[PATCH 0/3] Signing local cache repo

[PATCH 0/3] Signing local cache repo

[Maxim Yu. Osipov]

Hello everybody,

By default the local caching repo is not gpg signed.
This series adds the ability to sign it.  

Prerequsite: we suppose that gpg is installed on your host system
and a default key pair is generated.

 -  set `BASE_REPO_KEY` in `conf/local.conf` to `SRC_URI` of your public key,
f.e. BASE_REPO_KEY = "file:///home/user/my_pub.key" and 
follow usual procedure of  creation of local apt repo caching: 

 - bitbake -c cache_base_repo multiconfig:qemuamd64-stretch:isar-image-base

 - Set `ISAR_USE_CACHED_BASE_REPO` in `conf/local.conf`:

```
# Uncomment this to enable use of cached base repository
#ISAR_USE_CACHED_BASE_REPO ?= "1"
```
 - Remove build artifacts to use only local base-apt:

```
sudo rm -rf tmp

```
 - Trigger again generation of image (now using local caching repo):

```
bitbake multiconfig:qemuamd64-stretch:isar-image-base
```

Note: Depending on your gpg configuration you may be asked to provide a passphrase 
(if it is non empty).

Kind regards,
Maxim.

Maxim Yu. Osipov (3):
  isar-bootstrap: Allow to set local keys in DISTRO_APT_KEYS
  base-apt: Introduce BASE_REPO_KEY to sign local repo
  doc/user_manual: Describe gpg signing of local repo

 doc/user_manual.md                                  | 10 ++++++----
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 16 ++++++++++++++--
 meta/recipes-devtools/base-apt/base-apt.bb          |  6 ++++++
 3 files changed, 26 insertions(+), 6 deletions(-)

-- 
2.11.0

[PATCH 1/3] isar-bootstrap: Allow to set local keys in DISTRO_APT_KEYS

[Maxim Yu. Osipov]

One may specify the absolute path to locally stored keys in
DISTRO_APT_KEYS as file://<absolute_path_to_key_file>

Local fetcher module puts the file under
${WORKDIR}/<absolute_path_to_key_file>, so
gpg in do_generate_keyring() task can't find it.
This patch fixes the problem.

Signed-off-by: Maxim Yu. Osipov <mosipov@ilbers.de>
---
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index 323f7cf..fbe312d 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -37,9 +37,10 @@ python () {
     distro_apt_keys = d.getVar("DISTRO_APT_KEYS", False)
     if distro_apt_keys:
         d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
+        wd = d.getVar("WORKDIR", True)
         for key in distro_apt_keys.split():
             url = urlparse(key)
-            filename = os.path.basename(url.path)
+            filename = ''.join([wd, url.path])
             d.appendVar("SRC_URI", " %s" % key)
             d.appendVar("APTKEYFILES", " %s" % filename)
 }
-- 
2.11.0

[PATCH 2/3] base-apt: Introduce BASE_REPO_KEY to sign local repo

[Maxim Yu. Osipov]

This patch adds the ability to sign local cached repository
by setting BASE_REPO_KEY in local.conf to SRC_URI of your
public key.

For locally stored key the value has to be specified in the
format 'file://<absolute_path_to_your_pub_key_file>'.

Prerequsite: we suppose that gpg is installed on your host system
and a default key pair is generated.

Signed-off-by: Maxim Yu. Osipov <mosipov@ilbers.de>
---
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 15 +++++++++++++--
 meta/recipes-devtools/base-apt/base-apt.bb          |  6 ++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index fbe312d..234d339 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -35,14 +35,23 @@ inherit base-apt-helper
 python () {
     from urllib.parse import urlparse
     distro_apt_keys = d.getVar("DISTRO_APT_KEYS", False)
+    wd = d.getVar("WORKDIR", True)
     if distro_apt_keys:
         d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
-        wd = d.getVar("WORKDIR", True)
         for key in distro_apt_keys.split():
             url = urlparse(key)
             filename = ''.join([wd, url.path])
             d.appendVar("SRC_URI", " %s" % key)
             d.appendVar("APTKEYFILES", " %s" % filename)
+    if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')):
+        own_pub_key = d.getVar("BASE_REPO_KEY", False)
+        if own_pub_key:
+            d.setVar("DEBOOTSTRAP_KEYRING", "--keyring ${APTKEYRING}")
+            for key in own_pub_key.split():
+                url = urlparse(key)
+                filename = ''.join([wd, url.path])
+                d.appendVar("SRC_URI", " %s" % key)
+                d.appendVar("APTKEYFILES", " %s" % filename)
 }
 
 def aggregate_files(d, file_list, file_out):
@@ -200,7 +209,9 @@ isar_bootstrap() {
     done
     debootstrap_args="--verbose --variant=minbase --include='${DISTRO_BOOTSTRAP_BASE_PACKAGES}'"
     if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
-        debootstrap_args="$debootstrap_args --no-check-gpg"
+        if [ -z "${BASE_REPO_KEY}" ] ; then
+            debootstrap_args="$debootstrap_args --no-check-gpg"
+        fi
     fi
     E="${@bb.utils.export_proxies(d)}"
     sudo -E flock "${ISAR_BOOTSTRAP_LOCK}" -c "\
diff --git a/meta/recipes-devtools/base-apt/base-apt.bb b/meta/recipes-devtools/base-apt/base-apt.bb
index d744ed6..1c0b4c6 100644
--- a/meta/recipes-devtools/base-apt/base-apt.bb
+++ b/meta/recipes-devtools/base-apt/base-apt.bb
@@ -5,6 +5,8 @@ SRC_URI = "file://distributions.in"
 
