15217 2023-09-19 10:58:53 +0000 Need to document sstate signing 2026-07-01 06:45:04 +0000 1 1 9 Documentation Reference handbook 0.0.0 x86 Multiple RESOLVED FIXED Medium normal 6.1 M4 1 richard.purdie antonin.godard ccasciato poky.doc.watcher poky.watcher ptsneves randy.macleod --- --- Yes (doc changes required) oldest_to_newest 96516 0 richard.purdie 2023-09-19 10:58:53 +0000 sstate signing is technically supported but not documented. The best pointers I have to how it works are our test case: meta/lib/oeqa/selftest/cases/signing.py:test_signing_sstate_archive Where it appears you'd need to set: SSTATE_SIG_KEY SSTATE_SIG_PASSPHRASE SSTATE_VERIFY_SIG all of which are not documented. 96564 1 ptsneves 2023-09-24 09:27:56 +0000 Sstate cache signature verification is enabled by setting SSTATE_VERIFY_SIG to a boolean true as per bb.utils.to_boolean (which i did not find documented) SSTATE_SIG_KEY = GnuPG key ID (The private key part is necessary for singning, and public part is for verification) SSTATE_SIG_PASSPHRASE = GnuPG passphrase for signing SSTATE_VALID_SIGS: A space separated list with the GPG signature ID that are allowed for signed file verification. If this variable is empty any installed public key will be used to validate the signature (I need to verify if this understanding is correct locally), otherwise only the specified one will be considered. * If SSTATE_SIG_KEY is not set signature files will not be created. * If a signature file already exists, the previous one will be removed. * If SSTATE_SKIP_CREATION is "1" no signing operations will occur. Adapted from the RPM signing documentation: For signed sstate cache feeds, the passphrase should be should be specified in a separate file configuration file like local.conf or calling with `bitbake -R <credentials.conf>`. The signing program used by default is gpg. If GPG is not in the path or a gpg home directory is required the following variables apply GPG_BIN: Specifies a gpg binary/wrapper that is executed when a sstate cache file is signed. GPG_PATH: Specifies the gpg home directory used when the sstate cache file is signed. From my understanding there is currently no support for gpg-agent while signing sstate cache files 96565 2 michael.opdenacker 2023-09-24 10:23:35 +0000 Many thanks Paulo, very helpful! 100009 3 randy.macleod 2024-10-24 15:03:59 +0000 Bulk move of 5.1 M4 to 5.2 M2 as approved by AlexB. 102178 4 antonin.godard 2025-06-06 07:42:30 +0000 Bulk move of bugs I am assigned to from Milestone 5.2M4 to 5.3M1. 106056 5 antonin.godard 2026-07-01 06:45:04 +0000 Now documented with https://git.yoctoproject.org/yocto-docs/commit/?id=f3d78e68f74f2b37d5e7207e01e723ce4dae6441