public inbox for isar-users@googlegroups.com
 help / color / mirror / Atom feed
* [PATCH] base-apt: Use gpg keyid instead of yes
@ 2019-09-27 21:11 vijaikumar.kanagarajan
  2019-09-30  6:17 ` Jan Kiszka
  0 siblings, 1 reply; 14+ messages in thread
From: vijaikumar.kanagarajan @ 2019-09-27 21:11 UTC (permalink / raw)
  To: isar-users, henning.schild, claudius.heine.ext
  Cc: jan.kiszka, Amy_Fong, Vijai Kumar K

From: Vijai Kumar K <Vijaikumar_Kanagarajan@mentor.com>

When using "SignWith: yes", reprepro uses the default gpg key
of the system to sign the repo. The default gpg key might be
different from what is specified in BASE_REPO_KEY, resulting
in using a wrong key for signing.

Derive and use the keyid from the keyfile supplied instead of
a generic yes option.

Suggested-by: Amy Fong <Amy_Fong@mentor.com>
Signed-off-by: Vijai Kumar K <Vijaikumar_Kanagarajan@mentor.com>
---
 meta/recipes-devtools/base-apt/base-apt.bb | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-devtools/base-apt/base-apt.bb b/meta/recipes-devtools/base-apt/base-apt.bb
index 74189f1..c74be86 100644
--- a/meta/recipes-devtools/base-apt/base-apt.bb
+++ b/meta/recipes-devtools/base-apt/base-apt.bb
@@ -4,6 +4,7 @@
 SRC_URI = "file://distributions.in"
 
 BASE_REPO_KEY ?= ""
+KEYFILES ?= ""
 
 CACHE_CONF_DIR = "${REPO_BASE_DIR}/${BASE_DISTRO}/conf"
 do_cache_config[dirs] = "${CACHE_CONF_DIR}"
@@ -12,13 +13,18 @@ do_cache_config[lockfiles] = "${REPO_BASE_DIR}/isar.lock"
 
 # Generate reprepro config for current distro if it doesn't exist. Once it's
 # generated, this task should do nothing.
-do_cache_config() {
+repo_config() {
     if [ ! -e "${CACHE_CONF_DIR}/distributions" ]; then
         sed -e "s#{CODENAME}#"${BASE_DISTRO_CODENAME}"#g" \
             ${WORKDIR}/distributions.in > ${CACHE_CONF_DIR}/distributions
-        if [ "${BASE_REPO_KEY}" ] ; then
+        if [ -n "${KEYFILES}" ]; then
+            option=""
+            for key in ${KEYFILES}; do
+                keyid=$(cat ${key} | gpg --keyid-format 0xlong --with-colons - 2>/dev/null |grep "^pub:" |awk -F':' '{print $5;}')
+                option="${option}${keyid} "
+            done
             # To generate Release.gpg
-            echo "SignWith: yes" >> ${CACHE_CONF_DIR}/distributions
+            echo "SignWith: ${option}" >> ${CACHE_CONF_DIR}/distributions
         fi
     fi
 
@@ -35,4 +41,14 @@ do_cache_config() {
     fi
 }
 
+python do_cache_config() {
+    for key in d.getVar('BASE_REPO_KEY').split():
+        d.appendVar("SRC_URI", " %s" % key)
+        fetcher = bb.fetch2.Fetch([key], d)
+        filename = fetcher.localpath(key)
+        d.appendVar("KEYFILES", " %s" % filename)
+
+    bb.build.exec_func('repo_config', d)
+}
+
 addtask cache_config after do_build
-- 
2.17.1


^ permalink raw reply	[flat|nested] 14+ messages in thread
end of thread, other threads:[~2019-11-19 16:41 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-27 21:11 [PATCH] base-apt: Use gpg keyid instead of yes vijaikumar.kanagarajan
2019-09-30  6:17 ` Jan Kiszka
2019-09-30  8:42   ` Vijai Kumar K
2019-09-30  8:51     ` vijai kumar
2019-10-14 16:38   ` Henning Schild
2019-10-15  9:17     ` [PATCH v2] " vijaikumar.kanagarajan
2019-10-15  9:19       ` vijai kumar
2019-10-23  7:24         ` Vijai Kumar K
2019-11-02 15:57       ` Baurzhan Ismagulov
2019-11-02 16:37         ` vijai kumar
2019-11-05 10:33           ` [PATCH] meta/base-apt: Fix build issue with CI vijaikumar.kanagarajan
2019-11-05 18:10             ` vijai kumar
2019-11-19 16:41             ` Baurzhan Ismagulov
2019-11-19 16:40       ` [PATCH v2] base-apt: Use gpg keyid instead of yes Baurzhan Ismagulov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox