[RFC PATCH 0/3] Enforce Shared State Signing when options set

[Joshua Lock <jlock@vmware.com>]

There are 2 surprising behaviours in the current shared state signing
implementation which this pull request addresses:
1) when signature verification is enabled a failure to verify doesn't prevent
   the shared state object from being used. A warning is printed and the
   unsigned shared state object is used to accelerate the task.
2) when signing is enabled the taskhash doesn't change and any existing,
   unsigned, shared state objects will not be signed. This is particularly
   problematic when combined with 1.

Please review the following changes for suitability for inclusion. If you have
any objections or suggestions for improvement, please respond to the patches. If
you agree with the changes, please provide your Acked-by.

The following changes since commit 835f7eac0610325e906591cd81890bebe8627580:

  meta/lib/oeqa: Test for bootimg-biosplusefi Source (2019-07-23 22:26:28 +0100)

are available in the Git repository at:

  https://github.com/joshuagl/poky joshuagl/signed-sstate
  https://github.com/joshuagl/poky/tree/joshuagl/signed-sstate

Joshua Lock (3):
  sstate: fix log message
  classes/sstate: don't use unsigned sstate when verification enabled
  classes/sstate: regenerate sstate when signing enabled

 meta/classes/sstate.bbclass | 15 +++++++++++----
 meta/lib/oe/gpg_sign.py     | 10 ++++++++++
 2 files changed, 21 insertions(+), 4 deletions(-)

-- 
2.21.0