summaryrefslogtreecommitdiffstats
path: root/meta-integrity/classes
Commit message (Collapse)AuthorAgeFilesLines
* meta-secure-core: Convert to new override syntaxYi Zhao2021-08-091-2/+2
| | | | | | Converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* sign_rpm_ext: Use socket redirection to avoid GPG_PATH length limitationOvidiu Panait2020-03-011-5/+0
| | | | | | | | | | | | | | | Currently, an error will be thrown when trying to use a GPG homedir whose path length exceeds 80 characters. This limitation can be worked around by providing libassuan socket redirection files for "S.gpg-agent.yocto-native", "S.gpg-agent.ssh", "S.gpg-agent.browser" and "S.gpg-agent.extra" sockets. The redirection files will point to the real sockets in /tmp directory. The sockets will be automatically cleaned up by gpg agent. References: [1] https://dev.gnupg.org/T1752 [2] https://gnupg.org/documentation/manuals/assuan.pdf Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
* sign_rpm_ext.bbclass: check the length of GPG_PATHLiwei Song2019-12-051-0/+4
| | | | | | | connect to gpg agent may failed due to the GPG_PATH is too long, check and raise an error if the length is greater than 80. Signed-off-by: Liwei Song <liwei.song@windriver.com>
* sign_rpm_ext.bbclass: remove prefuncs for do_package_write_rpm andChangqing Li2019-11-291-3/+0
| | | | | | | | | do_rootfs in commit 393b80fa, prefuncs of do_package_write_rpm/do_rootfs have been replace by (task)_prepend in this bbclass, so remove it. Signed-off-by: Changqing Li <changqing.li@windriver.com>
* sign_rpm_ext.bbclass, user-key-store.bbclass: Add boot loader signingJason Wessel2019-11-081-24/+6
| | | | | | | | | | | | | | | | | | | | | This changes the rpm signing setup to use a generic routine check_gpg_key(), in order that the boot loader gpg signing can use the same infrastructure. For now the boot loader gpg signing will only support grub and introduces the variable: GRUB_SIGN_VERIFY = "1" This variable is a control point to activate the code in grub-efi to perform file verification of any file it loads against a gpg key which is linked into the boot loader with grub-mkimage. It will also cause all the other files such as the kernel, initramfs and LockDown.efi to be signed such that grub will verify the files. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* sign_rpm_ext.bbclass: fix check_rpm_public_key failed while host not install ↵Sandy2019-11-071-4/+11
| | | | | | | | | | gpg (#124) Due to the following reasons, need to add the dependency to task who needs to run check_rpm_public_key: * packagegroup recipe don't have task prepare_recipe_sysroot * varflags depends don't work for prefuncs Signed-off-by: Changqing Li <changqing.li@windriver.com>
* sign_rpm_ext.bbclass: fix compile fail since missing gpg (#123)Sandy2019-11-061-0/+3
| | | | | | | | | | | | | | there is a scenario that this bbclass is enabled globally, all targets will inherit sign_rpm_ext. but this bbclass need gpg to work, on some new distro like ubuntun 19.04, gpg is not installed, so compile will failed. fail cmd: cmd = '%s --batch --homedir %s --passphrase %s --import %s' % \ (gpg_bin, gpg_path, d.getVar('RPM_GPG_PASSPHRASE', True), gpg_key) error: base-files-3.0.14-r89 do_package_write_rpm: Failed to import gpg key (): /bin/sh: 1: --batch: not found Signed-off-by: Changqing Li <changqing.li@windriver.com>
* meta-secure-core: use bb.fatal instead of bb.build.FuncFailedYi Zhao2019-08-191-4/+2
| | | | | | | The bb.build.FuncFailed had been removed in bitbake with commit cfeffb602dd5319f071cd6bcf84139ec77f2d170. Use bb.fatal instead of it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* sign_rpm_ext.bbclass: fix check_rpm_public_key racing at recipe parsing timeHongxu Jia2018-05-311-4/+1
