[PATCH] dev-manual/packages.rst: document gpg-agent configuration for parallel signing

[PATCH] dev-manual/packages.rst: document gpg-agent configuration for parallel signing

[Adarsh Jagadish Kamini]

OE-Core no longer passes auto-expand-secmem through --agent-program.
Document how to enable it in gpg-agent.conf and restart the agent to
avoid secure-memory exhaustion during parallel signing.

[YOCTO #16480]

AI-Generated: Uses Kiro (claude-opus-5.5)
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
---
 documentation/dev-manual/packages.rst | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/documentation/dev-manual/packages.rst b/documentation/dev-manual/packages.rst
index 380d806be..f05ade8b4 100644
--- a/documentation/dev-manual/packages.rst
+++ b/documentation/dev-manual/packages.rst
@@ -905,6 +905,26 @@ related to signed package feeds are available:
    "ASC", which is the default and specifies ascii armored, and "BIN",
    which specifies binary.
 
+Configuring the GnuPG Agent
+---------------------------
+
+Parallel signing can exhaust ``gpg-agent``'s secure memory, causing
+"Cannot allocate memory" errors. Add the following to ``gpg-agent.conf``
+in the GnuPG home directory used for signing (``GPG_PATH`` if set, or
+GnuPG's default home directory, normally ``~/.gnupg``)::
+
+   auto-expand-secmem
+
+The OpenEmbedded build system does not set this option. Stop any running
+agent for that directory so the next signing operation starts it with
+the new configuration:
+
+.. code-block:: console
+
+   $ gpgconf --homedir /path/to/gpg/home --kill gpg-agent
+
+Omit ``--homedir /path/to/gpg/home`` to use GnuPG's default home directory.
+
 Testing Packages With ptest
 ===========================
 

[PATCH] dev-manual/packages.rst: document gpg-agent configuration for parallel signing

[Adarsh Jagadish Kamini]

OE-Core no longer passes auto-expand-secmem through --agent-program.
Document how to enable it in gpg-agent.conf and restart the agent to
avoid secure-memory exhaustion during parallel signing.

[YOCTO #16480]

AI-Generated: Uses Kiro (claude-opus-5.5)
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
---
 documentation/dev-manual/packages.rst | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/documentation/dev-manual/packages.rst b/documentation/dev-manual/packages.rst
index 380d806be..f05ade8b4 100644
--- a/documentation/dev-manual/packages.rst
+++ b/documentation/dev-manual/packages.rst
@@ -905,6 +905,26 @@ related to signed package feeds are available:
    "ASC", which is the default and specifies ascii armored, and "BIN",
    which specifies binary.
 
+Configuring the GnuPG Agent
+---------------------------
+
+Parallel signing can exhaust ``gpg-agent``'s secure memory, causing
+"Cannot allocate memory" errors. Add the following to ``gpg-agent.conf``
+in the GnuPG home directory used for signing (``GPG_PATH`` if set, or
+GnuPG's default home directory, normally ``~/.gnupg``)::
+
+   auto-expand-secmem
+
+The OpenEmbedded build system does not set this option. Stop any running
+agent for that directory so the next signing operation starts it with
+the new configuration:
+
+.. code-block:: console
+
+   $ gpgconf --homedir /path/to/gpg/home --kill gpg-agent
+
+Omit ``--homedir /path/to/gpg/home`` to use GnuPG's default home directory.
+
 Testing Packages With ptest
 ===========================
 

Re: [PATCH] dev-manual/packages.rst: document gpg-agent configuration for parallel signing

[Paul Barker]

On Wed Nov 11, 2026 at 4:06 PM GMT, Adarsh Jagadish Kamini wrote:
> OE-Core no longer passes auto-expand-secmem through --agent-program.
> Document how to enable it in gpg-agent.conf and restart the agent to
> avoid secure-memory exhaustion during parallel signing.
>
> [YOCTO #16480]
>
> AI-Generated: Uses Kiro (claude-opus-5.5)
> Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>

Hi Antonin,

Please hold this docs patch until we've reviewed the corresponding
oe-core patch [1].

[1]: https://lore.kernel.org/openembedded-core/20261111140027.69866-1-adarsh.jagadish.kamini@est.tech/

Best regards,

-- 
Paul Barker