Signing package feeds will default to ascii armored signatures (ASC) the
other option being binary (BIN). This is for both rpm and ipk backends.
(From OE-Core rev: 862a3892feb2628282e1d6f2e4498a7a3bd60cbf)
Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Create gpg signed ipk package feeds using the gpg backend if configured
(From OE-Core rev: a2ee831cfb688bc64c071f75a1dff8a963abe287)
Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add support for multiple types of signatures (binary or ascii)
in export_pubkey(). There is no change in behaviour for the function,
the previous implicit default is the new parameter "armor" default.
(From OE-Core rev: 95ba4a982b887444908207e3180fe4bc46281d3b)
Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Starting from v2.1 passing passwords directly to gpg does not work
anymore [1], instead a loopback interface must be used otherwise
gpg >2.1 will error out with:
"gpg: signing failed: Inappropriate ioctl for device"
gpg <2.1 does not work with the new --pinentry-mode arg and gives an
invalid option error, so we detect what is the running version of gpg
and pass it accordingly.
[1] https://wiki.archlinux.org/index.php/GnuPG#Unattended_passphrase
(From OE-Core rev: 0413bd8e294ca8ac972ac68662b43a981952f5ae)
Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Implement ipk signing inside the sign_ipk bbclass using the gpg_sign
module and configure signing similar to how rpm does it. sign_ipk uses
gpg_sign's detach_sign because its functionality is identical to package
feed signing.
IPK signing process is a bit different from rpm:
- Signatures are stored outside ipk files; opkg connects to a feed
server and downloads them to verify a package.
- Signatures are of two types (both supported by opkg): binary or
ascii armoured. By default we sign using ascii armoured.
- Public keys are stored on targets to verify ipks using the
opkg-keyrings recipe.
(From OE-Core rev: a40f27aa7802e8a0bd87a5417e35adbface62d05)
Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently the recipe files are hardcoded and if the recipe
change the version, the test will fail.
This will change from using a harcoded file to look for the
file using bitbake-layers. Now, just the recipe name must
be specified.
(From OE-Core rev: 1ee24e435353d93374895eead81fb281e1338739)
Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently when using a git version the check for the stamp, using regex,
will fail because of plus sign in the version.
With this change the version is escaped before adding it to the regex.
(From OE-Core rev: 1aefa6a4dec84a5581aab70451bb84801b3b3615)
Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Rather than rolling all of an npm module's dependencies into the same
package, split them into one module per package, setting the SUMMARY and
PKGV values from the package.json file for each package. Additionally,
mark each package with the appropriate license using the license
scanning we already do, falling back to the license stated in the
package.json file for the module if unknown. All of this is mostly in
aid of ensuring all modules and their licenses now show up in the
manifests for the image.
Additionally we set the main LICENSE value more concretely once we've
calculated the per-package licenses, since we have more information at
that point.
(From OE-Core rev: 8226805f83d21e7c1d2ba21969f3e8ee4b137496)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
do_shared_workdir is not a proper sstate task, it always reruns if
needed, so special-case it in warnings when checking locked sigs.
(From OE-Core rev: 4b08f982a2b15bff9092f60f7957301bb2d2108b)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
meta/lib/oe/package_manager.py was also updated. This ensures that any
diagnostic messages are ignored from the output of rpmresolve.
The patches have been split into bug fixes (things that belong upstream)
and local changes that are OE specific.
The following patches are obsolete and have been removed:
rpm-remove-sykcparse-decl.patch
fstack-protector-configure-check.patch
rpm-disable-Wno-override-init.patch
rpm-lua-fix-print.patch
rpm-rpmpgp-fix.patch
verify-fix-broken-logic-for-ghost-avoidance-Mark-Hat.patch
(From OE-Core rev: ee97e53fcceabc6ef4ddc68f38c5fa0e05c5d9a8)
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Prelink contains some hardcoded assumptions about the path layout of
the target system. Unfortunately if the system doesn't match, prelink
doesn't work. This breaks:
a) prelink of those images
b) the unsafe-references-in-binaries QA test (which uses prelink-rtld)
One way to work around this is to construct an ld.so.conf file which
lists the library paths in question. We do this in sanity QA check and
in the rootfs prelink code, being careful not to trample any existing
target ld.so.conf.
