Bug 8559 - Signing to sstate archives and signature verification should allow to use a custom GPG keys directory
Summary: Signing to sstate archives and signature verification should allow to use a c...
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: 1.9
Hardware: x86 Multiple
: Medium enhancement
Target Milestone: 2.1
Assignee: Ross Burton
QA Contact: Daniel Istrate
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2015-10-22 15:09 UTC by Daniel Istrate
Modified: 2016-01-26 14:23 UTC (History)
2 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Yes (doc changes required)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Istrate 2015-10-22 15:09:08 UTC
When signing sstate you should be able to specify where the gpg keys are located.
Similar implementation for rpm signing http://lists.openembedded.org/pipermail/openembedded-core/2015-October/111550.html

if GPG_PATH is specified use that instead of ~/.gnugpg/ .

Steps to validate:
gpg --gen-key <and provide all the details required> --> this will create the gpg keys in ~/.gnugpg

gpg --homedir /home/daniel/poky/meta-selftest/files/signing/ --gen-key <and provide all the details required> --> this will create the gpg keys in your specified directory

To list the keys use:
gpg --list-key
gpg --homedir /home/daniel/poky/meta-selftest/files/signing/ --list-key

1. Add to conf/local.conf (Please update the values accordingly)

SSTATE_SIG_KEY ?= "61EEFB30" <-- the pub key from custom dir (eg. pub   2048R/61EEFB30 2015-10-21)
SSTATE_SIG_PASSPHRASE ?= "test123"
SSTATE_VERIFY_SIG ?= "1"
SSTATE_DIR ?= '/media/ssd/poky-build/daniel-sstate'
GPG_PATH = /home/daniel/poky/meta-selftest/files/signing/

2. bitbake -c cleansstate ed
3. bitbake -c clean ed
4. bitbake ed  <-- should succeed and use the key from GPG_PATH

5. To validate even further:
[daniel@fedora-ws poky-build]$ gpg --verify daniel-sstate/ed/sstate:ed:i586-poky-linux:1.9:r0:i586:3:ed923fc0a937005a38e87d24bc219ec1_populate_sysroot.tgz.sig daniel-sstate/ed/sstate:ed:i586-poky-linux:1.9:r0:i586:3:ed923fc0a937005a38e87d24bc219ec1_populate_sysroot.tgz
gpg: Signature made Thu 22 Oct 2015 01:45:09 PM EEST using RSA key ID 61EEFB30
gpg: Good signature from "testuser (nocomment) <testuser@email.com>"


Also there is an oe-selftest waiting for this feature that also validates #8182
https://git.yoctoproject.org/cgit/cgit.cgi/poky-contrib/commit/?h=distrate/bug_8182&id=664fad667aa4102b5ab8ffa3447bfcaa0851c482
Comment 1 Ross Burton 2015-10-24 00:13:29 UTC
Patch 'sstate: respect GPG_BIN and GPG_HOME' sent to the list.
Comment 2 Ross Burton 2016-01-26 14:23:46 UTC
Merged in oe-core 6daf138822bbbc46960121d3b76b42eaf19e7c0e.