EljakimHerrewijnen/Openwrt
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

config: introduce separate CONFIG_SIGNATURE_CHECK option

Browse Source 
Introduce a new option CONFIG_SIGNATURE_CHECK which defaults to the value
of CONFIG_SIGNED_PACKAGES and thus is enabled by default.

This option is needed to support building target opkg with enabled
signature verification while having the signed package lists disabled.

Our buildbots currently disable package signing globally in the
buildroot and SDK to avoid the need to ship private signing keys to
the build workers and to prevent the triggering of random key generation
on the worker nodes since package signing happens off-line on the master
nodes.

As unintended side-effect, updated opkg packages will get built with
disabled signature verification, hence the need for a new override option.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2019-08-06 21:22:27 +02:00
parent 991dd5a893
commit f565f276e2
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config/Config-build.in
View File

@ -34,6 +34,10 @@ menu "Global build settings"
bool "Cryptographically signed package lists" bool "Cryptographically signed package lists"
default y default y
config SIGNATURE_CHECK
bool "Enable signature checking in opkg"
default SIGNED_PACKAGES
comment "General build options" comment "General build options"
config TESTING_KERNEL config TESTING_KERNEL

4
package/system/opkg/Makefile
View File

@ -25,7 +25,7 @@ PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
# Extend depends from version.mk # Extend depends from version.mk
PKG_CONFIG_DEPENDS += \ PKG_CONFIG_DEPENDS += \
CONFIG_SIGNED_PACKAGES \ CONFIG_SIGNATURE_CHECK \
CONFIG_TARGET_INIT_PATH CONFIG_TARGET_INIT_PATH
PKG_BUILD_PARALLEL:=1 PKG_BUILD_PARALLEL:=1
@ -88,7 +88,7 @@ define Package/opkg/install
$(INSTALL_DATA) ./files/opkg$(2).conf $(1)/etc/opkg.conf $(INSTALL_DATA) ./files/opkg$(2).conf $(1)/etc/opkg.conf
$(INSTALL_BIN) ./files/20_migrate-feeds $(1)/etc/uci-defaults/ $(INSTALL_BIN) ./files/20_migrate-feeds $(1)/etc/uci-defaults/
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/opkg-cl $(1)/bin/opkg $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/opkg-cl $(1)/bin/opkg
ifneq ($(CONFIG_SIGNED_PACKAGES),) ifneq ($(CONFIG_SIGNATURE_CHECK),)
echo "option check_signature" >> $(1)/etc/opkg.conf echo "option check_signature" >> $(1)/etc/opkg.conf
endif endif
$(INSTALL_DIR) $(1)/usr/sbin $(INSTALL_DIR) $(1)/usr/sbin