aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJo-Philipp Wich <jo@mein.io>2019-08-06 21:22:27 +0200
committerJo-Philipp Wich <jo@mein.io>2019-08-07 07:54:27 +0200
commit0a4a82a4317142615c4f20ceadbc0bc6bcbbcdbe (patch)
tree0fd8b7c953d66d943183d59d7eb0ab31474f5740
parent8a83892662d06a5f2fd4d95b73fe919a21066038 (diff)
downloadupstream-0a4a82a4317142615c4f20ceadbc0bc6bcbbcdbe.tar.gz
upstream-0a4a82a4317142615c4f20ceadbc0bc6bcbbcdbe.tar.bz2
upstream-0a4a82a4317142615c4f20ceadbc0bc6bcbbcdbe.zip
config: introduce separate CONFIG_SIGNATURE_CHECK option
Introduce a new option CONFIG_SIGNATURE_CHECK which defaults to the value of CONFIG_SIGNED_PACKAGES and thus is enabled by default. This option is needed to support building target opkg with enabled signature verification while having the signed package lists disabled. Our buildbots currently disable package signing globally in the buildroot and SDK to avoid the need to ship private signing keys to the build workers and to prevent the triggering of random key generation on the worker nodes since package signing happens off-line on the master nodes. As unintended side-effect, updated opkg packages will get built with disabled signature verification, hence the need for a new override option. Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit f565f276e2c06ac8f3176e0b16d6f2d40cd653d4)
-rw-r--r--config/Config-build.in4
-rw-r--r--package/system/opkg/Makefile4
2 files changed, 6 insertions, 2 deletions
diff --git a/config/Config-build.in b/config/Config-build.in
index a082a5e0e2..162510b646 100644
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -34,6 +34,10 @@ menu "Global build settings"
bool "Cryptographically signed package lists"
default y
+ config SIGNATURE_CHECK
+ bool "Enable signature checking in opkg"
+ default SIGNED_PACKAGES
+
comment "General build options"
config DISPLAY_SUPPORT
diff --git a/package/system/opkg/Makefile b/package/system/opkg/Makefile
index 43b9ebdb4f..ed3cd5ebf4 100644
--- a/package/system/opkg/Makefile
+++ b/package/system/opkg/Makefile
@@ -25,7 +25,7 @@ PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
# Extend depends from version.mk
PKG_CONFIG_DEPENDS += \
- CONFIG_SIGNED_PACKAGES \
+ CONFIG_SIGNATURE_CHECK \
CONFIG_TARGET_INIT_PATH
PKG_BUILD_PARALLEL:=1
@@ -88,7 +88,7 @@ define Package/opkg/install
$(INSTALL_DATA) ./files/opkg$(2).conf $(1)/etc/opkg.conf
$(INSTALL_BIN) ./files/20_migrate-feeds $(1)/etc/uci-defaults/
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/opkg-cl $(1)/bin/opkg
- ifneq ($(CONFIG_SIGNED_PACKAGES),)
+ ifneq ($(CONFIG_SIGNATURE_CHECK),)
echo "option check_signature" >> $(1)/etc/opkg.conf
endif
$(INSTALL_DIR) $(1)/usr/sbin