[PATCH 1/2] ci_build: Add signing cached repo test

[PATCH 1/2] ci_build: Add signing cached repo test

[Maxim Yu. Osipov]

Signed-off-by: Maxim Yu. Osipov <mosipov@isar-build.org>
---
 scripts/ci_build.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/scripts/ci_build.sh b/scripts/ci_build.sh
index 01f09b6..fcec14d 100755
--- a/scripts/ci_build.sh
+++ b/scripts/ci_build.sh
@@ -50,6 +50,7 @@ REPRO_TARGETS_SET="\
             multiconfig:qemuamd64-stretch:isar-image-base \
             multiconfig:qemuarm-buster:isar-image-base"
 
+GPG_PUB_KEY_FILE="$HOME/.gnupg/my_pub.key"
 
 show_help() {
     echo "This script builds the default Isar images."
@@ -103,6 +104,9 @@ do
         ;;
     -r|--repro)
         REPRO_BUILD="1"
+        case "$2" in
+        -s|--sign) SIGN_REPO='1'; shift ;;
+        esac
         ;;
     *)
         echo "error: invalid parameter '$key', please try '--help' to get list of supported parameters"
@@ -113,6 +117,7 @@ do
     shift
 done
 
+
 # Setup build folder for the current build
 if [ ! -d "$BUILD_DIR" ]; then
         mkdir -p "$BUILD_DIR"
@@ -124,6 +129,9 @@ if [ -n "$CROSS_BUILD" ]; then
 fi
 
 if [ -n "$REPRO_BUILD" ]; then
+    if [ -n "$SIGN_REPO" ]; then
+        echo BASE_REPO_KEY=\"file://$GPG_PUB_KEY_FILE\" >> conf/local.conf
+    fi
     # Enable use of cached base repository
     bitbake $BB_ARGS -c cache_base_repo $REPRO_TARGETS_SET
     while [ -e bitbake.sock ]; do sleep 1; done
@@ -134,6 +142,9 @@ if [ -n "$REPRO_BUILD" ]; then
     # Cleanup and disable use of cached base repository
     sudo rm -rf tmp
     sed -i -e 's/ISAR_USE_CACHED_BASE_REPO ?= "1"/#ISAR_USE_CACHED_BASE_REPO ?= "1"/g' conf/local.conf
+    if [ -n "$SIGN_REPO" ]; then
+        sed -i -e 's/BASE_REPO_KEY/#BASE_REPO_KEY/g' conf/local.conf
+    fi
 fi
 
 # Start cross build for the defined set of configurations
-- 
2.11.0

[PATCH 2/2] doc/user_manual: Add reference to GPG tutorial

[Maxim Yu. Osipov]

Signed-off-by: Maxim Yu. Osipov <mosipov@isar-build.org>
---
 doc/user_manual.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/doc/user_manual.md b/doc/user_manual.md
index ed181aa..d8ada2c 100644
--- a/doc/user_manual.md
+++ b/doc/user_manual.md
@@ -780,7 +780,7 @@ Cache upstream debian packages to reduce time for further downloads and to be ab
  - Signing of local repo (optional)
 
 By default, the local caching repo is not gpg signed. If you want to share it in a trusted way, you may sign it.
-To do that, install `gpg` in your build environment, import the public and private keys,
+To do that, install `gpg` in your build environment, import the public and private keys (see [1] for details),
 and provide the path to the public key in `conf/local.conf`, e.g.:
 
 ```
@@ -851,3 +851,5 @@ And build the corresponding image target:
 ```
 bitbake multiconfig:qemuarm64-stretch:isar-image-base
 ```
+
+[1] GPG Turorial What is GPG?  https://theprivacyguide.org/tutorials/gpg.html
-- 
2.11.0

Re: [PATCH 1/2] ci_build: Add signing cached repo test

[Henning Schild]

Hi,

testing is always good but i guess we first need an implementation that
deals with passphrase protected keys and gpg-agent.

On Wed, 24 Jul 2019 22:33:02 +0200
"Maxim Yu. Osipov" <mosipov@ilbers.de> wrote:

> Signed-off-by: Maxim Yu. Osipov <mosipov@isar-build.org>
> ---
>  scripts/ci_build.sh | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/scripts/ci_build.sh b/scripts/ci_build.sh
> index 01f09b6..fcec14d 100755
> --- a/scripts/ci_build.sh
> +++ b/scripts/ci_build.sh
> @@ -50,6 +50,7 @@ REPRO_TARGETS_SET="\
>              multiconfig:qemuamd64-stretch:isar-image-base \
>              multiconfig:qemuarm-buster:isar-image-base"
>  
> +GPG_PUB_KEY_FILE="$HOME/.gnupg/my_pub.key"

This will not work. The test keys have to be part of the repo.

Henning

>  show_help() {
>      echo "This script builds the default Isar images."
> @@ -103,6 +104,9 @@ do
>          ;;
>      -r|--repro)
>          REPRO_BUILD="1"
> +        case "$2" in
> +        -s|--sign) SIGN_REPO='1'; shift ;;
> +        esac
>          ;;
>      *)
>          echo "error: invalid parameter '$key', please try '--help'
> to get list of supported parameters" @@ -113,6 +117,7 @@ do
>      shift
>  done
>  
> +
>  # Setup build folder for the current build
>  if [ ! -d "$BUILD_DIR" ]; then
>          mkdir -p "$BUILD_DIR"
> @@ -124,6 +129,9 @@ if [ -n "$CROSS_BUILD" ]; then
>  fi
>  
>  if [ -n "$REPRO_BUILD" ]; then
> +    if [ -n "$SIGN_REPO" ]; then
> +        echo BASE_REPO_KEY=\"file://$GPG_PUB_KEY_FILE\" >>
> conf/local.conf
> +    fi
>      # Enable use of cached base repository
>      bitbake $BB_ARGS -c cache_base_repo $REPRO_TARGETS_SET
>      while [ -e bitbake.sock ]; do sleep 1; done
> @@ -134,6 +142,9 @@ if [ -n "$REPRO_BUILD" ]; then
>      # Cleanup and disable use of cached base repository
>      sudo rm -rf tmp
>      sed -i -e 's/ISAR_USE_CACHED_BASE_REPO ?=
> "1"/#ISAR_USE_CACHED_BASE_REPO ?= "1"/g' conf/local.conf
> +    if [ -n "$SIGN_REPO" ]; then
> +        sed -i -e 's/BASE_REPO_KEY/#BASE_REPO_KEY/g' conf/local.conf
> +    fi
>  fi
>  
>  # Start cross build for the defined set of configurations

Re: [PATCH 1/2] ci_build: Add signing cached repo test

[Baurzhan Ismagulov]

On Thu, Jul 25, 2019 at 08:52:10AM +0200, Henning Schild wrote:
> testing is always good but i guess we first need an implementation that
> deals with passphrase protected keys and gpg-agent.

As protecting keys is an issue of downstream policy, I think testing the
unprotected case has value. An implementation supporting passphrases could add
a separate test case for that.

With kind regards,
Baurzhan.

Re: [PATCH 1/2] ci_build: Add signing cached repo test

[Baurzhan Ismagulov]

On Thu, Jul 25, 2019 at 08:52:10AM +0200, Henning Schild wrote:
> > +GPG_PUB_KEY_FILE="$HOME/.gnupg/my_pub.key"
> 
> This will not work. The test keys have to be part of the repo.

The current concept was to set up the key manually. I agree that setting up
automatically would be better.

With kind regards,
Baurzhan.