There is an additional problem that $LIB references in RPATHs won't be
handled correctly, I've not see any system use these in reality though
so this change at least improves things.
(From OE-Core rev: 7fd1d7e639c2ed7e0699937a5cb245c187b7c811)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a build-sdk command which is only available within the extensible
SDK that builds a derivative extensible SDK. The idea is recipes in the
workspace become a part of the new SDK - for example, this allows taking
a vendor provided SDK, adding a few libs and then producing a new SDK
with those included.
When normally building the extensible SDK, the workspace is excluded;
here we need to copy into the new SDK (renaming it in the process); the
recipes' task signatures become locked and thus the sources are no
longer needed, so they are removed along with the workspace bbappends
which would interfere with the locked signatures. Additionally we need
to just copy the configuration files (i.e. local.conf and auto.conf)
rather than filtering and appending to them since that work has already
been done when constructing the original SDK. The extra sstate artifacts
from workspace recipes are also determined and copied into the new SDK
in minimal mode (on the assumption that you won't set up a new sstate
mirror).
This reuses some code from build-image, so that needed to be
generalised to allow that.
Implements [YOCTO #8892].
(From OE-Core rev: 59e207ff6dd4b50a8905e14bc9292cf2794f4e7a)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixing one of the recipes not to contain unsafe references to paths
results in this QA test failing. Improve the test so that we test
the recipe works, then if we intentionally break the recipe, the
issue is detected.
Also split out the binaries test from the scripts test. The binaries
issue may also get 'fixed' in future and need the same fix.
(From OE-Core rev: 68db200ca5b404d6c0aa0cbf5a587397d0aa65da)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Testing of local sdk updates was commented out.
Local sdk updates are functional now, so the tests should be re-enabled.
(From OE-Core rev: 0bc7cd0bd10f79907c4f41676801a113fb3df8a3)
Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The SDKUpdateTest class test devtool sdk-update mechanism inside
eSDK.
The SDKUpdateTest class search for new sdk if not found uses
the main one then it publish the eSDK into known folder
inside work and it starts a web server for serve the eSDK.
Finally it executes sdk-update over http, the local test is
commented due to bug [1].
[1] https://bugzilla.yoctoproject.org/show_bug.cgi?id=9043
[YOCTO #9089]
(From OE-Core rev: be7f5036a7c86fe70d43526df529bc467a9cf7d9)
Signed-off-by: Aníbal Limón <limon.anibal@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
tcname is needed for eSDK update testcase will be used for
publish it and then try to update
(From OE-Core rev: a75944a63482597be88ff0f3ce55025647b78e2c)
Signed-off-by: Aníbal Limón <limon.anibal@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The removal of bitbake and scripts PATH is only needed by eSDK tests
so move to eSDK context only.
This also it's a support for eSDK update test because it needs to
execute oe-publish-sdk from scripts.
(From OE-Core rev: 4ae0c84568f39661722cbceba8ddab22cffe5003)
Signed-off-by: Aníbal Limón <limon.anibal@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a test for devtool upgrade with a recipe pointing to a git
repository, since this uses several different code paths.
(From OE-Core rev: d3ec74ff4db248ea11a568d5214708d6a1757012)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Use a more real-world test of a recipe pointing to a remote file
* The cleanup tracking / teardown commands need to be added towards the
top, or they won't have the desired effect of cleaning up if the test
fails.
* Check that a versioned subdirectory gets renamed to match the new
version
* Ensure the recipe contents gets changed as we expect it to
* Check that the recipe directory is deleted by devtool reset at the end
(From OE-Core rev: d0ae258e963f9bafffc4ca43c87497d27e57c127)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Moved an error to common, and whitelisted the BAR errors
and ati module. Also the uvesafb related errors will be
ignored in LSB images which do not have graphic interface.
