package_manager: support for signed DEB package feeds

package_manager: support for signed DEB package feeds

[Ferry Toth]

[PATCH v3 1/1] apt: add apt selftest to test signed package feeds

Since Gatesgarth apt (1.8.2) has become more strict and doesn’t allow unsigned repositories by default.
Currently when building images this requirement is worked around by using [allow-insecure=yes] and
equivalently when performing selftest.
    
Patches "gpg-sign: Add parameters to gpg signature function" and "package_manager: sign deb package feeds"
(in master) enabled signed deb package feeds. 

This patch adds a runtime test for apt derived from the test_testimage_dnf test. When called from 
`oe-selftest -r runtime_test.TestImage.test_testimage_apt` it creates a signed deb package feed, 
runs a qemu image to install the key and performs some package management. To be able to install 
the key the gnupg package is added to the testimage.

Changes in V3:
 - Changed to original behavior when called from `bitbake core-image-sato -c testimage` and no 
   signed feed was created (Richard Purdie)

Changes in V2:
 - Added runtime test for signed deb package feeds (Richard Purdie)

Re: package_manager: support for signed DEB package feeds

[Ferry Toth]

Hi,

Op 19-04-2022 om 15:21 schreef Richard Purdie:
> On Wed, 2022-04-13 at 22:37 +0200, Ferry Toth wrote:
>> [PATCH v4 1/2] apt: add apt selftest to test signed package feeds
>> [PATCH v4 2/2] package_manager: fix missing dependency on gnupg when
>>
>> Since Gatesgarth apt (1.8.2) has become more strict and doesn’t allow unsigned repositories by default.
>> Currently when building images this requirement is worked around by using [allow-insecure=yes] and
>> equivalently when performing selftest.
>>      
>> Patches "gpg-sign: Add parameters to gpg signature function" and "package_manager: sign deb package feeds"
>> (already in master) enable signed deb package feeds. When called from
>> `oe-selftest -r runtime_test.TestImage.test_testimage_apt` this patch adds a runtime test for apt
>> derived from the test_testimage_dnf test. It creates a signed deb package feed, runs a qemu
>> image to install the key and performs some package management. To be able to install the key
>> the gnupg package is added to the testimage.
>>
>> Changes in V4:
>>   - Add fix to make gnupg-native a dependency else hosttools is used and
>>     `oe-selftest -r runtime_test.TestImage.test_testimage_apt` fails on Ubuntu 16.04 used
>>     on the autobuilder (Alexandre Belloni)
>>
>> Changes in V3:
>>   - When called from `bitbake core-image-sato -c testimage` package feed is unsigned. Auto-detect
>>     this case and behave as before (Richard Purdie)
>>
>> Changes in V2:
>>   - Added runtime test for signed deb package feeds (Richard Purdie)
> 
> This has now merged, thanks for working through the details with this! The test
> should allow the functionality to stay working and is extremely useful/helpful.
I watched it go through the CI bots and I must say I'm impressed with 
the process. Thanks for guiding me through this and merging.

> Cheers,
> 
> Richard
> 

Re: package_manager: support for signed DEB package feeds

[Richard Purdie]

On Wed, 2022-04-13 at 22:37 +0200, Ferry Toth wrote:
> [PATCH v4 1/2] apt: add apt selftest to test signed package feeds
> [PATCH v4 2/2] package_manager: fix missing dependency on gnupg when
> 
> Since Gatesgarth apt (1.8.2) has become more strict and doesn’t allow unsigned repositories by default.
> Currently when building images this requirement is worked around by using [allow-insecure=yes] and
> equivalently when performing selftest.
>     
> Patches "gpg-sign: Add parameters to gpg signature function" and "package_manager: sign deb package feeds"
> (already in master) enable signed deb package feeds. When called from 
> `oe-selftest -r runtime_test.TestImage.test_testimage_apt` this patch adds a runtime test for apt 
> derived from the test_testimage_dnf test. It creates a signed deb package feed, runs a qemu 
> image to install the key and performs some package management. To be able to install the key
> the gnupg package is added to the testimage.
> 
> Changes in V4:
>  - Add fix to make gnupg-native a dependency else hosttools is used and 
>    `oe-selftest -r runtime_test.TestImage.test_testimage_apt` fails on Ubuntu 16.04 used 
>    on the autobuilder (Alexandre Belloni)
> 
> Changes in V3:
>  - When called from `bitbake core-image-sato -c testimage` package feed is unsigned. Auto-detect
>    this case and behave as before (Richard Purdie)
> 
> Changes in V2:
>  - Added runtime test for signed deb package feeds (Richard Purdie)

This has now merged, thanks for working through the details with this! The test
should allow the functionality to stay working and is extremely useful/helpful.

