[PATCH v4 0/3] zypper: support signed repositories

[PATCH v4 0/3] zypper: support signed repositories

[Steve Sakoman]

The current zypper implementation does not work with signed repositories.
This patch series adds recipes for the required packages as well as the
necessary runtime dependencies to zypper.

Tested on Gumstix Overo (OMAP3) with meta-openembedded layer enabled and
a systemd based console image.

Version 4 incorporates feedback from Koen Kooi, Saul Wold, Khem Raj, and
Anders Darander
 - adds runtime dependencies to existing RDEPENDS_${PN} of zypper
 - removes duplicate recipe for libassuan
 - moves recipes for gnupg and libksba to recipes-support
 - adds dependency on libgpg-error for libksba
 - cleans up LICENSE field
 
Steve Sakoman (3):
  libksba: add recipe for 1.2.0
  gnupg: add recipe for 2.0.18
  zypper: add missing runtime dependences on gzip and gnupg

 meta/recipes-extended/zypper/zypper_git.bb    |    4 ++--
 meta/recipes-support/gnupg/gnupg_2.0.18.bb    |   25 +++++++++++++++++++++++++
 meta/recipes-support/libksba/libksba_1.2.0.bb |   12 ++++++++++++
 3 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 meta/recipes-support/gnupg/gnupg_2.0.18.bb
 create mode 100644 meta/recipes-support/libksba/libksba_1.2.0.bb

[PATCH v4 1/3] libksba: add recipe for 1.2.0

[Steve Sakoman]

Libksba provides an easy API to create and parse X.509 and CMS related objects
and is required for gnupg

Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-support/libksba/libksba_1.2.0.bb |   12 ++++++++++++
 1 files changed, 12 insertions(+), 0 deletions(-)
 create mode 100644 meta/recipes-support/libksba/libksba_1.2.0.bb

diff --git a/meta/recipes-support/libksba/libksba_1.2.0.bb b/meta/recipes-support/libksba/libksba_1.2.0.bb
new file mode 100644
index 0000000..1fadd48
--- /dev/null
+++ b/meta/recipes-support/libksba/libksba_1.2.0.bb
@@ -0,0 +1,12 @@
+DESCRIPTION = "Libksba provides an easy API to create and parse X.509 and CMS related objects"
+LICENSE = "GPLv3"
+LIC_FILES_CHKSUM = "file://COPYING;md5=f27defe1e96c2e1ecd4e0c9be8967949"
+
+DEPENDS = "libgpg-error"
+
+inherit autotools binconfig
+
+SRC_URI = "ftp://ftp.gnupg.org/gcrypt/${PN}/${PN}-${PV}.tar.bz2"
+
+SRC_URI[md5sum] = "e797f370b69b4dc776499d6a071ae137"
+SRC_URI[sha256sum] = "09afce65b03d027cbec10d21464f4f651cdfd269e38b404f83e48d3e2a3c934b"
-- 
1.7.1

[PATCH v4 2/3] gnupg: add recipe for 2.0.18

[Steve Sakoman]

GnuPG 2.0 is the new modularized version of GnuPG supporting OpenPGP and S/MIME

Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-support/gnupg/gnupg_2.0.18.bb |   25 +++++++++++++++++++++++++
 1 files changed, 25 insertions(+), 0 deletions(-)
 create mode 100644 meta/recipes-support/gnupg/gnupg_2.0.18.bb

diff --git a/meta/recipes-support/gnupg/gnupg_2.0.18.bb b/meta/recipes-support/gnupg/gnupg_2.0.18.bb
new file mode 100644
index 0000000..bdf6e3e
--- /dev/null
+++ b/meta/recipes-support/gnupg/gnupg_2.0.18.bb
@@ -0,0 +1,25 @@
+DESCRIPTION = "gnupg - GNU privacy guard"
+LICENSE = "GPLv3 & LGPLv3"
+LIC_FILES_CHKSUM = "file://COPYING;md5=f27defe1e96c2e1ecd4e0c9be8967949 \
+                    file://COPYING.LIB;md5=6a6a8e020838b23406c81b19c1d46df6"
+
+DEPENDS = "pth libassuan libksba zlib bzip2 readline"
+
+inherit autotools gettext
+
+SRC_URI = "ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-${PV}.tar.bz2"
+
+SRC_URI[md5sum] = "2f37e0722666a0fedbe4d9f9227ac4d7"
+SRC_URI[sha256sum] = "48aedd762ca443fb952a9e859efe3c66706d7c2c9c77c32dbdbac4fe962dae5b"
+
+S = "${WORKDIR}/gnupg-${PV}"
+
+EXTRA_OECONF = "--disable-ldap \
+		--with-zlib=${STAGING_LIBDIR}/.. \
+		--with-bzip2=${STAGING_LIBDIR}/.. \
+                --with-readline=${STAGING_LIBDIR}/.. \
+               "
+
+do_install_append() {
+	ln -sf gpg2 ${D}${bindir}/gpg
+}
-- 
1.7.1

[PATCH v4 3/3] zypper: add missing runtime dependences on gzip and gnupg

[Steve Sakoman]

gzip is required to uncompress repository files
gnupg is required for the support of signed repositories.

Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-extended/zypper/zypper_git.bb |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-extended/zypper/zypper_git.bb b/meta/recipes-extended/zypper/zypper_git.bb
index e5963be..bb456fe 100644
--- a/meta/recipes-extended/zypper/zypper_git.bb
+++ b/meta/recipes-extended/zypper/zypper_git.bb
@@ -5,7 +5,7 @@ LICENSE  = "GPLv2+"
 LIC_FILES_CHKSUM = "file://COPYING;md5=3201406e350b39e05a82e28b5020f413"
 
 DEPENDS  = "libzypp augeas"
-PR = "r1"
+PR = "r2"
 SRCREV = "2c5bb6ceb99ecd950ef993e43d77bf0569ea0582"
 
 inherit cmake
@@ -20,7 +20,7 @@ S = "${WORKDIR}/git"
 
 PV = "1.5.3-git${SRCPV}"
 
-RDEPENDS_${PN} = "rpm-libs"
+RDEPENDS_${PN} = "rpm-libs gzip gnupg"
 RRECOMMENDS_${PN} = "procps util-linux-uuidgen"
 
 PACKAGE_ARCH = "${MACHINE_ARCH}"
-- 
1.7.1

Re: [PATCH v4 0/3] zypper: support signed repositories

[Saul Wold]

On 01/30/2012 01:12 PM, Steve Sakoman wrote:
> The current zypper implementation does not work with signed repositories.
> This patch series adds recipes for the required packages as well as the
> necessary runtime dependencies to zypper.
>
> Tested on Gumstix Overo (OMAP3) with meta-openembedded layer enabled and
> a systemd based console image.
>
> Version 4 incorporates feedback from Koen Kooi, Saul Wold, Khem Raj, and
> Anders Darander
>   - adds runtime dependencies to existing RDEPENDS_${PN} of zypper
>   - removes duplicate recipe for libassuan
>   - moves recipes for gnupg and libksba to recipes-support
>   - adds dependency on libgpg-error for libksba
>   - cleans up LICENSE field
>
> Steve Sakoman (3):
>    libksba: add recipe for 1.2.0
>    gnupg: add recipe for 2.0.18

Steve, I am still reviewing this, and I need to to a build with 
non-GPLv3, since you might have added a dependency with zypper on a 
GPLv3 item, this will take me some checking.

You might want to prepare a patch and test with a GPLv2 version of gnupg 
as well.  This will not hold up this patch if we know the GPLv2 version 
is forth coming.

Thanks

Sau!

>    zypper: add missing runtime dependences on gzip and gnupg
>
>   meta/recipes-extended/zypper/zypper_git.bb    |    4 ++--
>   meta/recipes-support/gnupg/gnupg_2.0.18.bb    |   25 +++++++++++++++++++++++++
>   meta/recipes-support/libksba/libksba_1.2.0.bb |   12 ++++++++++++
>   3 files changed, 39 insertions(+), 2 deletions(-)
>   create mode 100644 meta/recipes-support/gnupg/gnupg_2.0.18.bb
>   create mode 100644 meta/recipes-support/libksba/libksba_1.2.0.bb
>
>
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/openembedded-core
>

Re: [PATCH v4 0/3] zypper: support signed repositories

[Steve Sakoman]

On Mon, Jan 30, 2012 at 1:50 PM, Saul Wold <sgw@linux.intel.com> wrote:
> Steve, I am still reviewing this, and I need to to a build with non-GPLv3,
> since you might have added a dependency with zypper on a GPLv3 item, this
> will take me some checking.
>
> You might want to prepare a patch and test with a GPLv2 version of gnupg as
> well.  This will not hold up this patch if we know the GPLv2 version is
> forth coming.

I'm not sure that a version 1.x of gnupg will give signed repository support.

The zypper package seems to explicitly use gpg2, see log below:

root@omap3-multi:~# zypper refresh
Retrieving repository 'sakoman' metadata [done]
Building repository 'sakoman' cache [done]
All repositories have been refreshed.
root@omap3-multi:~# cat /var/log/zypper.log | grep gpg
2011-12-13 15:10:55 <1> omap3-multi(517) [zypp] RpmDb.cc(~RpmDb):245 -
gpgcheck    : 0
2011-12-13 15:10:55 <1> omap3-multi(517) [zypp] RpmDb.cc(~RpmDb):245 -
gpgkey      :
2011-12-13 15:10:55 <1> omap3-multi(517) [zypp++]
ExternalProgram.cc(start_program):229 Executing '/usr/bin/gpg2'
'--no-default-keyring' '--quiet' '--list-public-keys' '--with-colons'
'--with-fingerprint' '--no-tty' '--no-greeting' '--batch'
'--status-fd' '1' '--homedir'
'/var/tmp/zypp.7TLoJg/zypp-trusted-krnRU0ej'
2011-12-13 15:10:55 <1> omap3-multi(517) [zypp++]
ExternalProgram.cc(start_program):229 Executing '/usr/bin/gpg2'
'--no-default-keyring' '--quiet' '--list-public-keys' '--with-colons'
'--with-fingerprint' '--no-tty' '--no-greeting' '--batch'
'--status-fd' '1' '--homedir'
'/var/tmp/zypp.7TLoJg/zypp-trusted-krnRU0ej'
2011-12-13 15:10:55 <1> omap3-multi(517) [zypp++]
ExternalProgram.cc(start_program):229 Executing '/usr/bin/gpg2'
'--no-default-keyring' '--quiet' '--no-tty' '--no-greeting'
'--no-permission-warning' '--status-fd' '1' '--homedir'
'/var/tmp/zypp.7TLoJg/zypp-trusted-krnRU0ej' '--import'
'/var/tmp/zypp.7TLoJg/TmpFile.bRqNPf'
2011-12-13 15:10:57 <1> omap3-multi(517) [zypp++]
ExternalProgram.cc(start_program):229 Executing 'gpg' '-v'
'--no-default-keyring' '--fixed-list-mode' '--with-fingerprint'
'--with-colons' '--homedir' '/var/tmp/TmpDir.HF2Hg5' '--quiet'
'--no-tty' '--no-greeting' '--batch' '--status-fd' '1'
'/var/tmp/TmpFile.njjEOI'
2011-12-13 15:10:57 <1> omap3-multi(517) [zypp++]
ExternalProgram.cc(start_program):229 Executing '/usr/bin/gpg2'
'--no-default-keyring' '--quiet' '--no-tty' '--no-greeting'
'--no-permission-warning' '--status-fd' '1' '--homedir'
'/var/tmp/zypp.7TLoJg/zypp-general-krfSdyHl' '--import'
'/var/tmp/TmpFile.njjEOI'

If I get some time later this week I will experiment with a earlier
version of gnupg, though I suspect we might have to create a somewhat
questionable symlink from gpg2 to gpg.  Note that it actually seems to
use *both* gpg2 and gpg!

Steve

Re: [PATCH v4 0/3] zypper: support signed repositories

[Saul Wold]

On 01/30/2012 01:50 PM, Saul Wold wrote:
> On 01/30/2012 01:12 PM, Steve Sakoman wrote:
>> The current zypper implementation does not work with signed repositories.
>> This patch series adds recipes for the required packages as well as the
>> necessary runtime dependencies to zypper.
>>
>> Tested on Gumstix Overo (OMAP3) with meta-openembedded layer enabled and
>> a systemd based console image.
>>
>> Version 4 incorporates feedback from Koen Kooi, Saul Wold, Khem Raj, and
>> Anders Darander
>> - adds runtime dependencies to existing RDEPENDS_${PN} of zypper
>> - removes duplicate recipe for libassuan
>> - moves recipes for gnupg and libksba to recipes-support
>> - adds dependency on libgpg-error for libksba
>> - cleans up LICENSE field
>>
>> Steve Sakoman (3):
>> libksba: add recipe for 1.2.0
>> gnupg: add recipe for 2.0.18
>
> Steve, I am still reviewing this, and I need to to a build with
> non-GPLv3, since you might have added a dependency with zypper on a
> GPLv3 item, this will take me some checking.
>
As I suspected, if we set INCOMPATIBLE_LICENSE = "GPLv3" and try a 
build, I get the following error:

NOTE: Resolving any missing task queue dependencies
ERROR: Nothing RPROVIDES 'gnupg' (but 
/intel/poky/distro/meta/recipes-extended/zypper/zypper_git.bb RDEPENDS 
on or otherwise requires it)
ERROR: gnupg was skipped: incompatible with license GPLv3 & LGPLv3
NOTE: Runtime target 'gnupg' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['gnupg']
NOTE: Runtime target 'zypper' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['zypper', 'gnupg']
NOTE: Runtime target 'task-core-basic' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['task-core-basic', 
'zypper', 'gnupg']
ERROR: Required build target 'core-image-basic' has no buildable providers.
Missing or unbuildable dependency chain was: ['core-image-basic', 
'task-core-basic', 'zypper', 'gnupg']

This would imply that we need to have a GPLv2 Version of the gnupg
recipe also, Steve if you had to look at or handle the newer GPLv3 gnupg 
code itself, you may not be able to write the GPLv2 recipe or create 
patches for it, can you arrange for someone to create that patch?

Thanks
	Sau!

> You might want to prepare a patch and test with a GPLv2 version of gnupg
> as well. This will not hold up this patch if we know the GPLv2 version
> is forth coming.
>
> Thanks
>
> Sau!
>
>> zypper: add missing runtime dependences on gzip and gnupg
>>
>> meta/recipes-extended/zypper/zypper_git.bb | 4 ++--
>> meta/recipes-support/gnupg/gnupg_2.0.18.bb | 25 +++++++++++++++++++++++++
>> meta/recipes-support/libksba/libksba_1.2.0.bb | 12 ++++++++++++
>> 3 files changed, 39 insertions(+), 2 deletions(-)
>> create mode 100644 meta/recipes-support/gnupg/gnupg_2.0.18.bb
>> create mode 100644 meta/recipes-support/libksba/libksba_1.2.0.bb
>>
>>
>> _______________________________________________
>> Openembedded-core mailing list
>> Openembedded-core@lists.openembedded.org
>> http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/openembedded-core
>>
>
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/openembedded-core
>

Re: [PATCH v4 0/3] zypper: support signed repositories

[Steve Sakoman]

On Mon, Jan 30, 2012 at 2:13 PM, Saul Wold <sgw@linux.intel.com> wrote:

> This would imply that we need to have a GPLv2 Version of the gnupg
> recipe also, Steve if you had to look at or handle the newer GPLv3 gnupg
> code itself, you may not be able to write the GPLv2 recipe or create patches
> for it, can you arrange for someone to create that patch?

