Re: [PATCH v2] base-apt: Use gpg keyid instead of yes

[Vijai Kumar K <vijaikumar.kanagarajan@gmail.com>]

On Tue, Oct 15, 2019 at 02:19:36AM -0700, vijai kumar wrote:

If there are no more review comments, can this be merged to next?

Thanks,
Vijai Kumar K

> This v2 is also rebased on top of current next. Forgot to mention that.
> 
> Thanks,
> Vijai Kumar K
> 
> On Tuesday, October 15, 2019 at 2:47:55 PM UTC+5:30, vijai kumar wrote:
> >
> > From: Vijai Kumar K <Vijaikumar_Kanagarajan@mentor.com> 
> >
> > When using "SignWith: yes", reprepro uses the default gpg key 
> > of the system to sign the repo. The default gpg key might be 
> > different from what is specified in BASE_REPO_KEY, resulting 
> > in using a wrong key for signing. 
> >
> > Derive and use the keyid from the keyfile supplied instead of 
> > a generic yes option. 
> >
> > Suggested-by: Amy Fong <Amy_Fong@mentor.com> 
> > Signed-off-by: Vijai Kumar K <Vijaikumar_Kanagarajan@mentor.com> 
> > --- 
> > Changes in v2: 
> > - Address review comments from Henning. 
> >
> >  meta/recipes-devtools/base-apt/base-apt.bb | 22 +++++++++++++++++++--- 
> >  1 file changed, 19 insertions(+), 3 deletions(-) 
> >
> > diff --git a/meta/recipes-devtools/base-apt/base-apt.bb 
> > b/meta/recipes-devtools/base-apt/base-apt.bb 
> > index 6acd6e7..42ff782 100644 
> > --- a/meta/recipes-devtools/base-apt/base-apt.bb 
> > +++ b/meta/recipes-devtools/base-apt/base-apt.bb 
> > @@ -4,6 +4,7 @@ 
> >  SRC_URI = "file://distributions.in" 
> >   
> >  BASE_REPO_KEY ?= "" 
> > +KEYFILES ?= "" 
> >   
> >  CACHE_CONF_DIR = "${REPO_BASE_DIR}/${BASE_DISTRO}/conf" 
> >  do_cache_config[dirs] = "${CACHE_CONF_DIR}" 
> > @@ -12,13 +13,18 @@ do_cache_config[lockfiles] = 
> > "${REPO_BASE_DIR}/isar.lock" 
> >   
> >  # Generate reprepro config for current distro if it doesn't exist. Once 
> > it's 
> >  # generated, this task should do nothing. 
> > -do_cache_config() { 
> > +repo_config() { 
> >      if [ ! -e "${CACHE_CONF_DIR}/distributions" ]; then 
> >          sed -e "s#{CODENAME}#"${BASE_DISTRO_CODENAME}"#g" \ 
> >              ${WORKDIR}/distributions.in > 
> > ${CACHE_CONF_DIR}/distributions 
> > -        if [ "${BASE_REPO_KEY}" ] ; then 
> > +        if [ -n "${KEYFILES}" ]; then 
> > +            option="" 
> > +            for key in ${KEYFILES}; do 
> > +                keyid=$(gpg --keyid-format 0xlong --with-colons ${key} 
> > 2>/dev/null | grep "^pub:" | awk -F':' '{print $5;}') 
> > +                option="${option}${keyid} " 
> > +            done 
> >              # To generate Release.gpg 
> > -            echo "SignWith: yes" >> ${CACHE_CONF_DIR}/distributions 
> > +            echo "SignWith: ${option}" >> ${CACHE_CONF_DIR}/distributions 
> >          fi 
> >      fi 
> >   
> > @@ -35,4 +41,14 @@ do_cache_config() { 
> >      fi 
> >  } 
> >   
> > +python do_cache_config() { 
> > +    for key in d.getVar('BASE_REPO_KEY').split(): 
> > +        d.appendVar("SRC_URI", " %s" % key) 
> > +        fetcher = bb.fetch2.Fetch([key], d) 
> > +        filename = fetcher.localpath(key) 
> > +        d.appendVar("KEYFILES", " %s" % filename) 
> > + 
> > +    bb.build.exec_func('repo_config', d) 
> > +} 
> > + 
> >  addtask cache_config after do_unpack before do_build 
> > -- 
> > 2.17.1 
> >
> >
> 
> -- 
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/isar-users/c20121db-766f-49e2-b64b-d25761d4f1bb%40googlegroups.com.