build: separate signing logic

This separates the options for signature creation and verification

* SIGNED_PACKAGES create Packages.sig
* SIGNED_IMAGES add ucert signature to created images
* CHECK_SIGNATURE add verification capabilities to images
* INSTALL_LOCAL_KEY add local key-build to /etc/opkg/keys

Right now the buildbot.git contains some hacks to create images that
have signature verification capabilities while not storing private keys
on buildbot slaves. This commit allows to disable these steps for the
buildbots and only perform signing on the master.

Signed-off-by: Paul Spooren <mail@aparcar.org>
This commit is contained in:
Paul Spooren 2019-09-24 12:32:54 -10:00 committed by John Crispin
parent f473ce6f23
commit 4a45e69d19
3 changed files with 27 additions and 15 deletions

View File

@ -37,13 +37,21 @@ menu "Global build settings"
- Enabling per-device rootfs support
...
config INSTALL_LOCAL_KEY
bool "Install local usign key into image"
default n
config SIGNED_PACKAGES
bool "Cryptographically signed package lists"
default y
default n
config SIGNED_IMAGES
bool "Cryptographically signed firmware images"
default n
config SIGNATURE_CHECK
bool "Enable signature checking in opkg"
default SIGNED_PACKAGES
default y
comment "General build options"

View File

@ -373,7 +373,10 @@ metadata_json = \
define Build/append-metadata
$(if $(SUPPORTED_DEVICES),-echo $(call metadata_json,$(SUPPORTED_DEVICES)) | fwtool -I - $@)
[ ! -s "$(BUILD_KEY)" -o ! -s "$(BUILD_KEY).ucert" -o ! -s "$@" ] || { \
[ -z "$(SIGNED_IMAGES)" \
-o ! -s "$(BUILD_KEY)" \
-o ! -s "$(BUILD_KEY).ucert" \
-o ! -s "$@" ] || { \
cp "$(BUILD_KEY).ucert" "$@.ucert" ;\
usign -S -m "$@" -s "$(BUILD_KEY)" -x "$@.sig" ;\
ucert -A -c "$@.ucert" -x "$@.sig" ;\

View File

@ -37,7 +37,7 @@ endif
define Package/base-files
SECTION:=base
CATEGORY:=Base system
DEPENDS:=+netifd +libc +procd +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool
DEPENDS:=+netifd +libc +procd +jsonfilter +SIGNATURE_CHECK:usign +SIGNATURE_CHECK:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool
TITLE:=Base filesystem for OpenWrt
URL:=http://openwrt.org/
VERSION:=$(PKG_RELEASE)-$(REVISION)
@ -116,12 +116,6 @@ ifdef CONFIG_SIGNED_PACKAGES
$(STAGING_DIR_HOST)/bin/ucert -I -c $(BUILD_KEY).ucert -p $(BUILD_KEY).pub -s $(BUILD_KEY)
endef
define Package/base-files/install-key
mkdir -p $(1)/etc/opkg/keys
$(CP) $(BUILD_KEY).pub $(1)/etc/opkg/keys/`$(STAGING_DIR_HOST)/bin/usign -F -p $(BUILD_KEY).pub`
endef
endif
ifeq ($(CONFIG_NAND_SUPPORT),)
@ -130,9 +124,16 @@ ifeq ($(CONFIG_NAND_SUPPORT),)
endef
endif
ifdef CONFIG_INSTALL_LOCAL_KEY
define Package/base-files/install-local-key
mkdir -p $(1)/etc/opkg/keys
$(CP) $(BUILD_KEY).pub $(1)/etc/opkg/keys/`$(STAGING_DIR_HOST)/bin/usign \
-F -p $(BUILD_KEY).pub`
endef
define Package/base-files/install
$(CP) ./files/* $(1)/
$(Package/base-files/install-key)
$(Package/base-files/install-local-key)
$(Package/base-files/nand-support)
if [ -d $(GENERIC_PLATFORM_DIR)/base-files/. ]; then \
$(CP) $(GENERIC_PLATFORM_DIR)/base-files/* $(1)/; \