OE-classic has a recipe for gnupg-1.4.10, so perhaps the safest
approach would be to import that recipe since I *have* browsed the
gnupg v2 code.

I know from experience that signed repositories won't work for that
version as-is.  Zypper explicitly uses gpg2.

It *may* be that gpg and gpg2 are compatible enough that you could get
away with a symlink and a v1.x version of gnupg.  Or perhaps one could
patch zypper to try gpg if gpg2 isn't present.  Thoughts?

Steve

Re: [PATCH v4 0/3] zypper: support signed repositories

[Saul Wold]

On 01/30/2012 03:29 PM, Steve Sakoman wrote:
> On Mon, Jan 30, 2012 at 2:13 PM, Saul Wold<sgw@linux.intel.com>  wrote:
>
>> This would imply that we need to have a GPLv2 Version of the gnupg
>> recipe also, Steve if you had to look at or handle the newer GPLv3 gnupg
>> code itself, you may not be able to write the GPLv2 recipe or create patches
>> for it, can you arrange for someone to create that patch?
>
> OE-classic has a recipe for gnupg-1.4.10, so perhaps the safest
> approach would be to import that recipe since I *have* browsed the
> gnupg v2 code.
>
You mean v3 code no doubt.

> I know from experience that signed repositories won't work for that
> version as-is.  Zypper explicitly uses gpg2.
>
Any idea how much work there is there? Do you know of anyone that can 
help out with this?

> It *may* be that gpg and gpg2 are compatible enough that you could get
> away with a symlink and a v1.x version of gnupg.  Or perhaps one could
> patch zypper to try gpg if gpg2 isn't present.  Thoughts?
>
I think it would be clearer if we patch zypper for gpg instead of hiding 
behind a symlink.  Other tools that may want to use gpg2 might get the 
wrong thing.

Another possibility would be disable signed repos for non-GPLv3, but I 
am not wild about that idea since it's highly likely that a commercial 
vendor would want to provide signed repos in a non-GPLv3 device for 
security and sanity.

Sau!


> Steve
>

Re: [PATCH v4 0/3] zypper: support signed repositories

[Steve Sakoman]

On Mon, Jan 30, 2012 at 3:56 PM, Saul Wold <sgw@linux.intel.com> wrote:
> On 01/30/2012 03:29 PM, Steve Sakoman wrote:
>>
>> On Mon, Jan 30, 2012 at 2:13 PM, Saul Wold<sgw@linux.intel.com>  wrote:
>>
>>> This would imply that we need to have a GPLv2 Version of the gnupg
>>> recipe also, Steve if you had to look at or handle the newer GPLv3 gnupg
>>> code itself, you may not be able to write the GPLv2 recipe or create
>>> patches
>>> for it, can you arrange for someone to create that patch?
>>
>>
>> OE-classic has a recipe for gnupg-1.4.10, so perhaps the safest
>> approach would be to import that recipe since I *have* browsed the
>> gnupg v2 code.
>>
> You mean v3 code no doubt.

No, I did mean GnuPG V2 code, which is GPLv3 :-)  Yeah, confusing with
all these v's flying around!

>> I know from experience that signed repositories won't work for that
>> version as-is.  Zypper explicitly uses gpg2.
>>
> Any idea how much work there is there? Do you know of anyone that can help
> out with this?

I'll take a look at patches for zypper to use GnuPG v1 (which is GPLv2 ;-) )

>> It *may* be that gpg and gpg2 are compatible enough that you could get
>> away with a symlink and a v1.x version of gnupg.  Or perhaps one could
>> patch zypper to try gpg if gpg2 isn't present.  Thoughts?
>>
> I think it would be clearer if we patch zypper for gpg instead of hiding
> behind a symlink.  Other tools that may want to use gpg2 might get the wrong
> thing.
>
> Another possibility would be disable signed repos for non-GPLv3, but I am
> not wild about that idea since it's highly likely that a commercial vendor
> would want to provide signed repos in a non-GPLv3 device for security and
> sanity.

Agreed.

Steve

Re: [PATCH v4 0/3] zypper: support signed repositories

[Steve Sakoman]

I took a quick look at the zypper code and discovered that the gpg2
dependency actually comes from the libzypp (package/libzypp.spec
excerpt):

%if 0%{?suse_version}
Requires:       gpg2
%else
Requires:       gnupg2
%endif

That said, the gpg2 utility seems to be quite compatible with gpg
(version 1.x), so we may get away with using an earlier version of
gnupg with GPLv2.

