign: perform rpm signing seriallyLeonardo Sandoval
gpg signing in file batches (which was default to 100) is a memory expensive computation, causing trouble in some host machines (even on production AB as seen on the bugzilla ID). Also, in terms of performance, there is no real gain when rpm signing is done in batches. Considering the latter issues, perform the rpm signing serially. Log showing errors observed recently at AB workers: | gpg: signing failed: Cannot allocate memory | gpg: signing failed: Cannot allocate memory | error: gpg exec failed (2) | /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-oe-selftest/build/build/tmp/work/core2-64-poky-linux/base-passwd/3.5.29-r0/deploy-rpms/core2_64/base-passwd-dev-3.5.29-r0.core2_64.rpm: [YOCTO #11914] Signed-off-by: Leonardo Sandoval <leonardo.sandoval.gonzalez@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-07-17sign_rpm: support signing files in RPM payloadLans Zhang
Currently, RPM4 supports to sign the files in RPM payload with plugin mechanism. We introduce more definitions to make the file signing available for the users: - RPM_FILE_CHECKSUM_DIGEST Global switch to enable file signing. - RPM_FSK_PATH The file signing key. - RPM_FSK_PASSWORD The password of file signing key. - RPM_FILE_CHECKSUM_DIGEST The file checksum digest. Signed-off-by: Lans Zhang <jia.zhang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-07-17gpg_sign.py: fix overwriting the RPM macro __gpg in a wrong wayLans Zhang
The RPM macro used in --define option should not be prefixed by %%. Signed-off-by: Lans Zhang <jia.zhang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-13gpg_sign.py: fix signing of rpm files using gpgAlexander Kanavin
This means a) calling rpmkeys and rpmsign instead of rpm b) instructing gpg to run non-interactively; otherwise on my machine it pops up windows requesting a key passphrase Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
2017-03-01lib/oe/gpg_sign: fix rpm signing with gpg > 2.1Markus Lehtonen
We need to check the gpg version and alter its command line options accordingly. [YOCTO #11054] Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01lib/oe/gpg_sign: make gpg version a property of the signerMarkus Lehtonen
Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01lib/oe/gpg_sign: sign rpm packages in chunks of 100Markus Lehtonen
Split the file list into chunks in order to avoid "OSError: [Errno 7] Argument list too long" This would happend when a package has huge amount of subpackages, e.g. glibc-locale. [YOCTO #11069] Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-12-16meta: remove True option to getVar callsJoshua Lock
getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Search made with the following regex: getVar ?\(( ?[^,()]*), True\) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-07-25lib/oe/gpg_sign: fix output in error pathsRoss Burton
oe.utils.getstatusoutput() is a wrapper for subprocess.getstatusoutput() which uses Universal Newlines, so the output is a str() not bytes(). Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-02classes/lib: Update to use python3 command pipeline decodingRichard Purdie
In python3, strings are unicode by default. We need to encode/decode from command pipelines and other places where we interface with the real world using the correct locales. This patch updates various call sites to use the correct encoding/decodings. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-23gpg_sign.py: get rid of pexpectRobert Yang
The python-expect is not installed on the distro such as Ubuntu by default, and we can get rid of it. Use RPM_GPG_PASSPHRASE to replace of RPM_GPG_PASSPHRASE_FILE which is more straightforward. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-11gpg_sign: export_pubkey: add signature type supportIoan-Adrian Ratiu
Add support for multiple types of signatures (binary or ascii) in export_pubkey(). There is no change in behaviour for the function, the previous implicit default is the new parameter "armor" default. Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-11gpg_sign: detach_sign: fix gpg > 2.1 STDIN file descriptorIoan-Adrian Ratiu
Starting from v2.1 passing passwords directly to gpg does not work anymore [1], instead a loopback interface must be used otherwise gpg >2.1 will error out with: "gpg: signing failed: Inappropriate ioctl for device" gpg <2.1 does not work with the new --pinentry-mode arg and gives an invalid option error, so we detect what is the running version of gpg and pass it accordingly. [1] https://wiki.archlinux.org/index.php/GnuPG#Unattended_passphrase Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-11gpg_sign: add local ipk package signing functionalityIoan-Adrian Ratiu
Implement ipk signing inside the sign_ipk bbclass using the gpg_sign module and configure signing similar to how rpm does it. sign_ipk uses gpg_sign's detach_sign because its functionality is identical to package feed signing. IPK signing process is a bit different from rpm: - Signatures are stored outside ipk files; opkg connects to a feed server and downloads them to verify a package. - Signatures are of two types (both supported by opkg): binary or ascii armoured. By default we sign using ascii armoured. - Public keys are stored on targets to verify ipks using the opkg-keyrings recipe. Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-18oe/gpg_sign: add 'passphrase' argument to detach_sign methodMarkus Lehtonen
This allows directly giving the passphrase, instead of reading from a file. [YOCTO #9006] Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-18sign_rpm.bbclass: do not store key details in signer instanceMarkus Lehtonen
Refactor the LocalSigner class. Do not store keyid or passphrase file in the signer object as they are only needed for some of the methods. For example, the newly added verify() method does not need any key parameters and export_pubkey only uses keyid. Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-18oe/gpg_sign: add 'armor' argument to detach_sign()Markus Lehtonen
[YOCTO #9006] Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-18oe/gpg_sign: add verify() methodMarkus Lehtonen
A new method for verifying detached signatures. [YOCTO #9006] Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-11oe/gpg_sign: fix incorrect variable nameMarkus Lehtonen
Prevents crash in signing if GPG_PATH is defined. Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-26meta/lib: new module for handling GPG signingMarkus Lehtonen
Add a new Python module (oe.gpg_sign) for handling GPG signing operations, i.e. currently package and package feed signing. The purpose is to be able to more easily support various signing backends and to be able to centralise signing functionality into one place (e.g. package signing and sstate signing). Currently, only local signing with gpg is implemented. [YOCTO #8755] Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-28 14:47:17 +0000