Bug 15217

Summary: Need to document sstate signing
Product: [Documentation] Reference Reporter: Richard Purdie <richard.purdie>
Component: handbookAssignee: Antonin Godard <antonin.godard>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium CC: ccasciato, poky.doc.watcher, poky.watcher, ptsneves, randy.macleod
Version: 0.0.0   
Target Milestone: 6.1 M4   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: Yes (doc changes required)

Description Richard Purdie 2023-09-19 10:58:53 UTC 
sstate signing is technically supported but not documented. The best pointers I have to how it works are our test case:

meta/lib/oeqa/selftest/cases/signing.py:test_signing_sstate_archive

Where it appears you'd need to set:

SSTATE_SIG_KEY
SSTATE_SIG_PASSPHRASE
SSTATE_VERIFY_SIG

all of which are not documented.
Comment 1 Paulo Neves 2023-09-24 09:27:56 UTC 
Sstate cache signature verification is enabled by setting SSTATE_VERIFY_SIG to a boolean true as per bb.utils.to_boolean (which i did not find documented)

SSTATE_SIG_KEY = GnuPG key ID (The private key part is necessary for singning, and public part is for verification)
SSTATE_SIG_PASSPHRASE = GnuPG passphrase for signing
SSTATE_VALID_SIGS: A space separated list with the GPG signature ID that are allowed for signed file verification. If this variable is empty any installed public key will be used to validate the signature (I need to verify if this understanding is correct locally), otherwise only the specified one will be considered. 

* If SSTATE_SIG_KEY is not set signature files will not be created.
* If a signature file already exists, the previous one will be removed.
* If SSTATE_SKIP_CREATION is "1" no signing operations will occur.

Adapted from the RPM signing documentation:

For signed sstate cache feeds, the passphrase should be should be specified in a   separate file configuration file like local.conf or calling with `bitbake -R <credentials.conf>`.

The signing program used by default is gpg. If GPG is not in the path or a gpg home directory is required the following variables apply

GPG_BIN: Specifies a gpg binary/wrapper that is executed when a sstate cache file is signed.
GPG_PATH: Specifies the gpg home directory used when the sstate cache file is signed.

From my understanding there is currently no support for gpg-agent while signing sstate cache files
Comment 2 Michael Opdenacker 2023-09-24 10:23:35 UTC 
Many thanks Paulo, very helpful!
Comment 3 Randy MacLeod 2024-10-24 15:03:59 UTC 
Bulk move of 5.1 M4 to 5.2 M2 as approved by AlexB.
Comment 4 Antonin Godard 2025-06-06 07:42:30 UTC 
Bulk move of bugs I am assigned to from Milestone 5.2M4 to 5.3M1.