8134 2015-08-10 14:12:09 +0000 Signing packages in the package feeds 2015-10-16 15:19:50 +0000 1 1 7 Build System, Metadata & Runtime OE-Core devtools / tool chain 1.9 x86 Multiple VERIFIED FIXED High enhancement 1.9 M3 1 alexander.kanevskiy markus.lehtonen bogdanx.a.voiculescu cathy.shen daniel.alexandrux.istrate meta.mr.watcher meta.watcher richard.purdie bogdanx.a.voiculescu --- --- Yes (doc changes required) oldest_to_newest 52945 0 alexander.kanevskiy 2015-08-10 14:12:09 +0000 There is a need on signing packages produced as part of the build in the package feeds, wherever package format supports that (e.g. RPM). This would allow users to verify authenticity of packages received from those feeds. Signing can be done either during build process or during/before package index update. Actual implementation we would need to discuss, based that different package formats have different limitations on signatures. 53058 1 richard.purdie 2015-08-12 21:11:12 +0000 Which packaging format are you primarily using? rpm v5 and smart? 53070 2 alexander.kanevskiy 2015-08-13 09:01:07 +0000 Yes, at the moment it's rpm5 and smart on device. 53226 3 markus.lehtonen 2015-08-19 14:37:37 +0000 Which of the following do you think would be more feasible to do: A. Extend the existing package_rpm bbclass. Signing would possibly be enabled by defining a proper variable in conf(?) B.Write a new bbclass for doing the package signing. Signing would be enabled by inheriting the new class e.g. in distro conf. I'm inclined to think that the second option would be better. 53329 4 2673 markus.lehtonen 2015-08-21 14:41:43 +0000 Created attachment 2673 POC patch for signing rpm packages 53331 5 markus.lehtonen 2015-08-21 14:44:44 +0000 I wrote a patch for generating signed RPM. Does it make any sense to you? This currently only supports signing in the local builder. Problematic part is of course the passphrase which must be stored in a file in the local filesystem. Also, what is lacking is the integration with smart and image generation. 53684 6 markus.lehtonen 2015-09-03 13:30:11 +0000 Merged to master: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=752736ae9f9c8842018e45cff2f5b1d770557d86 http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=59c7c7bfcb2cf3682526656fd9eba61a022e5a0a 53951 7 bogdanx.a.voiculescu 2015-09-11 06:34:52 +0000 ERROR: Function failed: RPM signing failed ERROR: Task 670 (/home/bvoiculescu/yocto/poky/meta/recipes-core/glibc/glibc-locale_2.22.bb, do_package_write_rpm) failed with exit code '1' NOTE: