pool/pesign-obs-integration
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14 Commits 1 Branch 0 Tags 684 KiB
RPM Spec 100%
f6afa13b96
Go to file
Gary Ching-Pang Lin f6afa13b96 Accepting request 228761 from home:michal-m:branches:Base:System 
- Do not sign any files if BRP_PESIGN_FILES is set not an empty
  string (bnc#857599).

- Fix a typo in the last change.

- Default to BRP_PESIGN_FILES="*.ko /lib/firmware" (bnc#857599).

- Add --signatures=<directory> option to modsign-repackage
  (bnc#841627).

OBS-URL: https://build.opensuse.org/request/show/228761
OBS-URL: https://build.opensuse.org/package/show/Base:System/pesign-obs-integration?expand=0&rev=20
2014-04-03 01:54:03 +00:00
.gitattributes osc copypac from project:home:michal-m:modsign package:pesign-obs-integration revision:2 2013-02-05 10:41:47 +00:00
.gitignore osc copypac from project:home:michal-m:modsign package:pesign-obs-integration revision:2 2013-02-05 10:41:47 +00:00
brp-99-pesign Accepting request 228761 from home:michal-m:branches:Base:System 2014-04-03 01:54:03 +00:00
COPYING osc copypac from project:home:michal-m:modsign package:pesign-obs-integration revision:2 2013-02-05 10:41:47 +00:00
kernel-sign-file Accepting request 178980 from home:michal-m:branches:Base:System 2013-06-14 21:59:33 +00:00
modsign-repackage Accepting request 228761 from home:michal-m:branches:Base:System 2014-04-03 01:54:03 +00:00
pesign-gen-repackage-spec Accepting request 178980 from home:michal-m:branches:Base:System 2013-06-14 21:59:33 +00:00
pesign-obs-integration.changes Accepting request 228761 from home:michal-m:branches:Base:System 2014-04-03 01:54:03 +00:00
pesign-obs-integration.spec Accepting request 228761 from home:michal-m:branches:Base:System 2014-04-03 01:54:03 +00:00
pesign-repackage.spec.in Accepting request 178980 from home:michal-m:branches:Base:System 2013-06-14 21:59:33 +00:00
README - switch to normal brp hook 2013-02-06 12:25:06 +00:00

README 

Signing kernel modules and EFI binaries in the Open Build Service
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Note: Not everything that is described here is actually implemented. Even
those parts that are implemented can change slightly.

Packages that need to sign files during build should add the following lines
to the specfile

# needssslcertforbuild
export BRP_PESIGN_FILES='pattern...'
BuildRequires: pesign-obs-integration

The "# needssslcertforbuild" comment tells the buildservice to store the
signing certificate in %_sourcedir/_projectcert.crt. At the end of the
install phase, the brp-99-pesign script computes hashes of all
files matching the patterns in $BRP_PESIGN_FILES. The sha256 hashes are stored
in %_topdir/OTHER/%name.cpio.rsasign, plus the script places a
pesign-repackage.spec file there. When the first rpmbuild finishes, the
buildservice sends the cpio archive to the signing server, which returns
a rsasigned.cio archive with RSA signatures of the sha256 hashes.

The pesign-repackage.spec takes the original RPMs, unpacks them and
appends the signatures to the files (TODO: only implemented for firmware
files). It then uses the pesign-gen-repackage-spec script to generate
another specfile, which builds new RPMs with signed files.