From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6741460933745311744 Date: Tue, 15 Oct 2019 02:19:36 -0700 (PDT) From: vijai kumar To: isar-users Message-Id: In-Reply-To: <20191015091723.14793-1-Vijaikumar_Kangarajan@mentor.com> References: <20191014183845.095f7182@md1za8fc.ad001.siemens.net> <20191015091723.14793-1-Vijaikumar_Kangarajan@mentor.com> Subject: Re: [PATCH v2] base-apt: Use gpg keyid instead of yes MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_4356_971861140.1571131177063" X-Google-Token: EKielu0FgAowEi0123I0 X-Google-IP: 139.181.36.34 X-TUID: ZaLEQMEKc8Cb ------=_Part_4356_971861140.1571131177063 Content-Type: multipart/alternative; boundary="----=_Part_4357_804571292.1571131177063" ------=_Part_4357_804571292.1571131177063 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit This v2 is also rebased on top of current next. Forgot to mention that. Thanks, Vijai Kumar K On Tuesday, October 15, 2019 at 2:47:55 PM UTC+5:30, vijai kumar wrote: > > From: Vijai Kumar K > > When using "SignWith: yes", reprepro uses the default gpg key > of the system to sign the repo. The default gpg key might be > different from what is specified in BASE_REPO_KEY, resulting > in using a wrong key for signing. > > Derive and use the keyid from the keyfile supplied instead of > a generic yes option. > > Suggested-by: Amy Fong > Signed-off-by: Vijai Kumar K > --- > Changes in v2: > - Address review comments from Henning. > > meta/recipes-devtools/base-apt/base-apt.bb | 22 +++++++++++++++++++--- > 1 file changed, 19 insertions(+), 3 deletions(-) > > diff --git a/meta/recipes-devtools/base-apt/base-apt.bb > b/meta/recipes-devtools/base-apt/base-apt.bb > index 6acd6e7..42ff782 100644 > --- a/meta/recipes-devtools/base-apt/base-apt.bb > +++ b/meta/recipes-devtools/base-apt/base-apt.bb > @@ -4,6 +4,7 @@ > SRC_URI = "file://distributions.in" > > BASE_REPO_KEY ?= "" > +KEYFILES ?= "" > > CACHE_CONF_DIR = "${REPO_BASE_DIR}/${BASE_DISTRO}/conf" > do_cache_config[dirs] = "${CACHE_CONF_DIR}" > @@ -12,13 +13,18 @@ do_cache_config[lockfiles] = > "${REPO_BASE_DIR}/isar.lock" > > # Generate reprepro config for current distro if it doesn't exist. Once > it's > # generated, this task should do nothing. > -do_cache_config() { > +repo_config() { > if [ ! -e "${CACHE_CONF_DIR}/distributions" ]; then > sed -e "s#{CODENAME}#"${BASE_DISTRO_CODENAME}"#g" \ > ${WORKDIR}/distributions.in > > ${CACHE_CONF_DIR}/distributions > - if [ "${BASE_REPO_KEY}" ] ; then > + if [ -n "${KEYFILES}" ]; then > + option="" > + for key in ${KEYFILES}; do > + keyid=$(gpg --keyid-format 0xlong --with-colons ${key} > 2>/dev/null | grep "^pub:" | awk -F':' '{print $5;}') > + option="${option}${keyid} " > + done > # To generate Release.gpg > - echo "SignWith: yes" >> ${CACHE_CONF_DIR}/distributions > + echo "SignWith: ${option}" >> ${CACHE_CONF_DIR}/distributions > fi > fi > > @@ -35,4 +41,14 @@ do_cache_config() { > fi > } > > +python do_cache_config() { > + for key in d.getVar('BASE_REPO_KEY').split(): > + d.appendVar("SRC_URI", " %s" % key) > + fetcher = bb.fetch2.Fetch([key], d) > + filename = fetcher.localpath(key) > + d.appendVar("KEYFILES", " %s" % filename) > + > + bb.build.exec_func('repo_config', d) > +} > + > addtask cache_config after do_unpack before do_build > -- > 2.17.1 > > ------=_Part_4357_804571292.1571131177063 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
This v2 is also rebased on top of current next. Forgot to = mention that.