Tasks Summary: Attempted 654 tasks of which 649 didn't need to be rerun and 4 failed. Waiting for 0 running tasks to finish:... My setup is: 1) in bitbake.conf INHERIT += "sign_rpm" RPM_GPG_PASSPHRASE_FILE = "/home/bvoiculescu/.gnupg/secret.txt" RPM_GPG_NAME = "Bogdan-Alexandru Voiculescu <bogdanx.a.voiculescu@intel.com>" 2) cat /home/bvoiculescu/.gnupg/secret.txt parola 3) rpmsign is working: ~/yocto/poky$ rpmsign --addsign /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/db/6.0.30-r0/deploy-rpms/i586/db-6.0.30-r0.i586.rpm Enter pass phrase: Pass phrase is good. /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/db/6.0.30-r0/deploy-rpms/i586/db-6.0.30-r0.i586.rpm: 53963 8 markus.lehtonen 2015-09-11 10:33:47 +0000 (In reply to comment #7) > ERROR: Function failed: RPM signing failed > ERROR: Task 670 > (/home/bvoiculescu/yocto/poky/meta/recipes-core/glibc/glibc-locale_2.22.bb, > do_package_write_rpm) failed with exit code '1' > NOTE: Tasks Summary: Attempted 654 tasks of which 649 didn't need to be > rerun and 4 failed. > Waiting for 0 running tasks to finish:... What is it that actually fails there? Does ${WORKDIR}/temp/log.do_package_write_rpm give any more insight? > My setup is: > 1) in bitbake.conf > > INHERIT += "sign_rpm" > RPM_GPG_PASSPHRASE_FILE = "/home/bvoiculescu/.gnupg/secret.txt" > RPM_GPG_NAME = "Bogdan-Alexandru Voiculescu <bogdanx.a.voiculescu@intel.com>" The configuration looks good to me > 2) > cat /home/bvoiculescu/.gnupg/secret.txt > parola Looks good, too. The file should only contain one line which is the passphrase. > 3) > rpmsign is working: > ~/yocto/poky$ rpmsign --addsign > /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/db/6.0.30-r0/ > deploy-rpms/i586/db-6.0.30-r0.i586.rpm > Enter pass phrase: > Pass phrase is good. > /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/db/6.0.30-r0/ > deploy-rpms/i586/db-6.0.30-r0.i586.rpm: 53964 9 bogdanx.a.voiculescu 2015-09-11 10:39:20 +0000 nope: bvoiculescu@vhangan-PC:~$ cat /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/linux-libc-headers/4.1-r0/temp/log.do_package_write_rpm.11256 DEBUG: Executing python function sstate_task_prefunc DEBUG: Removing manifest: /home/bvoiculescu/yocto/poky/build/tmp/deploy/rpm/i586/linux-libc-headers-dbg-4.1-r0.i586.rpm DEBUG: Removing manifest: /home/bvoiculescu/yocto/poky/build/tmp/deploy/rpm/i586/linux-libc-headers-dev-4.1-r0.i586.rpm DEBUG: Removing manifest: /home/bvoiculescu/yocto/poky/build/tmp/deploy/rpm/i586/ DEBUG: Python function sstate_task_prefunc