Fix for [YOCTO #8387]
Fix for [YOCTO #8590]
Fix for [YOCTO #6820]
Fix for [YOCTO #7897]
(From OE-Core rev: 4e59b6f66eeae256d4e62f4741725cdebb53cbf7)
Signed-off-by: Lucian Musat <george.l.musat at intel.com>
Signed-off-by: Cristina Agurida <cristina-danielax.agurida@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This test case validates if prservice start and stop properly the server.
Using bitbake commands also validates the exit status.
[YOCTO #8258]
(From OE-Core rev: 5125dd2a5c2e382c47ddeaf0327fc7dc39482023)
Signed-off-by: Francisco Pedraza <francisco.j.pedraza.gonzalez@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A network module was added, and will contain network utility funcions for now.
with get_free_port that returns available network port in the system.
(From OE-Core rev: 72b336ad0d0a2994f00c57747686111a59fa8b29)
Signed-off-by: Francisco Pedraza <francisco.j.pedraza.gonzalez@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Previously the keys were put into the os-release package. The package
indexing code was also deploying the keys rather than only using the keys.
This change makes signing-keys.bb the only publisher of the keys and also
uses standard tasks that already have sstate.
(From OE-Core rev: 1e38068ac38dfd067655dfd41464e28439179306)
Signed-off-by: Randy Witt <randy.e.witt@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When checking enabling buildhistory doesn't change anything but rootfs stamps,
just build core-image-minimal instead of -sato to reduce the time this test
takes.
(From OE-Core rev: e9b44579007cbaa24c6b39ff788be3a927797660)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Refactor the LocalSigner class. Do not store keyid or passphrase file in
the signer object as they are only needed for some of the methods. For
example, the newly added verify() method does not need any key
parameters and export_pubkey only uses keyid.
(From OE-Core rev: e2412294b6b1d3a80ee97a0706613349edc51d33)
Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bitbake option to restore from sstate only within a build
(i.e. execute no real tasks, only setscene)
fix for [YOCTO #8876]
(From OE-Core rev: 3821aee0129b87a859b3a540b82745fdae184721)
Signed-off-by: Daniel Istrate <daniel.alexandrux.istrate@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of raising a generic Exception that can't be handled specifically, raise
a ValueError. Also update the callers so any unexpected exceptions are not
ignored.
Also, rename isBigEngian() to isBigEndian().
(From OE-Core rev: c136652f9c0b35aafa393e63567daf029ae03929)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When opening an ELF file check that a filename points to a normal file before
attempting to open it, as if the file turns out to be something more exotic like
a FIFO it could hang forever.
(From OE-Core rev: 4b3576bc30d8f8cdcde25189def8b059fc92b27c)
(From OE-Core rev: d3af2058e2753516b9aaf7f6d71162363eea11d4)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
boot time string can change its format of the output of the amount of time
it took to boot. It is required to handle graceful fail of the parsing
errors that it provokes
[YOCTO #8889]
(From OE-Core rev: d17f5079594cd74014f29054f9ad4f38c7ef03d8)
Signed-off-by: Benjamin Esquivel <benjamin.esquivel@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With the addition of the task name to recipe output, the sanity tests
need updates where they are looking for specific messages.
(From OE-Core rev: 0f2ef4304e6a6f18b4ed13f59000b4a1daa35f6b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Image should be build usual way, i.e. using bitbake <image>.
Specifying do_mage_complete and do_rootfs_wicenv tasks should not
be needed anymore as those tasks should be run by bitbake for
every image.
Removed specifying do_mage_complete and do_rootfs_wicenv tasks
from bitbake calls.
(From OE-Core rev: d8d7bd1b41eb846f18378a2581ff172cb2cc52b8)
(From OE-Core rev: 00cd291605ff5f001979b350d95670e33012fdc9)
Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Added test_qemu testcase to boot wic-image-minimal and test
that 2 partitions mentioned in .wks are mounted.
