Bug 8134

Which packaging format are you primarily using? rpm v5 and smart?

Yes, at the moment it's rpm5 and smart on device.

Which of the following do you think would be more feasible to do:
A. Extend the existing package_rpm bbclass. Signing would possibly be enabled by defining a proper variable in conf(?)

B.Write a new bbclass for doing the package signing. Signing would be enabled by inheriting the new class e.g. in distro conf.

I'm inclined to think that the second option would be better.

Created attachment 2673 [details]
POC patch for signing rpm packages

I wrote a patch for generating signed RPM. Does it make any sense to you?

This currently only supports signing in the local builder. Problematic part is of course the passphrase which must be stored in a file in the local filesystem.

Also, what is lacking is the integration with smart and image generation.

Merged to master:
http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=752736ae9f9c8842018e45cff2f5b1d770557d86
http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=59c7c7bfcb2cf3682526656fd9eba61a022e5a0a

ERROR: Function failed: RPM signing failed
ERROR: Task 670 (/home/bvoiculescu/yocto/poky/meta/recipes-core/glibc/glibc-locale_2.22.bb, do_package_write_rpm) failed with exit code '1'
NOTE: Tasks Summary: Attempted 654 tasks of which 649 didn't need to be rerun and 4 failed.
Waiting for 0 running tasks to finish:...


My setup is: 
1) in bitbake.conf

INHERIT += "sign_rpm"
RPM_GPG_PASSPHRASE_FILE = "/home/bvoiculescu/.gnupg/secret.txt"
RPM_GPG_NAME = "Bogdan-Alexandru Voiculescu <bogdanx.a.voiculescu@intel.com>"

2) 
cat /home/bvoiculescu/.gnupg/secret.txt
parola

3)
rpmsign is working:
~/yocto/poky$ rpmsign  --addsign /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/db/6.0.30-r0/deploy-rpms/i586/db-6.0.30-r0.i586.rpm
Enter pass phrase:
Pass phrase is good.
/home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/db/6.0.30-r0/deploy-rpms/i586/db-6.0.30-r0.i586.rpm:

(In reply to comment #7)
> ERROR: Function failed: RPM signing failed
> ERROR: Task 670
> (/home/bvoiculescu/yocto/poky/meta/recipes-core/glibc/glibc-locale_2.22.bb,
> do_package_write_rpm) failed with exit code '1'
> NOTE: Tasks Summary: Attempted 654 tasks of which 649 didn't need to be
> rerun and 4 failed.
> Waiting for 0 running tasks to finish:...

What is it that actually fails there? Does ${WORKDIR}/temp/log.do_package_write_rpm give any more insight?

 
> My setup is: 
> 1) in bitbake.conf
> 
> INHERIT += "sign_rpm"
> RPM_GPG_PASSPHRASE_FILE = "/home/bvoiculescu/.gnupg/secret.txt"
> RPM_GPG_NAME = "Bogdan-Alexandru Voiculescu <bogdanx.a.voiculescu@intel.com>"

The configuration looks good to me

> 2) 
> cat /home/bvoiculescu/.gnupg/secret.txt
> parola

Looks good, too. The file should only contain one line which is the passphrase.


> 3)
> rpmsign is working:
> ~/yocto/poky$ rpmsign  --addsign
> /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/db/6.0.30-r0/
> deploy-rpms/i586/db-6.0.30-r0.i586.rpm
> Enter pass phrase:
> Pass phrase is good.
> /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/db/6.0.30-r0/
> deploy-rpms/i586/db-6.0.30-r0.i586.rpm:

nope:
bvoiculescu@vhangan-PC:~$ cat /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/linux-libc-headers/4.1-r0/temp/log.do_package_write_rpm.11256
DEBUG: Executing python function sstate_task_prefunc
DEBUG: Removing manifest: /home/bvoiculescu/yocto/poky/build/tmp/deploy/rpm/i586/linux-libc-headers-dbg-4.1-r0.i586.rpm
DEBUG: Removing manifest: /home/bvoiculescu/yocto/poky/build/tmp/deploy/rpm/i586/linux-libc-headers-dev-4.1-r0.i586.rpm
DEBUG: Removing manifest: /home/bvoiculescu/yocto/poky/build/tmp/deploy/rpm/i586/
DEBUG: Python function sstate_task_prefunc finished
DEBUG: Executing python function do_package_write_rpm
DEBUG: Executing python function read_subpackage_metadata
DEBUG: Python function read_subpackage_metadata finished
DEBUG: Executing python function do_package_rpm
DEBUG: Executing python function write_specfile
NOTE: Creating EMPTY RPM Package for linux-libc-headers-dbg
NOTE: Not creating empty RPM package for linux-libc-headers-staticdev
NOTE: Creating RPM package for linux-libc-headers-dev
NOTE: Not creating empty RPM package for linux-libc-headers-doc
NOTE: Not creating empty RPM package for linux-libc-headers-locale
NOTE: Not creating empty RPM package for linux-libc-headers
DEBUG: Python function write_specfile finished
DEBUG: PKGWRITEDIR: /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/linux-libc-headers/4.1-r0/deploy-rpms/i586
DEBUG: Executing shell function BUILDSPEC
Building target platforms: i586-poky-linux
Processing files: linux-libc-headers-dbg-4.1-r0.i586
Processing files: linux-libc-headers-dev-4.1-r0.i586
Checking for unpackaged file(s): /home/bvoiculescu/yocto/poky/build/tmp/sysroots/x86_64-linux/usr/bin/../lib/rpm/check-files /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/linux-libc-headers/4.1-r0/package
Wrote: /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/linux-libc-headers/4.1-r0/deploy-rpms/i586/linux-libc-headers-dbg-4.1-r0.i586.rpm
Wrote: /home/bvoiculescu/yocto/poky/build/tmp/work/i586-poky-linux/linux-libc-headers/4.1-r0/deploy-rpms/i586/linux-libc-headers-dev-4.1-r0.i586.rpm
DEBUG: Shell function BUILDSPEC finished
DEBUG: Executing python function sign_rpm
DEBUG: Python function sign_rpm finished
DEBUG: Python function do_package_rpm finished
DEBUG: Python function do_package_write_rpm finished
ERROR: Function failed: RPM signing failed

Marking this as resolved, again.

The problem above was caused by missing 'gpg2' binary on Ubuntu systems (they only have 'gpg'). The problem can be circumvented by defining GPG_BIN in bitbake configuration or defining the %__gpg macro in ~/.oerpmmacros file. These settings are not required when/if this patch gets merged:
http://lists.openembedded.org/pipermail/openembedded-core/2015-September/110475.html

confirmed implementation is done and rpm sign is working.

We trying to verify this in my project, but didn't get successful result, pls. help to check if the test steps are correct:
My steps:
1. gpg --gen-key
2. add my passwd to ~/.gnupg/secret.txt
3. edit .rpmmacros , add these contents:
%_signature gpg
%_gpgbin /usr/bin/gpg
%_gpg_name myname (test) <myname@corparation.com>
%_gpg_path /home/dir/.gnupg
4. git clone [my project]
5. source oe-init-build-env
6. edit conf/local.conf, add these contents(please note that if didn't add RPM_GPG_PUBKEY, bitbake will return an error):\
INHERIT += "sign_rpm"
RPM_GPG_PASSPHRASE_FILE = "/home/dir/.gnupg/secret.txt"
RPM_GPG_NAME = "myname"
RPM_GPG_PUBKEY = "/home/dir/.gnupg/pubring.gpg"
7. bitbake my-project-image
8. rpm --checksig mraa-test-1.0.0-r0.i586_nlp_32.rpm
mraa-test-1.0.0-r0.i586_nlp_32.rpm: RSA sha1 md5 NOT OK
9. rpm --resign mraa-test-1.0.0-r0.i586_nlp_32.rpm
Enter pass phrase: 
Pass phrase is good.
mraa-test-1.0.0-r0.i586_nlp_32.rpm:
warning: mraa-test-1.0.0-r0.i586_nlp_32.rpm already contains identical signature, skipping
It seems that signature has added already, but couldn't verify this key.
BTW, I tried to add sign manually, when I checksign, it will have these results:
mraa-test-1.0.0-r0.i586_nlp_32.rpm: RSA sha1 ((MD5) PGP) md5 NOT OK (MISSING KEYS: (MD5) PGP#2b1be55e)

Pls. give my some hints about the test steps. Thanks!

First of all, RPM_GPG_PUBKEY must point to the public key, not the pub keyring. I.e.
$ gpg --export --armor "myname (test) <myname@corparation.com>" > key.pub
and then make RPM_GPG_PUBKEY point to that file.


Worksforme. What host os do you use? It might be some incompatibility with the rpm versions of host and target systems. Try using the rpm from sysroot instead:
$ tmp-glibc/sysroots/x86_64-linux/usr/bin/rpm --import key.pug
$ tmp-glibc/sysroots/x86_64-linux/usr/bin/rpm --checksig mraa-test-1.0.0-r0.i586_nlp_32.rpm

Added oe-selftest for this feature:
http://lists.openembedded.org/pipermail/openembedded-core/2015-October/111648.html