finished DEBUG: Executing python function do_package_write_rpm DEBUG: Executing python function read_subpackage_metadata DEBUG: Python function read_subpackage_metadata finished DEBUG: Executing python function do_package_rpm DEBUG: Executing python function write_specfile NOTE: Creating EMPTY RPM Package for linux-libc-headers-dbg NOTE: Not creating empty RPM package for linux-libc-headers-staticdev NOTE: Creating RPM package for linux-libc-headers-dev NOTE: Not creating empty RPM package for linux-libc-headers-doc NOTE: Not creating empty RPM package for linux-libc-headers-locale NOTE: Not creating empty RPM package for linux-libc-headers DEBUG: Python function write_specfile finished DEBUG: PKGWRITEDIR: /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/linux-libc-headers/4.1-r0/deploy-rpms/i586 DEBUG: Executing shell function BUILDSPEC Building target platforms: i586-poky-linux Processing files: linux-libc-headers-dbg-4.1-r0.i586 Processing files: linux-libc-headers-dev-4.1-r0.i586 Checking for unpackaged file(s): /home/bvoiculescu/yocto/poky/build/tmp/sysroots/x86_64-linux/usr/bin/../lib/rpm/check-files /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/linux-libc-headers/4.1-r0/package Wrote: /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/linux-libc-headers/4.1-r0/deploy-rpms/i586/linux-libc-headers-dbg-4.1-r0.i586.rpm Wrote: /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/linux-libc-headers/4.1-r0/deploy-rpms/i586/linux-libc-headers-dev-4.1-r0.i586.rpm DEBUG: Shell function BUILDSPEC finished DEBUG: Executing python function sign_rpm DEBUG: Python function sign_rpm finished DEBUG: Python function do_package_rpm finished DEBUG: Python function do_package_write_rpm finished ERROR: Function failed: RPM signing failed 54217 10 markus.lehtonen 2015-09-17 15:18:38 +0000 Marking this as resolved, again. The problem above was caused by missing 'gpg2' binary on Ubuntu systems (they only have 'gpg'). The problem can be circumvented by defining GPG_BIN in bitbake configuration or defining the %__gpg macro in ~/.oerpmmacros file. These settings are not required when/if this patch gets merged: http://lists.openembedded.org/pipermail/openembedded-core/2015-September/110475.html 54249 11 bogdanx.a.voiculescu 2015-09-18 07:35:25 +0000 confirmed implementation is done and rpm sign is working. 