Yocto的配方，用于安全APT存储库

Question

我有一个配置GPG密钥和自签名证书的私有APT存储库。我想从带有YOCTO生成的OS的设备访问存储库。我正在尝试创建一个将设备与远程存储库通信的食谱。到目前为止，这是食谱 myrepo_1.0.0.bb ：

SUMMARY = "Install files for APT secure repository"
DESCRIPTION = "Copy security configuration files for enable secure APT communication with remote repository"
LICENSE = "CLOSED"

DEPENDS = "package-index ca-certificates-native"

FILESEXTRAPATHS_prepend := "${THISDIR}/files:"

SRC_URI += "\
  file://myrepo.gpg \
  file://myrepo.crt \
"

do_install_append() {
  install -d ${D}${sysconfdir}/${PN}
  install -m 0644 ${WORKDIR}/myrepo.gpg ${D}${sysconfdir}/${PN}/
  install -m 0644 ${WORKDIR}/myrepo.crt ${D}${sysconfdir}/${PN}/
  install -d ${D}usr/local/share/ca-certificates
  ln -s ${sysconfdir}/${PN}/myrepo.crt ${D}usr/local/share/ca-certificates/
}

在食谱中，我正在尝试复制gpg键（myrepo.gpg）和自签名证书（myrepo.crt）。

关于CRT键：我遵循了这些指令要手动添加证书，但是当我这样做时，证书在设备上不起作用。

关于GPG密钥：我成功地复制了设备中的密钥，但我无法使用它。为了使用它，文件 /etc/apt/sources.list 必须包含签名 - by 指令，以指定GPG密钥的路径。例如：deb [signed-by =/etc/myrepo/myrepo.gpg] https://myrepo.com/all ./ code>，但是如果我在我的 local.conf中添加了指令这样：

PACKAGE_CLASSES ?= "package_deb"
PACKAGE_FEED_URIS = "[signed-by=/etc/myrepo/myrepo.gpg] https://myrepo.com"

结果是被视为新存储库的指令：

deb [signed-by=/etc/myrepo/myrepo.gpg] ./
deb https://myrepo.com/all ./

有人可以帮助我使用食谱以自动配置存储库吗？

Answer 1

我终于找到了添加HTTPS证书并添加GPG签名的方法。

我使用 do_install_append 函数在构建时间上添加了证书和密钥文件，并且我必须使用函数 pkg_postinst_ontarget _ $ {pn} （请参阅 mega-manual ）以更改运行时（仅第一次运行）上的APT存储库配置。找不到一种更改 sources.list的方法。

;; This buffer is for text that is not saved, and for Lisp evaluation.
;; To create a file, visit it with C-x C-f and enter text in its buffer.

SUMMARY = "Install files for APT myrepository repository"
DESCRIPTION = "Copy security configuration files for enable secure APT communication with myrepository repository"
LICENSE = "CLOSED"

DEPENDS = "ca-certificates-native"
RDEPENDS_{PN} = "apt"

FILESEXTRAPATHS_prepend := "${THISDIR}/files:"

SRC_URI += "\
  file://myrepo.gpg \
  file://myrepo.crt \
"

do_install_append() {
  install -d ${D}${sysconfdir}/${PN}
  install -m 0644 ${WORKDIR}/myrepo.gpg ${D}${sysconfdir}/${PN}/
  install -m 0644 ${WORKDIR}/myrepo.crt ${D}${sysconfdir}/${PN}/
}

pkg_postinst_${PN}() {
  echo "192.168.200.6 myrepo.com" >> $D/etc/hosts
  cat $D/etc/myrepo/myrepo.crt >> $D/etc/ssl/certs/ca-certificates.crt
}

pkg_postinst_ontarget_${PN}() {
   sed -i 's/https/[signed-by=\/etc\/myrepo\/myrepo.gpg] https/g' $D/etc/apt/sources.list
}