The required patch for libzypp is quite simple:

--- git/zypp/KeyRing.cc-orig	2012-01-30 17:26:49.000000000 -0800
+++ git/zypp/KeyRing.cc	2012-01-30 17:27:57.000000000 -0800
@@ -37,7 +37,7 @@ using namespace zypp::filesystem;
 #undef  ZYPP_BASE_LOGGER_LOGGROUP
 #define ZYPP_BASE_LOGGER_LOGGROUP "zypp::KeyRing"

-#define GPG_BINARY "/usr/bin/gpg2"
+#define GPG_BINARY "/usr/bin/gpg"

 ///////////////////////////////////////////////////////////////////
 namespace zypp

Of course you'll need to import the older gnupg recipe from oe-classic
to test this - not sure I should touch that since I've been poking
through the GPLv3 version of gnupg..

Since the gnupg v2 package has a symlink from gpg to gpg2 the above
patch should work just fine with the new code too.  I'll test &
verify.

Steve


On Mon, Jan 30, 2012 at 3:56 PM, Saul Wold <sgw@linux.intel.com> wrote:
> On 01/30/2012 03:29 PM, Steve Sakoman wrote:
>>
>> On Mon, Jan 30, 2012 at 2:13 PM, Saul Wold<sgw@linux.intel.com>  wrote:
>>
>>> This would imply that we need to have a GPLv2 Version of the gnupg
>>> recipe also, Steve if you had to look at or handle the newer GPLv3 gnupg
>>> code itself, you may not be able to write the GPLv2 recipe or create
>>> patches
>>> for it, can you arrange for someone to create that patch?
>>
>>
>> OE-classic has a recipe for gnupg-1.4.10, so perhaps the safest
>> approach would be to import that recipe since I *have* browsed the
>> gnupg v2 code.
>>
> You mean v3 code no doubt.
>
>
>> I know from experience that signed repositories won't work for that
>> version as-is.  Zypper explicitly uses gpg2.
>>
> Any idea how much work there is there? Do you know of anyone that can help
> out with this?
>
>
>> It *may* be that gpg and gpg2 are compatible enough that you could get
>> away with a symlink and a v1.x version of gnupg.  Or perhaps one could
>> patch zypper to try gpg if gpg2 isn't present.  Thoughts?
>>
> I think it would be clearer if we patch zypper for gpg instead of hiding
> behind a symlink.  Other tools that may want to use gpg2 might get the wrong
> thing.
>
> Another possibility would be disable signed repos for non-GPLv3, but I am
> not wild about that idea since it's highly likely that a commercial vendor
> would want to provide signed repos in a non-GPLv3 device for security and
> sanity.
>
> Sau!
>
>
>> Steve
>>
>

Re: [PATCH v4 0/3] zypper: support signed repositories

[Steve Sakoman]

On Mon, Jan 30, 2012 at 7:23 PM, Saul Wold <sgw@linux.intel.com> wrote:
> On 01/30/2012 05:39 PM, Steve Sakoman wrote:
>>
>> I took a quick look at the zypper code and discovered that the gpg2
>> dependency actually comes from the libzypp (package/libzypp.spec
>> excerpt):
>>
>> %if 0%{?suse_version}
>> Requires:       gpg2
>> %else
>> Requires:       gnupg2
>> %endif
>>
> So, should your DEPENDS patch really be against libzypp instead of zypper?

Yes.  In fact, though it isn't called out explicitly in libzypp.spec,
the libzypp source code does indeed make use of gzip so both runtime
dependencies in my original patch belong with libzypp and not zypper.

Can you feel a v5 coming?

>> That said, the gpg2 utility seems to be quite compatible with gpg
>> (version 1.x), so we may get away with using an earlier version of
>> gnupg with GPLv2.
>>
>> The required patch for libzypp is quite simple:
>>
>> --- git/zypp/KeyRing.cc-orig    2012-01-30 17:26:49.000000000 -0800
>> +++ git/zypp/KeyRing.cc 2012-01-30 17:27:57.000000000 -0800
>> @@ -37,7 +37,7 @@ using namespace zypp::filesystem;
>>  #undef  ZYPP_BASE_LOGGER_LOGGROUP
>>  #define ZYPP_BASE_LOGGER_LOGGROUP "zypp::KeyRing"
>>
>> -#define GPG_BINARY "/usr/bin/gpg2"
>> +#define GPG_BINARY "/usr/bin/gpg"
>>
>>  ///////////////////////////////////////////////////////////////////
>>  namespace zypp
>>
>> Of course you'll need to import the older gnupg recipe from oe-classic
>> to test this - not sure I should touch that since I've been poking
>> through the GPLv3 version of gnupg..
>>
>> Since the gnupg v2 package has a symlink from gpg to gpg2 the above
>> patch should work just fine with the new code too.  I'll test&
>> verify.
>>
> I will wait to pull this until I hear back from you with another pull
> request.  Thanks for digging into this, better to get it solved now then
> figure it out later that we missed a GPLv2 dependency.

I'll do a build with the libzypp RDEPENDS change and verify no issues,
and then a test build with the gpg2 -> gpg change and verify that too.

