To provide some element of integrity to sstate archives, allow sstate archives to be GPG signed with a specified key (detached signature to a sidecar .sig file), and verify the signatures when sstate archives are unpacked.
TODO: fetch .sig from remote sstate mirrors Signed-off-by: Ross Burton <[email protected]> --- meta/classes/sstate.bbclass | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/meta/classes/sstate.bbclass b/meta/classes/sstate.bbclass index 4e6afef..69145e5 100644 --- a/meta/classes/sstate.bbclass +++ b/meta/classes/sstate.bbclass @@ -54,6 +54,11 @@ EXTRA_STAGING_FIXMES ?= "" SIGGEN_LOCKEDSIGS_CHECK_LEVEL ?= 'error' +# The GnuPG key ID to use to sign sstate archives (or unset to not sign) +SSTATE_SIG_KEY ?= "" +# Whether to verify the GnUPG signatures when extracting sstate archives +SSTATE_VERIFY_SIG ?= "0" + # Specify dirs in which the shell function is executed and don't use ${B} # as default dirs to avoid possible race about ${B} with other task. sstate_create_package[dirs] = "${SSTATE_BUILDDIR}" @@ -298,6 +303,10 @@ def sstate_installpkg(ss, d): d.setVar('SSTATE_INSTDIR', sstateinst) d.setVar('SSTATE_PKG', sstatepkg) + if bb.utils.to_boolean(d.getVar("SSTATE_VERIFY_SIG", True), False): + if subprocess.call(["gpg", "--verify", sstatepkg + ".sig", sstatepkg]) != 0: + bb.warn("Cannot verify signature on sstate package %s" % sstatepkg) + for f in (d.getVar('SSTATEPREINSTFUNCS', True) or '').split() + ['sstate_unpack_package'] + (d.getVar('SSTATEPOSTUNPACKFUNCS', True) or '').split(): bb.build.exec_func(f, d) @@ -604,6 +613,7 @@ def pstaging_fetch(sstatefetch, sstatepkg, d): # Try a fetch from the sstate mirror, if it fails just return and # we will build the package + # TODO attempt to fetch (and silently handle) the .sig file for srcuri in ['file://{0}'.format(sstatefetch), 'file://{0}.siginfo'.format(sstatefetch)]: localdata.setVar('SRC_URI', srcuri) @@ -665,6 +675,11 @@ sstate_create_package () { chmod 0664 $TFILE mv -f $TFILE ${SSTATE_PKG} + if [ -n "${SSTATE_SIG_KEY}" ]; then + rm -f ${SSTATE_PKG}.sig + gpg --detach-sign --local-user ${SSTATE_SIG_KEY} --output ${SSTATE_PKG}.sig ${SSTATE_PKG} + fi + cd ${WORKDIR} rm -rf ${SSTATE_BUILDDIR} } -- 2.1.4 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