Thanks,
Vijai Kumar K

On = Tuesday, October 15, 2019 at 2:47:55 PM UTC+5:30, vijai kumar wrote:From: Vijai Kumar K <Vijaikumar_Kanagarajan@mentor.com>= ;

When using "SignWith: yes", reprepro uses the default gpg key
of the system to sign the repo. The default gpg key might be
different from what is specified in BASE_REPO_KEY, resulting
in using a wrong key for signing.

Derive and use the keyid from the keyfile supplied instead of
a generic yes option.

Suggested-by: Amy Fong <Amy_Fong@mentor.com>
Signed-off-by: Vijai Kumar K <Vijaikumar_Kanagarajan@mentor.com>
---
Changes in v2:
- Address review comments from Henning.

=C2=A0meta/recipes-devtools/base-apt/base-apt.bb | 22 +++++++++++++++++++---
=C2=A01 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-devtools/base-apt/base-apt.bb b/meta/recipes-devtools/base-apt/base-apt.bb
index 6acd6e7..42ff782 100644
--- a/meta/recipes-devtools/base-apt/base-apt.bb
+++ b/meta/recipes-devtools/base-apt/base-apt.bb
@@ -4,6 +4,7 @@
=C2=A0SRC_URI =3D "file://distributions.in"
=C2=A0
=C2=A0BASE_REPO_KEY ?=3D ""
+KEYFILES ?=3D ""
=C2=A0
=C2=A0CACHE_CONF_DIR =3D "${REPO_BASE_DIR}/${BASE_DISTRO}/con= f"
=C2=A0do_cache_config[dirs] =3D "${CACHE_CONF_DIR}"
@@ -12,13 +13,18 @@ do_cache_config[lockfiles] =3D "${REPO_BASE_DI= R}/isar.lock"
=C2=A0
=C2=A0# Generate reprepro config for current distro if it doesn't e= xist. Once it's
=C2=A0# generated, this task should do nothing.
-do_cache_config() {
+repo_config() {
=C2=A0 =C2=A0 =C2=A0if [ ! -e "${CACHE_CONF_DIR}/distribution= s" ]; then
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sed -e "s#{CODENAME}#"${BAS= E_DISTRO_CODENAME}"#g" \
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0${WORKDIR}/distributions.in > ${CACHE= _CONF_DIR}/distributions
- =C2=A0 =C2=A0 =C2=A0 =C2=A0if [ "${BASE_REPO_KEY}" ] ; then
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0if [ -n "${KEYFILES}" ]; then
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0option=3D""
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0for key in ${KEYFILES}; do
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0keyid=3D$(gpg = --keyid-format 0xlong --with-colons ${key} 2>/dev/null | grep "^pub= :" | awk -F':' '{print $5;}')
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0option=3D"= ;${option}${keyid} "
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0done
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0# To generate Release.g= pg
- =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0echo "SignWith: yes&quo= t; >> ${CACHE_CONF_DIR}/distributions
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0echo "SignWith: ${optio= n}" >> ${CACHE_CONF_DIR}/distributions
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0fi
=C2=A0 =C2=A0 =C2=A0fi
=C2=A0
@@ -35,4 +41,14 @@ do_cache_config() {
=C2=A0 =C2=A0 =C2=A0fi
=C2=A0}
=C2=A0
+python do_cache_config() {
+ =C2=A0 =C2=A0for key in d.getVar('BASE_REPO_KEY').split(= ):
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0d.appendVar("SRC_URI", " %s= " % key)
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0fetcher =3D bb.fetch2.Fetch([key], d)
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0filename =3D fetcher.localpath(key)
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0d.appendVar("KEYFILES", " %= s" % filename)
+
+ =C2=A0 =C2=A0bb.build.exec_func('repo_config', d)
+}
+
=C2=A0addtask cache_config after do_unpack before do_build
--=20
2.17.1

------=_Part_4357_804571292.1571131177063-- ------=_Part_4356_971861140.1571131177063--