If it works, then that patch should likely get bundled with the
introduction of a GnuPG V1.4.10 recipe import from oe-classic.

Steve

>> Steve
>>
>>
>> On Mon, Jan 30, 2012 at 3:56 PM, Saul Wold<sgw@linux.intel.com>  wrote:
>>>
>>> On 01/30/2012 03:29 PM, Steve Sakoman wrote:
>>>>
>>>>
>>>> On Mon, Jan 30, 2012 at 2:13 PM, Saul Wold<sgw@linux.intel.com>
>>>>  wrote:
>>>>
>>>>> This would imply that we need to have a GPLv2 Version of the gnupg
>>>>> recipe also, Steve if you had to look at or handle the newer GPLv3
>>>>> gnupg
>>>>> code itself, you may not be able to write the GPLv2 recipe or create
>>>>> patches
>>>>> for it, can you arrange for someone to create that patch?
>>>>
>>>>
>>>>
>>>> OE-classic has a recipe for gnupg-1.4.10, so perhaps the safest
>>>> approach would be to import that recipe since I *have* browsed the
>>>> gnupg v2 code.
>>>>
>>> You mean v3 code no doubt.
>>>
>>>
>>>> I know from experience that signed repositories won't work for that
>>>> version as-is.  Zypper explicitly uses gpg2.
>>>>
>>> Any idea how much work there is there? Do you know of anyone that can
>>> help
>>> out with this?
>>>
>>>
>>>> It *may* be that gpg and gpg2 are compatible enough that you could get
>>>> away with a symlink and a v1.x version of gnupg.  Or perhaps one could
>>>> patch zypper to try gpg if gpg2 isn't present.  Thoughts?
>>>>
>>> I think it would be clearer if we patch zypper for gpg instead of hiding
>>> behind a symlink.  Other tools that may want to use gpg2 might get the
>>> wrong
>>> thing.
>>>
>>> Another possibility would be disable signed repos for non-GPLv3, but I am
>>> not wild about that idea since it's highly likely that a commercial
>>> vendor
>>> would want to provide signed repos in a non-GPLv3 device for security and
>>> sanity.
>>>
>>> Sau!
>>>
>>>
>>>> Steve
>>>>
>>>
>>
>

Re: [PATCH v4 0/3] zypper: support signed repositories

[Anders Darander]

* Steve Sakoman <steve@sakoman.com> [120131 06:32]:

> On Mon, Jan 30, 2012 at 7:23 PM, Saul Wold <sgw@linux.intel.com> wrote:
> > On 01/30/2012 05:39 PM, Steve Sakoman wrote:

> > I will wait to pull this until I hear back from you with another pull
> > request.  Thanks for digging into this, better to get it solved now then
> > figure it out later that we missed a GPLv2 dependency.

> I'll do a build with the libzypp RDEPENDS change and verify no issues,
> and then a test build with the gpg2 -> gpg change and verify that too.

> If it works, then that patch should likely get bundled with the
> introduction of a GnuPG V1.4.10 recipe import from oe-classic.

I think you'll have to modify the oe-classic recipe to use GnuPG v1.4.7,
as it seems that GnuPG was relicensed to GPLv3 in 1.4.8... At least that
was the conclusion I came to when I looked at this last summer.
(Unfortunately, I didn't have time to work through it).

Cheers,
Anders

-- 
Anders Darander
ChargeStorm AB / eStorm AB

Re: [PATCH v4 0/3] zypper: support signed repositories

[Steve Sakoman]

On Mon, Jan 30, 2012 at 11:42 PM, Anders Darander <anders@chargestorm.se> wrote:
> * Steve Sakoman <steve@sakoman.com> [120131 06:32]:
>
>> On Mon, Jan 30, 2012 at 7:23 PM, Saul Wold <sgw@linux.intel.com> wrote:
>> > On 01/30/2012 05:39 PM, Steve Sakoman wrote:
>
>> > I will wait to pull this until I hear back from you with another pull
>> > request.  Thanks for digging into this, better to get it solved now then
>> > figure it out later that we missed a GPLv2 dependency.
>
>> I'll do a build with the libzypp RDEPENDS change and verify no issues,
>> and then a test build with the gpg2 -> gpg change and verify that too.
>
>> If it works, then that patch should likely get bundled with the
>> introduction of a GnuPG V1.4.10 recipe import from oe-classic.
>
> I think you'll have to modify the oe-classic recipe to use GnuPG v1.4.7,
> as it seems that GnuPG was relicensed to GPLv3 in 1.4.8... At least that
> was the conclusion I came to when I looked at this last summer.
> (Unfortunately, I didn't have time to work through it).

This makes me wonder whether libzypp/zypper is an appropriate long
term choice for those who want to avoid GPLv3.

The zypp project obviously made the choice to switch to GPLv3 years
ago and it will be an ongoing problem to try to support old versions
with GPLv2.

Perhaps yum would be a better choice for the GPLv3 averse, since IIRC
it is still GPLv2.