55139 12 cathy.shen 2015-10-10 09:55:55 +0000 We trying to verify this in my project, but didn't get successful result, pls. help to check if the test steps are correct: My steps: 1. gpg --gen-key 2. add my passwd to ~/.gnupg/secret.txt 3. edit .rpmmacros , add these contents: %_signature gpg %_gpgbin /usr/bin/gpg %_gpg_name myname (test) <myname@corparation.com> %_gpg_path /home/dir/.gnupg 4. git clone [my project] 5. source oe-init-build-env 6. edit conf/local.conf, add these contents(please note that if didn't add RPM_GPG_PUBKEY, bitbake will return an error):\ INHERIT += "sign_rpm" RPM_GPG_PASSPHRASE_FILE = "/home/dir/.gnupg/secret.txt" RPM_GPG_NAME = "myname" RPM_GPG_PUBKEY = "/home/dir/.gnupg/pubring.gpg" 7. bitbake my-project-image 8. rpm --checksig mraa-test-1.0.0-r0.i586_nlp_32.rpm mraa-test-1.0.0-r0.i586_nlp_32.rpm: RSA sha1 md5 NOT OK 9. rpm --resign mraa-test-1.0.0-r0.i586_nlp_32.rpm Enter pass phrase: Pass phrase is good. mraa-test-1.0.0-r0.i586_nlp_32.rpm: warning: mraa-test-1.0.0-r0.i586_nlp_32.rpm already contains identical signature, skipping It seems that signature has added already, but couldn't verify this key. BTW, I tried to add sign manually, when I checksign, it will have these results: mraa-test-1.0.0-r0.i586_nlp_32.rpm: RSA sha1 ((MD5) PGP) md5 NOT OK (MISSING KEYS: (MD5) PGP#2b1be55e) Pls. give my some hints about the test steps. Thanks! 55155 13 markus.lehtonen 2015-10-12 07:28:01 +0000 First of all, RPM_GPG_PUBKEY must point to the public key, not the pub keyring. I.e. $ gpg --export --armor "myname (test) <myname@corparation.com>" > key.pub and then make RPM_GPG_PUBKEY point to that file. Worksforme. What host os do you use? It might be some incompatibility with the rpm versions of host and target systems. Try using the rpm from sysroot instead: $ tmp-glibc/sysroots/x86_64-linux/usr/bin/rpm --import key.pug $ tmp-glibc/sysroots/x86_64-linux/usr/bin/rpm --checksig mraa-test-1.0.0-r0.i586_nlp_32.rpm 55399 14 daniel.alexandrux.istrate 2015-10-16 15:19:50 +0000 Added oe-selftest for this feature: http://lists.openembedded.org/pipermail/openembedded-core/2015-October/111648.html 2673 2015-08-21 14:41:43 +0000 2015-08-21 14:41:43 +0000 POC patch for signing rpm packages 0001-package_rpm-WIP-support-signing-of-rpm-packages.patch text/plain 4034 markus.lehtonen RnJvbSBmMWU0N2IwM2RhNmQ1MTAwZGFiNmI5ZmI2ZThkZTE0Y2EzOTVhNzg3IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBNYXJrdXMgTGVodG9uZW4gPG1hcmt1cy5sZWh0b25lbkBsaW51 eC5pbnRlbC5jb20+CkRhdGU6IEZyaSwgMjEgQXVnIDIwMTUgMTc6MjE6NTcgKzAzMDAKU3ViamVj dDogW1BBVENIXSBwYWNrYWdlX3JwbTogV0lQOiBzdXBwb3J0IHNpZ25pbmcgb2YgcnBtIHBhY2th Z2VzCgpUaGlzIHBhdGNoIGFkZHMgYSBuZXcgYmJjbGFzcyBmb3IgZ2VuZXJhdGluZyBzaWduZWQg