diff mbox series

lib/oe/gpg_sign.py: drop unsupported gpg-agent argument passing

Message ID 20261111140027.69866-1-adarsh.jagadish.kamini@est.tech
State New
Headers show
Series lib/oe/gpg_sign.py: drop unsupported gpg-agent argument passing | expand

Commit Message

Adarsh Jagadish Kamini Nov. 11, 2026, 2 p.m. UTC 
Passing auto-expand-secmem through --agent-program relies on GnuPG's
unsupported regression test interface. Remove this use and leave agent
configuration to the user, since the signing home directory is
user-managed and an agent may already be running. Users can enable
auto-expand-secmem in gpg-agent.conf to avoid secure-memory exhaustion
during parallel signing.

Tested with oe-selftest -r signing.

[YOCTO #16480]

AI-Generated: Uses Kiro (claude-opus-5.5)
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
---
 meta/lib/oe/gpg_sign.py | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)
diff mbox series

Patch

diff --git a/meta/lib/oe/gpg_sign.py b/meta/lib/oe/gpg_sign.py
index ede6186c84..fec6fb27ea 100644
--- a/meta/lib/oe/gpg_sign.py
+++ b/meta/lib/oe/gpg_sign.py
@@ -18,12 +18,7 @@  class LocalSigner(object):
         self.gpg_bin = d.getVar('GPG_BIN') or \
                   bb.utils.which(os.getenv('PATH'), 'gpg')
         self.gpg_cmd = [self.gpg_bin]
-        self.gpg_agent_bin = bb.utils.which(os.getenv('PATH'), "gpg-agent")
-        # Without this we see "Cannot allocate memory" errors when running processes in parallel
-        # It needs to be set for any gpg command since any agent launched can stick around in memory
-        # and this parameter must be set.
-        if self.gpg_agent_bin:
-            self.gpg_cmd += ["--agent-program=%s|--auto-expand-secmem" % (self.gpg_agent_bin)]
+        # Parallel signing may need auto-expand-secmem in gpg-agent.conf.
         self.gpg_path = d.getVar('GPG_PATH')
         self.rpm_bin = bb.utils.which(os.getenv('PATH'), "rpmsign")
         self.gpg_version = self.get_gpg_version()
@@ -43,7 +38,7 @@  class LocalSigner(object):
         """Sign RPM files"""
 
         cmd = self.rpm_bin + " --addsign --define '_gpg_name %s'  " % keyid
-        gpg_args = '--no-permission-warning --batch --passphrase=%s --agent-program=%s|--auto-expand-secmem' % (passphrase, self.gpg_agent_bin)
+        gpg_args = '--no-permission-warning --batch --passphrase=%s' % passphrase
         if self.gpg_version > (2,1,):
             gpg_args += ' --pinentry-mode=loopback'
         cmd += "--define '_gpg_sign_cmd_extra_args %s' " % gpg_args