From 75f5f11b19ba1bf8743caf9ee7c99a3c67f4b266 Mon Sep 17 00:00:00 2001 From: Markus Lehtonen Date: Fri, 21 Aug 2015 17:21:57 +0300 Subject: package_rpm: support signing of rpm packages This patch adds a new bbclass for generating rpm packages that are signed with a user defined key. The packages are signed as part of the "package_write_rpm" task. In order to enable the feature you need to 1. 'INHERIT += " sign_rpm"' in bitbake config (e.g. local or distro) 2. Create a file that contains the passphrase to your gpg secret key 3. 'RPM_GPG_PASSPHRASE_FILE = "" in bitbake config, pointing to the passphrase file created in 2. 4. Define GPG key name to use by either defining 'RPM_GPG_NAME = "" in bitbake config OR by defining %_gpg_name in your ~/.oerpmmacros file 5. 'RPM_GPG_PUBKEY = "" in bitbake config pointing to the public key (in "armor" format) The user may optionally define "GPG_BIN" variable in the bitbake configuration in order to specify a specific gpg binary/wrapper to use. The sign_rpm.bbclass implements a simple scenario of locally signing the packages. It could be replaced by a more advanced class that would utilize a separate signing server for signing the packages, for example. [YOCTO #8134] Signed-off-by: Markus Lehtonen Signed-off-by: Richard Purdie --- meta/classes/package_rpm.bbclass | 5 +++ meta/classes/sign_rpm.bbclass | 75 ++++++++++++++++++++++++++++++++++++++++ meta/lib/oe/package_manager.py | 17 +++++++++ 3 files changed, 97 insertions(+) create mode 100644 meta/classes/sign_rpm.bbclass diff --git a/meta/classes/package_rpm.bbclass b/meta/classes/package_rpm.bbclass index 264438b442..1fa1634d29 100644 --- a/meta/classes/package_rpm.bbclass +++ b/meta/classes/package_rpm.bbclass @@ -697,6 +697,8 @@ python do_package_rpm () { else: d.setVar('PACKAGE_ARCH_EXTEND', package_arch) pkgwritedir = d.expand('${PKGWRITEDIRRPM}/${PACKAGE_ARCH_EXTEND}') + d.setVar('RPM_PKGWRITEDIR', pkgwritedir) + bb.debug(1, 'PKGWRITEDIR: %s' % d.getVar('RPM_PKGWRITEDIR', True)) pkgarch = d.expand('${PACKAGE_ARCH_EXTEND}${HOST_VENDOR}-${HOST_OS}') magicfile = d.expand('${STAGING_DIR_NATIVE}${datadir_native}/misc/magic.mgc') bb.utils.mkdirhier(pkgwritedir) @@ -732,6 +734,9 @@ python do_package_rpm () { d.setVar('BUILDSPEC', cmd + "\n") d.setVarFlag('BUILDSPEC', 'func', '1') bb.build.exec_func('BUILDSPEC', d) + + if d.getVar('RPM_SIGN_PACKAGES', True) == '1': + bb.build.exec_func("sign_rpm", d) } python () { diff --git a/meta/classes/sign_rpm.bbclass b/meta/classes/sign_rpm.bbclass new file mode 100644 index 0000000000..0aa4cd841c --- /dev/null +++ b/meta/classes/sign_rpm.bbclass @@ -0,0 +1,75 @@ +# Class for generating signed RPM packages. +# +# Configuration variables used by this class: +# RPM_GPG_PASSPHRASE_FILE +# Path to a file containing the passphrase of the signing key. +# RPM_GPG_NAME +# Name of the key to sign with. Alternatively you can define +# %_gpg_name macro in your ~/.oerpmmacros file. +# RPM_GPG_PUBKEY +# Path to a file containing the public key (in "armor" format) +# corresponding the signing key. +# GPG_BIN +# Optional variable for specifying the gpg binary/wrapper to use for +# signing. +# +inherit sanity + +RPM_SIGN_PACKAGES='1' + + +_check_gpg_name () { + macrodef=`rpm -E '%_gpg_name'` + [ "$macrodef" == "%_gpg_name" ] && return 1 || return 0 +} + + +def