Bug 8182 - Add optional signing to sstate archives and signature verification
Summary: Add optional signing to sstate archives and signature verification
Status: VERIFIED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: 1.8
Hardware: x86 Multiple
: High enhancement
Target Milestone: 1.9 M3
Assignee: Ross Burton
QA Contact: Bogdan Alexandru Voiculescu
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2015-08-19 09:59 UTC by Richard Purdie
Modified: 2015-09-09 09:41 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Yes (doc changes required)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Richard Purdie 2015-08-19 09:59:16 UTC 
sstate archives are currently unsigned and its not possible to verify their integrity. Adding a verification mechanism such as signing would improve security in wider distributed systems.
Comment 1 Ross Burton 2015-08-19 19:41:13 UTC 
As in GPG signatures?
Comment 2 Ross Burton 2015-09-08 10:24:01 UTC 
Merged in 237b6c51b42b0c64434dc45685e10f757ac939c2.
Comment 3 Bogdan Alexandru Voiculescu 2015-09-09 09:41:54 UTC 
verified on master: db92bc23880794be77373b0f2d8c26279dcecb84

gpg --verify sstate:glibc-initial:i586-poky-linux:2.22:r0:i586:3:9153636a57df8fc934be63e83ccdc963_package.tgz.sig  sstate:glibc-initial:i586-poky-linux:2.22:r0:i586:3:9153636a57df8fc934be63e83ccdc963_package.tgz
gpg: Signature made Wed 09 Sep 2015 12:19:35 PM EEST using RSA key ID 876EC70C
gpg: Good signature from "Bogdan-Alexandru Voiculescu (no comment...) <bogdanx.a.voiculescu@intel.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: E29B 4FC5 861C 717E DBCD  F5AF F139 ABFA 876E C70C