cnBtIHBhY2thZ2VzLgoKSW4gb3JkZXIgdG8gZW5hYmxlIHRoZSBmZWF0dXJlIHlvdSBuZWVkIHRv CjEuICdJTkhFUklUICs9ICIgc2lnbl9ycG0iJyBpbiBiaXRiYWtlIGNvbmZpZyAoZS5nLiBsb2Nh bCBvcgogICBkaXN0cm8pCjIuIENyZWF0ZSBhIGZpbGUgdGhhdCBjb250YWlucyB0aGUgcGFzc3Bo cmFzZSB0byB5b3VyIGdwZyBzZWNyZXQga2V5CjMuICdSUE1fR1BHX1BBU1NQSFJBU0VfRklMRSA9 ICI8cGF0aF90b19maWxlPiIgaW4gYml0YmFrZSBjb25maWcsCiAgIHBvaW50aW5nIHRvIHRoZSBw YXNzcGhyYXNlIGZpbGUgY3JlYXRlZCBpbiAyLgo0LiBEZWZpbmUgR1BHIGtleSBuYW1lIHRvIHVz ZSBieSBlaXRoZXIgZGVmaW5pbmcKICAgJ1JQTV9HUEdfTkFNRSA9ICI8a2V5X2lkPiIgaW4gYml0 YmFrZSBjb25maWcgT1IgYnkgZGVmaW5pbmcKICAgJV9ncGdfbmFtZSA8a2V5X2lkPiBpbiB5b3Vy IH4vLm9lcnBtbWFjcm9zIGZpbGUKClNpZ25lZC1vZmYtYnk6IE1hcmt1cyBMZWh0b25lbiA8bWFy a3VzLmxlaHRvbmVuQGxpbnV4LmludGVsLmNvbT4KLS0tCiBtZXRhL2NsYXNzZXMvcGFja2FnZV9y cG0uYmJjbGFzcyB8ICA1ICsrKysKIG1ldGEvY2xhc3Nlcy9zaWduX3JwbS5iYmNsYXNzICAgIHwg NTggKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKwogMiBmaWxlcyBjaGFu Z2VkLCA2MyBpbnNlcnRpb25zKCspCiBjcmVhdGUgbW9kZSAxMDA2NDQgbWV0YS9jbGFzc2VzL3Np Z25fcnBtLmJiY2xhc3MKCmRpZmYgLS1naXQgYS9tZXRhL2NsYXNzZXMvcGFja2FnZV9ycG0uYmJj bGFzcyBiL21ldGEvY2xhc3Nlcy9wYWNrYWdlX3JwbS5iYmNsYXNzCmluZGV4IDI3MWI5YWUuLmI4 OWYzMDkgMTAwNjQ0Ci0tLSBhL21ldGEvY2xhc3Nlcy9wYWNrYWdlX3JwbS5iYmNsYXNzCisrKyBi L21ldGEvY2xhc3Nlcy9wYWNrYWdlX3JwbS5iYmNsYXNzCkBAIC02OTIsNiArNjkyLDggQEAgcHl0 aG9uIGRvX3BhY2thZ2VfcnBtICgpIHsKICAgICBlbHNlOgogICAgICAgICBkLnNldFZhcignUEFD S0FHRV9BUkNIX0VYVEVORCcsIHBhY2thZ2VfYXJjaCkKICAgICBwa2d3cml0ZWRpciA9IGQuZXhw YW5kKCcke1BLR1dSSVRFRElSUlBNfS8ke1BBQ0tBR0VfQVJDSF9FWFRFTkR9JykKKyAgICBkLnNl dFZhcignUlBNX1BLR1dSSVRFRElSJywgcGtnd3JpdGVkaXIpCisgICAgYmIuZGVidWcoMSwgJ1BL R1dSSVRFRElSOiAlcycgJSBkLmdldFZhcignUlBNX1BLR1dSSVRFRElSJywgVHJ1ZSkpCiAgICAg cGtnYXJjaCA9IGQuZXhwYW5kKCcke1BBQ0tBR0VfQVJDSF9FWFRFTkR9JHtIT1NUX1ZFTkRPUn0t JHtIT1NUX09TfScpCiAgICAgbWFnaWNmaWxlID0gZC5leHBhbmQoJyR7U1RBR0lOR19ESVJfTkFU SVZFfSR7ZGF0YWRpcl9uYXRpdmV9L21pc2MvbWFnaWMubWdjJykKICAgICBiYi51dGlscy5ta2Rp cmhpZXIocGtnd3JpdGVkaXIpCkBAIC03MjcsNiArNzI5LDkgQEAgcHl0aG9uIGRvX3BhY2thZ2Vf cnBtICgpIHsKICAgICBkLnNldFZhcignQlVJTERTUEVDJywgY21kICsgIlxuIikKICAgICBkLnNl dFZhckZsYWcoJ0JVSUxEU1BFQycsICdmdW5jJywgJzEnKQogICAgIGJiLmJ1aWxkLmV4ZWNfZnVu YygnQlVJTERTUEVDJywgZCkKKworICAgIGlmIGQuZ2V0VmFyKCdSUE1fU0lHTl9QQUNLQUdFUycs IFRydWUpID09ICcxJzoKKyAgICAgICAgYmIuYnVpbGQuZXhlY19mdW5jKCJzaWduX3JwbSIsIGQp CiB9CiAKIHB5dGhvbiAoKSB7CmRpZmYgLS1naXQgYS9tZXRhL2NsYXNzZXMvc2lnbl9ycG0uYmJj bGFzcyBiL21ldGEvY2xhc3Nlcy9zaWduX3JwbS5iYmNsYXNzCm5ldyBmaWxlIG1vZGUgMTAwNjQ0 CmluZGV4IDAwMDAwMDAuLjg0YzcxNDEKLS0tIC9kZXYvbnVsbAorKysgYi9tZXRhL2NsYXNzZXMv