rpmsign_wrapper(d, files, passphrase, gpg_name=None): + import pexpect + + # Find the correct rpm binary + rpm_bin_path = d.getVar('STAGING_BINDIR_NATIVE', True) + '/rpm' + cmd = rpm_bin_path + " --addsign " + if gpg_name: + cmd += "--define '%%_gpg_name %s' " % gpg_name + else: + try: + bb.build.exec_func('_check_gpg_name', d) + except bb.build.FuncFailed: + raise_sanity_error("You need to define RPM_GPG_NAME in bitbake " + "config or the %_gpg_name RPM macro defined " + "(e.g. in ~/.oerpmmacros", d) + if d.getVar('GPG_BIN', True): + cmd += "--define '%%__gpg %s' " % d.getVar('GPG_BIN', True) + cmd += ' '.join(files) + + # Need to use pexpect for feeding the passphrase + proc = pexpect.spawn(cmd) + try: + proc.expect_exact('Enter pass phrase:', timeout=15) + proc.sendline(passphrase) + proc.expect(pexpect.EOF, timeout=900) + proc.close() + except pexpect.TIMEOUT as err: + bb.debug('rpmsign timeout: %s' % err) + proc.terminate() + return proc.exitstatus + + +python sign_rpm () { + import glob + + rpm_gpg_pass_file = (d.getVar("RPM_GPG_PASSPHRASE_FILE", True) or "") + if rpm_gpg_pass_file: + with open(rpm_gpg_pass_file) as fobj: + rpm_gpg_passphrase = fobj.readlines()[0].rstrip('\n') + else: + raise_sanity_error("You need to define RPM_GPG_PASSPHRASE_FILE in the config", d) + + rpm_gpg_name = (d.getVar("RPM_GPG_NAME", True) or "") + + rpms = glob.glob(d.getVar('RPM_PKGWRITEDIR', True) + '/*') + + if rpmsign_wrapper(d, rpms, rpm_gpg_passphrase, rpm_gpg_name) != 0: + raise bb.build.FuncFailed("RPM signing failed") +} diff --git a/meta/lib/oe/package_manager.py b/meta/lib/oe/package_manager.py index f5a22abca7..3632a7af94 100644 --- a/meta/lib/oe/package_manager.py +++ b/meta/lib/oe/package_manager.py @@ -108,6 +108,7 @@ class RpmIndexer(Indexer): archs = archs.union(set(sdk_pkg_archs)) rpm_createrepo = bb.utils.which(os.getenv('PATH'), "createrepo") + index_cmds = [] rpm_dirs_found = False for arch in archs: @@ -127,9 +128,16 @@ class RpmIndexer(Indexer): bb.note("There are no packages in %s" % self.deploy_dir) return + # Create repodata result = oe.utils.multiprocess_exec(index_cmds, create_index) if result: bb.fatal('%s' % ('\n'.join(result))) + # Copy pubkey to repo + distro_version = self.d.getVar('DISTRO_VERSION', True) or "oe.0" + if self.d.getVar('RPM_SIGN_PACKAGES', True) == '1': + shutil.copy2(self.d.getVar('RPM_GPG_PUBKEY', True), + os.path.join(self.deploy_dir, + 'RPM-GPG-KEY-%s' % distro_version)) class OpkgIndexer(Indexer): @@ -352,6 +360,9 @@ class RpmPkgsList(PkgsList): pkg = line.split()[0] arch = line.split()[1] ver = line.split()[2] + # Skip GPG keys + if pkg == 'gpg-pubkey': + continue if self.rpm_version == 4: pkgorigin = "unknown" else: @@ -864,6 +875,12 @@ class RpmPM(PackageManager): except subprocess.CalledProcessError as e: bb.fatal("Create rpm database failed. Command '%s' " "returned %d:\n%s" % (cmd, e.returncode, e.output)) + # Import GPG key to RPM database of the target system + if self.d.getVar('RPM_SIGN_PACKAGES', True) == '1': + pubkey_path = self.d.getVar('RPM_GPG_PUBKEY', True) + cmd = "%s --root %s --dbpath /var/lib/rpm --import %s > /dev/null" % ( + self.rpm_cmd, self.target_rootfs, pubkey_path) + subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True) # Configure smart bb.note("configuring Smart settings") -- cgit 1.2.3-korg