[oe-commits] yzhu1 : rpm: disable external key server
git at git.openembedded.org
git at git.openembedded.org
Thu Jul 9 17:00:49 UTC 2015
Module: openembedded-core.git
Branch: master
Commit: fdaa9115fb20d4af49ce8407b5785096c66ecf6c
URL: http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=fdaa9115fb20d4af49ce8407b5785096c66ecf6c
Author: yzhu1 <yanjun.zhu at windriver.com>
Date: Wed Jul 8 11:30:57 2015 +0800
rpm: disable external key server
When RPM experiences a signed package, with a signature that it does NOT know.
By default it will send the -fingerprint- (and only the 16 digit fingerprint)
to an external HKP server, trying to get the key down.
This is probably not a reasonable default behavior for the system to do,
instead it should simply fail the key lookup. If someone wants to enable the
HKP server it's easy enough to do by enabling the necessary macros.
Signed-off-by: yzhu1 <yanjun.zhu at windriver.com>
Signed-off-by: Roy Li <rongqing.li at windriver.com>
Signed-off-by: Richard Purdie <richard.purdie at linuxfoundation.org>
---
...rpm-macros.in-disable-external-key-server.patch | 27 ++++++++++++++++++++++
meta/recipes-devtools/rpm/rpm_5.4.14.bb | 1 +
2 files changed, 28 insertions(+)
diff --git a/meta/recipes-devtools/rpm/rpm/rpm-macros.in-disable-external-key-server.patch b/meta/recipes-devtools/rpm/rpm/rpm-macros.in-disable-external-key-server.patch
new file mode 100644
index 0000000..07a0cfa
--- /dev/null
+++ b/meta/recipes-devtools/rpm/rpm/rpm-macros.in-disable-external-key-server.patch
@@ -0,0 +1,27 @@
+disable external key server
+
+Upstream-Status: Pending
+
+When RPM experiences a signed package, with a signature that it does NOT know.
+By default it will send the -fingerprint- (and only the 16 digit fingerprint) to
+an external HKP server, trying to get the key down.
+
+This is probably not a reasonable default behavior for the system to do, instead
+it should simply fail the key lookup. If someone wants to enable the HKP server
+it's easy enough to do by enabling the necessary macros.
+
+Signed-off-by: yzhu1 <yanjun.zhu at windriver.com>
+Signed-off-by: Mark Hatle <mark.hatle at windriver.com>
+--- a/macros/macros.in
++++ b/macros/macros.in
+@@ -546,8 +546,8 @@ $_arbitrary_tags_tests Foo:Bar
+ # Horowitz Key Protocol server configuration
+ #
+ #%_hkp_keyserver hkp://keys.n3npq.net
+-%_hkp_keyserver hkp://pool.sks-keyservers.net
+-%_hkp_keyserver_query %{_hkp_keyserver}/pks/lookup?op=get&search=
++#%_hkp_keyserver hkp://pool.sks-keyservers.net
++#%_hkp_keyserver_query %{_hkp_keyserver}/pks/lookup?op=get&search=
+
+
+ %_nssdb_path /etc/pki/nssdb
diff --git a/meta/recipes-devtools/rpm/rpm_5.4.14.bb b/meta/recipes-devtools/rpm/rpm_5.4.14.bb
index 2e17a91..bff0687 100644
--- a/meta/recipes-devtools/rpm/rpm_5.4.14.bb
+++ b/meta/recipes-devtools/rpm/rpm_5.4.14.bb
@@ -94,6 +94,7 @@ SRC_URI = "http://www.rpm5.org/files/rpm/rpm-5.4/rpm-5.4.14-0.20131024.src.rpm;e
file://no-ldflags-in-pkgconfig.patch \
file://rpm-lua-fix-print.patch \
file://rpm-check-rootpath-reasonableness.patch \
+ file://rpm-macros.in-disable-external-key-server.patch \
"
# Uncomment the following line to enable platform score debugging
More information about the Openembedded-commits
mailing list