c2lnbl9ycG0uYmJjbGFzcwpAQCAtMCwwICsxLDU4IEBACitpbmhlcml0IHNhbml0eQorCitSUE1f U0lHTl9QQUNLQUdFUz0nMScKKworCitfY2hlY2tfZ3BnX25hbWUgKCkgeworICAgIGVjaG8gYHdo aWNoIHJwbWAKKyAgICBtYWNyb2RlZj1gcnBtIC1FICclX2dwZ19uYW1lJ2AKKyAgICBbICIkbWFj cm9kZWYiID09ICIlX2dwZ19uYW1lIiBdICYmIHJldHVybiAxIHx8IHJldHVybiAwCit9CisKKwor ZGVmIHJwbXNpZ25fd3JhcHBlcihkLCBmaWxlcywgcGFzc3BocmFzZSwgZ3BnX25hbWU9Tm9uZSk6 CisgICAgaW1wb3J0IHBleHBlY3QKKworICAgICMgRmluZCB0aGUgY29ycmVjdCBycG0gYmluYXJ5 CisgICAgcnBtX2Jpbl9wYXRoID0gZC5nZXRWYXIoJ1NUQUdJTkdfQklORElSX05BVElWRScsIFRy dWUpICsgJy9ycG0nCisgICAgY21kID0gcnBtX2Jpbl9wYXRoICsgIiAtLWFkZHNpZ24gIgorICAg IGlmIGdwZ19uYW1lOgorICAgICAgICBjbWQgKz0gIi0tZGVmaW5lICclJV9ncGdfbmFtZSAlcycg IiAlIGdwZ19uYW1lCisgICAgZWxzZToKKyAgICAgICAgdHJ5OgorICAgICAgICAgICAgYmIuYnVp bGQuZXhlY19mdW5jKCdfY2hlY2tfZ3BnX25hbWUnLCBkKQorICAgICAgICBleGNlcHQgYmIuYnVp bGQuRnVuY0ZhaWxlZDoKKyAgICAgICAgICAgIHJhaXNlX3Nhbml0eV9lcnJvcigiWW91IG5lZWQg dG8gZGVmaW5lIFJQTV9HUEdfTkFNRSBpbiBiaXRiYWtlICIKKyAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAiY29uZmlnIG9yIHRoZSAlX2dwZ19uYW1lIFJQTSBtYWNybyBkZWZpbmVkICIK KyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiKGUuZy4gaW4gIH4vLm9lcnBtbWFjcm9z IiwgZCkKKyAgICBjbWQgKz0gJyAnLmpvaW4oZmlsZXMpCisKKyAgICAjIE5lZWQgdG8gdXNlIHBl eHBlY3QgZm9yIGZlZWRpbmcgdGhlIHBhc3NwaHJhc2UKKyAgICBwcm9jID0gcGV4cGVjdC5zcGF3 bihjbWQpCisgICAgdHJ5OgorICAgICAgICBwcm9jLmV4cGVjdF9leGFjdCgnRW50ZXIgcGFzcyBw aHJhc2U6JywgdGltZW91dD0xMCkKKyAgICBleGNlcHQgcGV4cGVjdC5USU1FT1VUIGFzIGVycjoK KyAgICAgICAgYmIuZGVidWcoJ3JwbXNpZ24gdGltZW91dDogJXMnICUgZXJyKQorICAgICAgICBw cm9jLnRlcm1pbmF0ZSgpCisgICAgcHJvYy5zZW5kbGluZShwYXNzcGhyYXNlKQorICAgIHByb2Mu d2FpdCgpCisgICAgcmV0dXJuIHByb2MuZXhpdHN0YXR1cworCisKK3B5dGhvbiBzaWduX3JwbSAo KSB7CisgICAgaW1wb3J0IGdsb2IKKworICAgIHJwbV9ncGdfcGFzc19maWxlID0gKGQuZ2V0VmFy KCJSUE1fR1BHX1BBU1NQSFJBU0VfRklMRSIsIFRydWUpIG9yICIiKQorICAgIGlmIHJwbV9ncGdf cGFzc19maWxlOgorICAgICAgICB3aXRoIG9wZW4ocnBtX2dwZ19wYXNzX2ZpbGUpIGFzIGZvYmo6 CisgICAgICAgICAgICBycG1fZ3BnX3Bhc3NwaHJhc2UgPSBmb2JqLnJlYWRsaW5lcygpWzBdLnJz dHJpcCgnXG4nKQorICAgIGVsc2U6CisgICAgICAgIHJhaXNlX3Nhbml0eV9lcnJvcigiWW91IG5l ZWQgdG8gZGVmaW5lIFJQTV9HUEdfUEFTU1BIUkFTRV9GSUxFIGluIHRoZSBjb25maWciLCBkKQor CisgICAgcnBtX2dwZ19uYW1lID0gKGQuZ2V0VmFyKCJSUE1fR1BHX05BTUUiLCBUcnVlKSBvciAi IikKKworICAgIHJwbXMgPSBnbG9iLmdsb2IoZC5nZXRWYXIoJ1JQTV9QS0dXUklURURJUicsIFRy dWUpICsgJy8qJykKKworICAgIGlmIHJwbXNpZ25fd3JhcHBlcihkLCBycG1zLCBycG1fZ3BnX3Bh c3NwaHJhc2UsIHJwbV9ncGdfbmFtZSkgIT0gMDoKKyAgICAgICAgcmFpc2UgYmIuYnVpbGQuRnVu Y0ZhaWxlZCgiUlBNIHNpZ25pbmcgZmFpbGVkIikKK30KLS0gCjIuMS40Cgo=