8559 2015-10-22 15:09:08 +0000 Signing to sstate archives and signature verification should allow to use a custom GPG keys directory 2016-01-26 14:23:46 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 1.9 x86 Multiple RESOLVED FIXED Medium enhancement 2.1 1 daniel.alexandrux.istrate ross.burton meta.mr.watcher meta.watcher daniel.alexandrux.istrate --- --- Yes (doc changes required) oldest_to_newest 55617 0 daniel.alexandrux.istrate 2015-10-22 15:09:08 +0000 When signing sstate you should be able to specify where the gpg keys are located. Similar implementation for rpm signing http://lists.openembedded.org/pipermail/openembedded-core/2015-October/111550.html if GPG_PATH is specified use that instead of ~/.gnugpg/ . Steps to validate: gpg --gen-key <and provide all the details required> --> this will create the gpg keys in ~/.gnugpg gpg --homedir /home/daniel/poky/meta-selftest/files/signing/ --gen-key <and provide all the details required> --> this will create the gpg keys in your specified directory To list the keys use: gpg --list-key gpg --homedir /home/daniel/poky/meta-selftest/files/signing/ --list-key 1. Add to conf/local.conf (Please update the values accordingly) SSTATE_SIG_KEY ?= "61EEFB30" <-- the pub key from custom dir (eg. pub 2048R/61EEFB30 2015-10-21) SSTATE_SIG_PASSPHRASE ?= "test123" SSTATE_VERIFY_SIG ?= "1" SSTATE_DIR ?= '/media/ssd/poky-build/daniel-sstate' GPG_PATH = /home/daniel/poky/meta-selftest/files/signing/ 2. bitbake -c cleansstate ed 3. bitbake -c clean ed 4. bitbake ed <-- should succeed and use the key from GPG_PATH 5. To validate even further: [daniel@fedora-ws poky-build]$ gpg --verify daniel-sstate/ed/sstate:ed:i586-poky-linux:1.9:r0:i586:3:ed923fc0a937005a38e87d24bc219ec1_populate_sysroot.tgz.sig daniel-sstate/ed/sstate:ed:i586-poky-linux:1.9:r0:i586:3:ed923fc0a937005a38e87d24bc219ec1_populate_sysroot.tgz gpg: Signature made Thu 22 Oct 2015 01:45:09 PM EEST using RSA key ID 61EEFB30 gpg: Good signature from "testuser (nocomment) <testuser@email.com>" Also there is an oe-selftest waiting for this feature that also validates #8182 https://git.yoctoproject.org/cgit/cgit.cgi/poky-contrib/commit/?h=distrate/bug_8182&id=664fad667aa4102b5ab8ffa3447bfcaa0851c482 55703 1 ross.burton 2015-10-24 00:13:29 +0000 Patch 'sstate: respect GPG_BIN and GPG_HOME' sent to the list. 58236 2 ross.burton 2016-01-26 14:23:46 +0000 Merged in oe-core 6daf138822bbbc46960121d3b76b42eaf19e7c0e.