mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-13 00:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

gnupg: use native version for signing, rather than one provided by host

Browse Source 
Using host gpg has been problematic, and particularly this removes
the need to serialize package creation, as long as --auto-expand-secmem
is passed to gpg-agent, and gnupg >= 2.2.4 is in use
(https://dev.gnupg.org/T3530).

Sadly, gpg-agent itself is single-threaded, so in the longer run
we might want to seek alternatives:
https://lwn.net/Articles/742542/

(a smaller issue is that rpm itself runs the gpg fronted in a serial
fashion, which slows down the build in cases of recipes with very
large amount of packages, e.g. glibc-locale)

Note that sstate signing and verification continues to use host
gpg, as depending on native gpg would create circular dependencies.

[YOCTO #12022]

(From OE-Core rev: 08fef6198122fe79d4c1213f9a64b862162ed6cd)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Alexander Kanavin
2018-01-10 14:27:42 +02:00
committed by Richard Purdie
parent 0a732a9c66
commit 0f49d9182f
4 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
meta/classes/sign_package_feed.bbclass
View File

@@ -43,4 +43,4 @@ python () {
}
do_package_index[depends] += "signing-keys:do_deploy"
do_rootfs[depends] += "signing-keys:do_populate_sysroot"
do_rootfs[depends] += "signing-keys:do_populate_sysroot gnupg-native:do_populate_sysroot"

6
meta/classes/sign_rpm.bbclass
View File

@@ -68,8 +68,4 @@ python sign_rpm () {
do_package_index[depends] += "signing-keys:do_deploy"
do_rootfs[depends] += "signing-keys:do_populate_sysroot"
# Newer versions of gpg (at least 2.1.5 and 2.2.1) have issues when signing occurs in parallel
# so unfortunately the signing must be done serially. Once the upstream problem is fixed,
# the following line must be removed otherwise we loose all the intrinsic parallelism from
# bitbake. For more information, check https://bugzilla.yoctoproject.org/show_bug.cgi?id=12022.
do_package_write_rpm[lockfiles] += "${TMPDIR}/gpg.lock"
PACKAGE_WRITE_DEPS += "gnupg-native"