Bug 15217 - Need to document sstate signing
Summary: Need to document sstate signing
Status: RESOLVED FIXED
Alias: None
Product: Reference
Classification: Documentation
Component: handbook (show other bugs)
Version: 0.0.0
Hardware: x86 Multiple
: Medium normal
Target Milestone: 6.1 M4
Assignee: Antonin Godard
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2023-09-19 10:58 UTC by Richard Purdie
Modified: 2026-07-01 06:45 UTC (History)
5 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Yes (doc changes required)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Richard Purdie 2023-09-19 10:58:53 UTC 
sstate signing is technically supported but not documented. The best pointers I have to how it works are our test case:

meta/lib/oeqa/selftest/cases/signing.py:test_signing_sstate_archive

Where it appears you'd need to set:

SSTATE_SIG_KEY
SSTATE_SIG_PASSPHRASE
SSTATE_VERIFY_SIG

all of which are not documented.
Comment 1 Paulo Neves 2023-09-24 09:27:56 UTC 
Sstate cache signature verification is enabled by setting SSTATE_VERIFY_SIG to a boolean true as per bb.utils.to_boolean (which i did not find documented)

SSTATE_SIG_KEY = GnuPG key ID (The private key part is necessary for singning, and public part is for verification)
SSTATE_SIG_PASSPHRASE = GnuPG passphrase for signing
SSTATE_VALID_SIGS: A space separated list with the GPG signature ID that are allowed for signed file verification. If this variable is empty any installed public key will be used to validate the signature (I need to verify if this understanding is correct locally), otherwise only the specified one will be considered. 

* If SSTATE_SIG_KEY is not set signature files will not be created.
* If a signature file already exists, the previous one will be removed.
* If SSTATE_SKIP_CREATION is "1" no signing operations will occur.

Adapted from the RPM signing documentation:

For signed sstate cache feeds, the passphrase should be should be specified in a   separate file configuration file like local.conf or calling with `bitbake -R <credentials.conf>`.

The signing program used by default is gpg. If GPG is not in the path or a gpg home directory is required the following variables apply

GPG_BIN: Specifies a gpg binary/wrapper that is executed when a sstate cache file is signed.
GPG_PATH: Specifies the gpg home directory used when the sstate cache file is signed.

From my understanding there is currently no support for gpg-agent while signing sstate cache files
Comment 2 Michael Opdenacker 2023-09-24 10:23:35 UTC 
Many thanks Paulo, very helpful!
Comment 3 Randy MacLeod 2024-10-24 15:03:59 UTC 
Bulk move of 5.1 M4 to 5.2 M2 as approved by AlexB.
Comment 4 Antonin Godard 2025-06-06 07:42:30 UTC 
Bulk move of bugs I am assigned to from Milestone 5.2M4 to 5.3M1.