Steve

Re: [PATCH v4 0/3] zypper: support signed repositories

[Anders Darander]

* Steve Sakoman <sakoman@gmail.com> [120131 17:50]:
> On Mon, Jan 30, 2012 at 11:42 PM, Anders Darander <anders@chargestorm.se> wrote:
> > * Steve Sakoman <steve@sakoman.com> [120131 06:32]:
> >> On Mon, Jan 30, 2012 at 7:23 PM, Saul Wold <sgw@linux.intel.com> wrote:
> >> > On 01/30/2012 05:39 PM, Steve Sakoman wrote:

> >> > I will wait to pull this until I hear back from you with another pull
> >> > request.  Thanks for digging into this, better to get it solved now then
> >> > figure it out later that we missed a GPLv2 dependency.

> >> I'll do a build with the libzypp RDEPENDS change and verify no issues,
> >> and then a test build with the gpg2 -> gpg change and verify that too.

> >> If it works, then that patch should likely get bundled with the
> >> introduction of a GnuPG V1.4.10 recipe import from oe-classic.

> > I think you'll have to modify the oe-classic recipe to use GnuPG v1.4.7,
> > as it seems that GnuPG was relicensed to GPLv3 in 1.4.8... At least that
> > was the conclusion I came to when I looked at this last summer.
> > (Unfortunately, I didn't have time to work through it).

> This makes me wonder whether libzypp/zypper is an appropriate long
> term choice for those who want to avoid GPLv3.

> The zypp project obviously made the choice to switch to GPLv3 years
> ago and it will be an ongoing problem to try to support old versions
> with GPLv2.

> Perhaps yum would be a better choice for the GPLv3 averse, since IIRC
> it is still GPLv2.

How does yum handle the signatures? Does it also do it using
gpg/gpg2-commands? If so, we would probably have the same problem with
yum as with libzypp/zypper. (Possible without having to patch gpg2 ->
gpg, but as they are quite compatible, that should be a minor issue). We
would still have problems using later GnuPG 1.4.x...

Or is yum (or any other package manager) using GpgME? (The library
designed to make it easier for applications to interface with gpg). If
so, it should be OK, as gpgme is licensed under GPLv2(+?)

Cheers,
Anders

-- 
Anders Darander
ChargeStorm AB / eStorm AB

Re: [PATCH v4 0/3] zypper: support signed repositories

[Koen Kooi]

Op 1 feb. 2012, om 12:11 heeft Anders Darander het volgende geschreven:

> * Steve Sakoman <sakoman@gmail.com> [120131 17:50]:
>> On Mon, Jan 30, 2012 at 11:42 PM, Anders Darander <anders@chargestorm.se> wrote:
>>> * Steve Sakoman <steve@sakoman.com> [120131 06:32]:
>>>> On Mon, Jan 30, 2012 at 7:23 PM, Saul Wold <sgw@linux.intel.com> wrote:
>>>>> On 01/30/2012 05:39 PM, Steve Sakoman wrote:
> 
>>>>> I will wait to pull this until I hear back from you with another pull
>>>>> request.  Thanks for digging into this, better to get it solved now then
>>>>> figure it out later that we missed a GPLv2 dependency.
> 
>>>> I'll do a build with the libzypp RDEPENDS change and verify no issues,
>>>> and then a test build with the gpg2 -> gpg change and verify that too.
> 
>>>> If it works, then that patch should likely get bundled with the
>>>> introduction of a GnuPG V1.4.10 recipe import from oe-classic.
> 
>>> I think you'll have to modify the oe-classic recipe to use GnuPG v1.4.7,
>>> as it seems that GnuPG was relicensed to GPLv3 in 1.4.8... At least that
>>> was the conclusion I came to when I looked at this last summer.
>>> (Unfortunately, I didn't have time to work through it).
> 
>> This makes me wonder whether libzypp/zypper is an appropriate long
>> term choice for those who want to avoid GPLv3.
> 
>> The zypp project obviously made the choice to switch to GPLv3 years
>> ago and it will be an ongoing problem to try to support old versions
>> with GPLv2.
> 
>> Perhaps yum would be a better choice for the GPLv3 averse, since IIRC
>> it is still GPLv2.
> 
> How does yum handle the signatures? Does it also do it using
> gpg/gpg2-commands? If so, we would probably have the same problem with
> yum as with libzypp/zypper. (Possible without having to patch gpg2 ->
> gpg, but as they are quite compatible, that should be a minor issue). We
> would still have problems using later GnuPG 1.4.x...
> 
> Or is yum (or any other package manager) using GpgME? (The library
> designed to make it easier for applications to interface with gpg). If
> so, it should be OK, as gpgme is licensed under GPLv2(+?)

