]> code.ossystems Code Review - openembedded-core.git/commit
gnupg: use native version for signing, rather than one provided by host
authorAlexander Kanavin <alexander.kanavin@linux.intel.com>
Wed, 10 Jan 2018 12:27:42 +0000 (14:27 +0200)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Sat, 24 Nov 2018 22:01:35 +0000 (22:01 +0000)
commitd449179eaf3cc25fdf6757342e9f95562a84696f
tree64e6e3f215b6d2bc88c69cce93dc7647fb78380e
parent143545237080138f4bbfe82830d4dd4ac5d53409
gnupg: use native version for signing, rather than one provided by host

Using host gpg has been problematic, and particularly this removes
the need to serialize package creation, as long as --auto-expand-secmem
is passed to gpg-agent, and gnupg >= 2.2.4 is in use
(https://dev.gnupg.org/T3530).

Sadly, gpg-agent itself is single-threaded, so in the longer run
we might want to seek alternatives:
https://lwn.net/Articles/742542/

(a smaller issue is that rpm itself runs the gpg fronted in a serial
fashion, which slows down the build in cases of recipes with very
large amount of packages, e.g. glibc-locale)

Note that sstate signing and verification continues to use host
gpg, as depending on native gpg would create circular dependencies.

[YOCTO #12022]

(From OE-Core rev: 08fef6198122fe79d4c1213f9a64b862162ed6cd)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
meta/classes/sign_package_feed.bbclass
meta/classes/sign_rpm.bbclass
meta/lib/oe/gpg_sign.py
meta/recipes-core/meta/signing-keys.bb