8182 2015-08-19 09:59:16 +0000 Add optional signing to sstate archives and signature verification 2015-09-09 09:41:54 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 1.8 x86 Multiple VERIFIED FIXED High enhancement 1.9 M3 1 richard.purdie ross.burton bluelightning bogdanx.a.voiculescu meta.mr.watcher meta.watcher bogdanx.a.voiculescu --- --- Yes (doc changes required) oldest_to_newest 53212 0 richard.purdie 2015-08-19 09:59:16 +0000 sstate archives are currently unsigned and its not possible to verify their integrity. Adding a verification mechanism such as signing would improve security in wider distributed systems. 53242 1 ross.burton 2015-08-19 19:41:13 +0000 As in GPG signatures? 53831 2 ross.burton 2015-09-08 10:24:01 +0000 Merged in 237b6c51b42b0c64434dc45685e10f757ac939c2. 53867 3 bogdanx.a.voiculescu 2015-09-09 09:41:54 +0000 verified on master: db92bc23880794be77373b0f2d8c26279dcecb84 gpg --verify sstate:glibc-initial:i586-poky-linux:2.22:r0:i586:3:9153636a57df8fc934be63e83ccdc963_package.tgz.sig sstate:glibc-initial:i586-poky-linux:2.22:r0:i586:3:9153636a57df8fc934be63e83ccdc963_package.tgz gpg: Signature made Wed 09 Sep 2015 12:19:35 PM EEST using RSA key ID 876EC70C gpg: Good signature from "Bogdan-Alexandru Voiculescu (no comment...) <bogdanx.a.voiculescu@intel.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: E29B 4FC5 861C 717E DBCD F5AF F139 ABFA 876E C70C