[YOCTO #8499]
(From OE-Core rev: 6fb015d0847fe7d259d654d4a99bf4c328f810ab)
(From OE-Core rev: be360c24649391235fd9547a8f2c1251b12e9c81)
Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Replaced wic.bz2 -> wic in the recipe.
Replaced wic.bz2 -> wic in oe-selftest test case.
wic-image-minimal is going to be booted in qemu and tested.
As runqemu doesn't support compressed images this recipe needs
to produce raw wic image.
(From OE-Core rev: 3ce91db94f4b921566dce0dc6f91a422009be06b)
(From OE-Core rev: 69d8dfe4fc1fec440e33b1bb6cef62e20f1f5c28)
Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Added 'wic' to the list image types supported by targetcontrol.
This is a preparation for booting and testing wic images
with oe-selftest.
[YOCTO #8498]
(From OE-Core rev: 7dda053fbd1ea1354b7720cfa691470ba88ef5b9)
(From OE-Core rev: 4b84328d3cd0d87ad146f034b58f68a5158313d7)
Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Added new parameter 'ssh' to targetcontrol 'start' method
to be able to test images without running ssh server.
[YOCTO #8498]
(From OE-Core rev: 1c3c66aadd43092bc19242b0651ee810cc31fe7c)
(From OE-Core rev: 67ccf7413b2ac9f516dbdaa6a39d4cec38a6c94d)
Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
QemuRunner requires pair of ip addresses provided through kernel
commandline for method 'start' to work. These ip addresses are
used to connect to the image using ssh and run tests there.
However, this functionality should not be mandatory as testing
doesn't always require ssh connection. Some tests can be run using
serial console.
Added new parameter 'get_ip' to QemuRunner.start to make it possible
to skip getting pair of ip addresses from kernel command line. This
should allow oe-selftest to test images without modifying kernel
command line.
[YOCTO #8498]
(From OE-Core rev: 3f8b734ebb81d035849288091bb0b97b9c4fba34)
(From OE-Core rev: 4c90daaeb946f1adf58b2f71f1af8eb7f5906474)
Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It seems that if the --workdir option is not set konsole does open in the users
home directory. By setting --workdir . konsole opens in the recipes work
directory. This is the same behavior as observed for other consoles.
(Tested with Konsole 2.14.2 on Debian Jessie).
(From OE-Core rev: bd06944249c3de3f629c013e14f446464441c4da)
Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a test so we validate the following recently implemented/fixed
aspects of "devtool add":
* Adding from a local directory with no name specified
* Auto-detecting the name and version from autoconf files
* Setting SRC_URI and S from the local git repo
* Showing the recipe file path in "devtool status" if it has been
created within the workspace
Incidentally also tests:
* LICENSE and LIC_FILES_CHKSUM detection (though just for this piece of
software)
* Extracting a dependency from autoconf (though just for this narrow
case since there's only one)
(From OE-Core rev: d991fe7f17861dc5c21f7eac30d8c912b4d5dbed)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It's going to be more common for users not to have the prepared source
tree for a recipe already, so the default behaviour ought to be to
extract it for them from the recipe. Change the default to extract
(effectively making the -x option a no-op) and add a --no-extract/-n
option to disable it. Later we can look at trying to be smart and
reusing an existing source tree instead of erroring out if it exists;
for now this is just the default reversal.
(From OE-Core rev: 80a44e52609a89d9ffe816181ae193af491c06ac)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When extracting source for a recipe, if there are additional custom
tasks run that make changes to the source, create a commit in the
generated git branch so they are contained. This is particularly
useful for tasks that come before do_patch since otherwise the changes
might get incorporated in the first applied patch, but otherwise it
helps avoid the tree being dirty at any point.
Fixes [YOCTO #7626].
(From OE-Core rev: 997a77d9b20af1778b804778e5d8c8a7424f7582)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
