diff options
author | Paul Spooren <mail@aparcar.org> | 2020-11-02 12:15:05 -1000 |
---|---|---|
committer | Daniel Golle <daniel@makrotopia.org> | 2020-11-19 22:15:00 +0000 |
commit | 418362b1cc106b9aca3905150199f60548906fff (patch) | |
tree | 2d47ae0121e3c893975359dc9bc214d29ed597f5 /target/linux/arc770/base-files/etc | |
parent | 2127accd441b1c979c8f3f56f3ad5264542e185a (diff) | |
download | upstream-418362b1cc106b9aca3905150199f60548906fff.tar.gz upstream-418362b1cc106b9aca3905150199f60548906fff.tar.bz2 upstream-418362b1cc106b9aca3905150199f60548906fff.zip |
imagebuilder: add package signature verification
The ImageBuilder downloads pre-built packages and adds them to images.
This process uses `opkg` which has the capability to verify package list
signatures via `usign`, as enabled per default on running OpenWrt
devices.
Until now this was disabled for ImageBuilders because neither the `opkg`
keys nor the `opkg-add` script was present during first packagelist
update.
To harden the ImageBuilder against *drive-by-download-attacks* both keys
and verification script are added to the ImageBuilder allowing `opkg` to
verify downloaded package indices.
This commit adds `opkg-add` to the ImageBuilder scripts folder. The keys
folder is added to ImageBuilder $TOPDIR to have an obvious place for users to
store their own keys. The `option check_signature` is appended to the
repositories.conf file. All of the above only happens if the Buildbot
runs with the SIGNATURE_CHECK option.
The keys stored in the ImageBuilder keys/ are the same as included in
the openwrt-keyring package. To avoid the chicken-egg problem of
downloading and verifying a package, containing signing keys, the keys
are added during the ImageBuilder generation. They are same as in
shipped images (stored at `/etc/opkg/keys/`).
To allow a local package feed in which the user can add additional
packages, a local set of `usign` and `ucert` keys is generated, same as
building OpenWrt from source. The private key signs the local repository
inside the packages/ folder. The local public key is added to the keys/
folder to be considered by `opkg` when updating repositories. This way a
local package feed can be modified while requiring `opkg` to check
signatures for remote feed, making HTTPS optional.
The new option `ADD_LOCAL_KEY` allows to add the local key inside the
created images, adding the advantage that sysupgrades can validate the
ImageBuilders local key.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Diffstat (limited to 'target/linux/arc770/base-files/etc')
0 files changed, 0 insertions, 0 deletions