Bug 8182

Summary:	Add optional signing to sstate archives and signature verification
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Richard Purdie <richard.purdie>
Component:	core	Assignee:	Ross Burton <ross.burton>
Status:	VERIFIED FIXED	QA Contact:	Bogdan Alexandru Voiculescu <bogdanx.a.voiculescu>
Severity:	enhancement
Priority:	High	CC:	bluelightning, bogdanx.a.voiculescu, meta.mr.watcher, meta.watcher
Version:	1.8
Target Milestone:	1.9 M3
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	Yes (doc changes required)

Description Richard Purdie 2015-08-19 09:59:16 UTC

sstate archives are currently unsigned and its not possible to verify their integrity. Adding a verification mechanism such as signing would improve security in wider distributed systems.

Comment 1 Ross Burton 2015-08-19 19:41:13 UTC

As in GPG signatures?

Comment 2 Ross Burton 2015-09-08 10:24:01 UTC

Merged in 237b6c51b42b0c64434dc45685e10f757ac939c2.

Comment 3 Bogdan Alexandru Voiculescu 2015-09-09 09:41:54 UTC

verified on master: db92bc23880794be77373b0f2d8c26279dcecb84

gpg --verify sstate:glibc-initial:i586-poky-linux:2.22:r0:i586:3:9153636a57df8fc934be63e83ccdc963_package.tgz.sig  sstate:glibc-initial:i586-poky-linux:2.22:r0:i586:3:9153636a57df8fc934be63e83ccdc963_package.tgz
gpg: Signature made Wed 09 Sep 2015 12:19:35 PM EEST using RSA key ID 876EC70C
gpg: Good signature from "Bogdan-Alexandru Voiculescu (no comment...) <bogdanx.a.voiculescu@intel.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: E29B 4FC5 861C 717E DBCD  F5AF F139 ABFA 876E C70C