Merge pull request #17289 from bluca/mkosi_multi_sign

[backend]: support multi-stage signing for mkosi

src/backend/BSXML.pm

@@ -644,7 +644,8 @@ our $buildinfo = [
      ]],
 	'containerannotation',	# temporary hack
 	'expanddebug',
-	'followupfile',	# for two-stage builds
+	'followupfile',	# for multi-stage builds
+	'signingstage',	# for multi-stage builds, to avoid loops
 	'masterdispatched',	# dispatched through a master dispatcher
 	'nounchanged',	# do not check for "unchanged" builds
       [ 'module' ],	# list of modules to use

src/backend/bs_signer

@@ -879,8 +879,8 @@ sub signjob {
     unlink("$jobdir/.checksums");
 
     my $followupfile;
-    # check for followup files
-    if (!$info->{'followupfile'} && ($info->{'file'} || '') ne '_aggregate') {
+    # check for followup files, but don't allow more than 10 stages to avoid loops
+    if ((!$info->{'signingstage'} || $info->{'signingstage'} < 10) && ($info->{'file'} || '') ne '_aggregate') {
       if (grep {/\.rsasign$/} @signfiles) {
         $followupfile = (grep {/\.(spec|dsc)$/} @files)[0];
         @signfiles = grep {/\.rsasign$/} @signfiles if $followupfile;
@@ -1074,6 +1074,12 @@ sub signjob {
       # we need to create a followup job to integrate the signatures
       $info->{'followupfile'} = $followupfile;
       $info->{'readytime'} = time();
+      # to avoid loops keep track of how many stages we have done for this job
+      if (!$info->{'signingstage'}) {
+        $info->{'signingstage'} = 0;
+      } else {
+        $info->{'signingstage'}++;
+      }
       writexml("$jobsdir/$arch/.$job", "$jobsdir/$arch/$job", $info, $BSXML::buildinfo);
       updateredisjobstatus($arch, $job, $info);
       unlink("$jobsdir/$arch/$job:status");