| | | | | | | | | | | | | | | | All recipe will be parsed which caused lockfile of check_rpm_public_key racing issue. ... |WARNING: meta-secure-core/meta/recipes-core/images/secure-core-image-initramfs.bb: oe-core/bitbake/lib/bb/utils.py:400: ResourceWarning: unclosed file <_io.TextIOWrapper name='tmp-glibc/check_rpm_public_key.lock' mode='a+' encoding='UTF-8'> ... Refer do_package_write_rpm, add check_rpm_public_key to prefunc of do_rootfs, only the running image recipe will invoke check_rpm_public_key. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* sign_rpm_ext.bbclass: check rpm public key at image recipe parsing timeHongxu Jia2018-05-231-0/+4
| | | | | | | | | | | | | | | | | While multiple builds share a common sstate, the latter build failed to build image which the public key not found. ... |ERROR: initramfs-ostree-image-1.0-r0 do_rootfs: Importing GPG key failed. Command 'rpmkeys --root=<path>/rootfs --import <path>/rpm-key' returned 1: ... The latter build will not regenerate rpm packages and check_rpm_public_key will not be invoked. Explicitly invoke check_rpm_public_key at image recipe parsing time, which make sure gpg public key be imported. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* sign_rpm_ext: make sure all target recipes are signedJia Zhang2017-08-241-0/+26
| | | | | | | | Placing the key import logic under signing-keys cannot ensure all target recipes are always signed. Instead, place it before do_package_write_rpm. Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* sign_rpm_ext: define the location of default gpg keyring to TMPDIRJia Zhang2017-08-201-1/+1
| | | | Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* sign_rpm_ext: fix permission warningJia Zhang2017-08-201-1/+1
| | | | Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* sign_rpm_ext.bbclass: clean upJia Zhang2017-08-191-9/+1
| | | | Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* sign_rpm_ext: Fix the GPG_PATH directory not exist issue (#4)Guojian2017-08-191-8/+7
| | | | | | | | | | | | | | | If "GPG_PATH" is set in the init script, then "signing-keys" get_public_keys task will execute failed. So the "GPG_PATH" directory would be created when "GPG_PATH" is set. The do_get_public_keys failed to import gpg key error information is as following: ---------------------------------------------------------------------------------------- ERROR: signing-keys-1.0-r0 do_get_public_keys: Function failed: Failed to import gpg key (layers/meta-secure-core/meta-signing-key/files/rpm_keys/RPM-GPG-PRIVKEY-SecureCore): gpg: fatal: can't create directory `tmp/deploy/images/intel-corei7-64/.gnupg': No such file or directory Signed-off-by: Guojian Zhou <guojian.zhou@windriver.com>
* sign_rpm_ext.bbclass: use the default setting from meta-signing-keyJia Zhang2017-08-191-2/+3
| | | | Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* sign_rpm_ext: set default GPG_PATH if it is not specified (#2)yunguowei2017-08-191-0/+15
| | | | | | | | | | | commit 52bf3b6636f95a(meta-integrity: move gpg keyring initialization to signing-keys) tried to initialize keyring in the task check_public_keys of the recipe signing-keys. However, it does work with the recipe signing-keys only, and GPG_PATH can't be passed to other recipes. We bring the python anonymous function back, and it makes sure GPG_PATH is set before signing the packages for every recipe. Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
* meta-integrity: move gpg keyring initialization to signing-keysJia Zhang2017-08-171-38/+0
| | | | Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* sign_rpm_ext: support RPM signingLans Zhang2017-08-171-6/+45
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* sign_rpm_ext: remove the test linesLans Zhang2017-07-191-4/+0
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* IMA: enable RPM file signing if ima is configuredLans Zhang2017-07-191-1/+1
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* meta-integrity: enable sign_rpm_ext to support rpm and file signingLans Zhang2017-07-111-0/+20
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* IMA: clean up IMA signingLans Zhang2017-07-111-156/+0
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* meta-secure-core: initial commitLans Zhang2017-06-221-0/+156
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-05-14 12:45:50 +0000