And is yum a binary or a script? I'm in the 'statically linked package manager' camp, so switching to a script is only going to make me sad ;)

regards,

Koen

Re: [PATCH v4 0/3] zypper: support signed repositories

[Steve Sakoman]

On Wed, Feb 1, 2012 at 3:13 AM, Koen Kooi <koen@dominion.thruhere.net> wrote:
>
> Op 1 feb. 2012, om 12:11 heeft Anders Darander het volgende geschreven:
>
>> * Steve Sakoman <sakoman@gmail.com> [120131 17:50]:
>>> On Mon, Jan 30, 2012 at 11:42 PM, Anders Darander <anders@chargestorm.se> wrote:
>>>> * Steve Sakoman <steve@sakoman.com> [120131 06:32]:
>>>>> On Mon, Jan 30, 2012 at 7:23 PM, Saul Wold <sgw@linux.intel.com> wrote:
>>>>>> On 01/30/2012 05:39 PM, Steve Sakoman wrote:
>>
>>>>>> I will wait to pull this until I hear back from you with another pull
>>>>>> request.  Thanks for digging into this, better to get it solved now then
>>>>>> figure it out later that we missed a GPLv2 dependency.
>>
>>>>> I'll do a build with the libzypp RDEPENDS change and verify no issues,
>>>>> and then a test build with the gpg2 -> gpg change and verify that too.
>>
>>>>> If it works, then that patch should likely get bundled with the
>>>>> introduction of a GnuPG V1.4.10 recipe import from oe-classic.
>>
>>>> I think you'll have to modify the oe-classic recipe to use GnuPG v1.4.7,
>>>> as it seems that GnuPG was relicensed to GPLv3 in 1.4.8... At least that
>>>> was the conclusion I came to when I looked at this last summer.
>>>> (Unfortunately, I didn't have time to work through it).
>>
>>> This makes me wonder whether libzypp/zypper is an appropriate long
>>> term choice for those who want to avoid GPLv3.
>>
>>> The zypp project obviously made the choice to switch to GPLv3 years
>>> ago and it will be an ongoing problem to try to support old versions
>>> with GPLv2.
>>
>>> Perhaps yum would be a better choice for the GPLv3 averse, since IIRC
>>> it is still GPLv2.
>>
>> How does yum handle the signatures? Does it also do it using
>> gpg/gpg2-commands? If so, we would probably have the same problem with
>> yum as with libzypp/zypper. (Possible without having to patch gpg2 ->
>> gpg, but as they are quite compatible, that should be a minor issue). We
>> would still have problems using later GnuPG 1.4.x...
>>
>> Or is yum (or any other package manager) using GpgME? (The library
>> designed to make it easier for applications to interface with gpg). If
>> so, it should be OK, as gpgme is licensed under GPLv2(+?)
>
> And is yum a binary or a script? I'm in the 'statically linked package manager' camp, so switching to a script is only going to make me sad ;)

IIRC yum is a script.  It would make me sad too, and that is why I
intend to stick with libzypp/zypper for rpm based images.

Steve

Re: [PATCH v4 0/3] zypper: support signed repositories

[Steve Sakoman]

On Wed, Feb 1, 2012 at 3:11 AM, Anders Darander <anders@chargestorm.se> wrote:
> * Steve Sakoman <sakoman@gmail.com> [120131 17:50]:
>> On Mon, Jan 30, 2012 at 11:42 PM, Anders Darander <anders@chargestorm.se> wrote:
>> > * Steve Sakoman <steve@sakoman.com> [120131 06:32]:
>> >> On Mon, Jan 30, 2012 at 7:23 PM, Saul Wold <sgw@linux.intel.com> wrote:
>> >> > On 01/30/2012 05:39 PM, Steve Sakoman wrote:
>
>> >> > I will wait to pull this until I hear back from you with another pull
>> >> > request.  Thanks for digging into this, better to get it solved now then
>> >> > figure it out later that we missed a GPLv2 dependency.
>
>> >> I'll do a build with the libzypp RDEPENDS change and verify no issues,
>> >> and then a test build with the gpg2 -> gpg change and verify that too.
>
>> >> If it works, then that patch should likely get bundled with the
>> >> introduction of a GnuPG V1.4.10 recipe import from oe-classic.
>
>> > I think you'll have to modify the oe-classic recipe to use GnuPG v1.4.7,
>> > as it seems that GnuPG was relicensed to GPLv3 in 1.4.8... At least that
>> > was the conclusion I came to when I looked at this last summer.
>> > (Unfortunately, I didn't have time to work through it).
>
>> This makes me wonder whether libzypp/zypper is an appropriate long
>> term choice for those who want to avoid GPLv3.
>
>> The zypp project obviously made the choice to switch to GPLv3 years
>> ago and it will be an ongoing problem to try to support old versions
>> with GPLv2.
>
>> Perhaps yum would be a better choice for the GPLv3 averse, since IIRC
>> it is still GPLv2.
>
> How does yum handle the signatures? Does it also do it using
> gpg/gpg2-commands? If so, we would probably have the same problem with
> yum as with libzypp/zypper. (Possible without having to patch gpg2 ->
> gpg, but as they are quite compatible, that should be a minor issue). We
> would still have problems using later GnuPG 1.4.x...

I don't know what yum does, and to be honest I'm not too motivated to find out!

I'm happy with zypp/zypper and that is the reason for jumping through
hoops to get full support for signed repositories :-)

Yum was merely mentioned as an option for those who can't deal with GPLv3.

> Or is yum (or any other package manager) using GpgME? (The library
> designed to make it easier for applications to interface with gpg). If
> so, it should be OK, as gpgme is licensed under GPLv2(+?)

No idea on this one either!

Steve