 inherit base-apt-helper
 
+BASE_REPO_KEY ?= ""
+
 CACHE_CONF_DIR = "${REPO_BASE_DIR}/${BASE_DISTRO}/conf"
 do_cache_config[dirs] = "${CACHE_CONF_DIR}"
 do_cache_config[stamp-extra-info] = "${DISTRO}"
@@ -16,6 +18,10 @@ do_cache_config() {
     if [ ! -e "${CACHE_CONF_DIR}/distributions" ]; then
         sed -e "s#{CODENAME}#"${BASE_DISTRO_CODENAME}"#g" \
             ${WORKDIR}/distributions.in > ${CACHE_CONF_DIR}/distributions
+        if [ "${BASE_REPO_KEY}" ] ; then
+            # To generate Release.gpg
+            echo "SignWith: yes" >> ${CACHE_CONF_DIR}/distributions
+        fi
     fi
 
     path_cache="${REPO_BASE_DIR}/${BASE_DISTRO}"
-- 
2.11.0

[PATCH 3/3] doc/user_manual: Describe gpg signing of local repo

[Maxim Yu. Osipov]

Signed-off-by: Maxim Yu. Osipov <mosipov@ilbers.de>
---
 doc/user_manual.md | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/doc/user_manual.md b/doc/user_manual.md
index eebcaa9..c9c40ae 100644
--- a/doc/user_manual.md
+++ b/doc/user_manual.md
@@ -727,6 +727,12 @@ Cache upstream debian packages to reduce time for further downloads and to be ab
 
  - Trigger creation of local apt caching Debian packages during image generation.
 
+Note: By default the local caching repo is not gpg signed.
+If you want to sign it, `gpg` has to be installed in your host system and
+a default key pair is generated,
+set `BASE_REPO_KEY` in `conf/local.conf` to `SRC_URI` of your public key,
+f.e. 'BASE_REPO_KEY = "file://<absolute_path_to_your_pub_key_file>"'.
+
 ```
 bitbake -c cache_base_repo multiconfig:qemuarm-stretch:isar-image-base
 ```
@@ -749,7 +755,3 @@ sudo rm -rf tmp
 ```
 bitbake multiconfig:qemuarm-stretch:isar-image-base
 ```
-
-### Limitation
-
-So far the local base-apt repo is not gpg signed.
-- 
2.11.0

Re: [PATCH 0/3] Signing local cache repo

[Maxim Yu. Osipov]

On 2/4/19 8:54 PM, Maxim Yu. Osipov wrote:
> Hello everybody,
> 
> By default the local caching repo is not gpg signed.
> This series adds the ability to sign it.
> 
> Prerequsite: we suppose that gpg is installed on your host system
> and a default key pair is generated.
> 
>   -  set `BASE_REPO_KEY` in `conf/local.conf` to `SRC_URI` of your public key,
> f.e. BASE_REPO_KEY = "file:///home/user/my_pub.key" and
> follow usual procedure of  creation of local apt repo caching:
> 
>   - bitbake -c cache_base_repo multiconfig:qemuamd64-stretch:isar-image-base
> 
>   - Set `ISAR_USE_CACHED_BASE_REPO` in `conf/local.conf`:
> 
> ```
> # Uncomment this to enable use of cached base repository
> #ISAR_USE_CACHED_BASE_REPO ?= "1"
> ```
>   - Remove build artifacts to use only local base-apt:
> 
> ```
> sudo rm -rf tmp
> 
> ```
>   - Trigger again generation of image (now using local caching repo):
> 
> ```
> bitbake multiconfig:qemuamd64-stretch:isar-image-base
> ```
> 
> Note: Depending on your gpg configuration you may be asked to provide a passphrase
> (if it is non empty).
> 
> Kind regards,
> Maxim.

Applied to the 'next' (v2 of patch #3  was applied)

Maxim.

> Maxim Yu. Osipov (3):
>    isar-bootstrap: Allow to set local keys in DISTRO_APT_KEYS
>    base-apt: Introduce BASE_REPO_KEY to sign local repo
>    doc/user_manual: Describe gpg signing of local repo
> 
>   doc/user_manual.md                                  | 10 ++++++----
>   meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 16 ++++++++++++++--
>   meta/recipes-devtools/base-apt/base-apt.bb          |  6 ++++++
>   3 files changed, 26 insertions(+), 6 deletions(-)
> 


-- 
Maxim Osipov
ilbers GmbH
Maria-Merian-Str. 8
85521 Ottobrunn
Germany
+49 (151) 6517 6917
mosipov@ilbers.de
http://ilbers.de/
Commercial register Munich, HRB 214197
General Manager: Baurzhan Ismagulov