Cheers,

Richard

package_manager: support for signed DEB package feeds

[Ferry Toth]

[PATCH v4 1/2] apt: add apt selftest to test signed package feeds
[PATCH v4 2/2] package_manager: fix missing dependency on gnupg when

Since Gatesgarth apt (1.8.2) has become more strict and doesn’t allow unsigned repositories by default.
Currently when building images this requirement is worked around by using [allow-insecure=yes] and
equivalently when performing selftest.
    
Patches "gpg-sign: Add parameters to gpg signature function" and "package_manager: sign deb package feeds"
(already in master) enable signed deb package feeds. When called from 
`oe-selftest -r runtime_test.TestImage.test_testimage_apt` this patch adds a runtime test for apt 
derived from the test_testimage_dnf test. It creates a signed deb package feed, runs a qemu 
image to install the key and performs some package management. To be able to install the key
the gnupg package is added to the testimage.

Changes in V4:
 - Add fix to make gnupg-native a dependency else hosttools is used and 
   `oe-selftest -r runtime_test.TestImage.test_testimage_apt` fails on Ubuntu 16.04 used 
   on the autobuilder (Alexandre Belloni)

Changes in V3:
 - When called from `bitbake core-image-sato -c testimage` package feed is unsigned. Auto-detect
   this case and behave as before (Richard Purdie)

Changes in V2:
 - Added runtime test for signed deb package feeds (Richard Purdie)

package_manager: support for signed DEB package feeds

[Ferry Toth]

[PATCH v3 1/1] apt: add apt selftest to test signed package feeds

Since Gatesgarth apt (1.8.2) has become more strict and doesn’t allow unsigned repositories by default.
Currently when building images this requirement is worked around by using [allow-insecure=yes] and
equivalently when performing selftest.
    
Patches "gpg-sign: Add parameters to gpg signature function" and "package_manager: sign deb package feeds"
(already in master) enable signed deb package feeds. When called from 
`oe-selftest -r runtime_test.TestImage.test_testimage_apt` this patch adds a runtime test for apt 
derived from the  test_testimage_dnf test. It creates a signed deb package feed, runs a qemu 
image to install the key and performs some package management. To be able to install the key
the gnupg package is added to the testimage.

Changes in V3:
 - When called from `bitbake core-image-sato -c testimage` package feed is unsigned. Auto-detect
   this case and behave as before (Richard Purdie)

Changes in V2:
 - Added runtime test for signed deb package feeds (Richard Purdie)

package_manager: support for signed DEB package feeds

[Ferry Toth]

[PATCH v2 0/3] package_manager: support for signed DEB package feeds
[PATCH v2 1/3] gpg-sign: Add parameters to gpg signature function
[PATCH v2 2/3] package_manager: sign DEB package feeds
[PATCH v2 3/3] apt: add apt selftest to test signed package feeds

Since Gatesgarth apt (1.8.2) has become more strict and doesn’t allow unsigned repositories by default.
Currently when building images this requirement is worked around by using [allow-insecure=yes] and
equivalently when performing selftest.
    
Patches "gpg-sign: Add parameters to gpg signature function" and "package_manager: sign deb package feeds"
enable signed deb package feeds. This patch adds a runtime test for apt derived from the test_testimage_dnf
test. It creates a signed deb package feed, runs a qemu image to install the key and performs some package
management. To be able to install the key the gnupg package is added to the testimage.
    
These patches makes deb a first class citizen as ipk and rpm.

Patches have been in use in meta-intel-edison since Gatesgarth, 
see https://edison-fw.github.io/meta-intel-edison/5.0-Creating-a-deb-repository.html

Changes in V2:
 - Added runtime test for signed deb package feeds (Richard Purdie)