diff options
| -rw-r--r-- | config/Config-build.in | 12 | ||||
| -rw-r--r-- | include/image-commands.mk | 13 | ||||
| -rw-r--r-- | package/base-files/Makefile | 17 |
3 files changed, 27 insertions, 15 deletions
diff --git a/config/Config-build.in b/config/Config-build.in index 872e5c12ab..c6591708a2 100644 --- a/config/Config-build.in +++ b/config/Config-build.in @@ -37,13 +37,21 @@ menu "Global build settings" - Enabling per-device rootfs support ... + config INSTALL_LOCAL_KEY + bool "Install local usign key into image" + default n + config SIGNED_PACKAGES bool "Cryptographically signed package lists" - default y + default n + + config SIGNED_IMAGES + bool "Cryptographically signed firmware images" + default n config SIGNATURE_CHECK bool "Enable signature checking in opkg" - default SIGNED_PACKAGES + default y comment "General build options" diff --git a/include/image-commands.mk b/include/image-commands.mk index 5dfd6a2c2f..3d10b18bc8 100644 --- a/include/image-commands.mk +++ b/include/image-commands.mk @@ -373,11 +373,14 @@ metadata_json = \ define Build/append-metadata $(if $(SUPPORTED_DEVICES),-echo $(call metadata_json,$(SUPPORTED_DEVICES)) | fwtool -I - $@) - [ ! -s "$(BUILD_KEY)" -o ! -s "$(BUILD_KEY).ucert" -o ! -s "$@" ] || { \ - cp "$(BUILD_KEY).ucert" "$@.ucert" ;\ - usign -S -m "$@" -s "$(BUILD_KEY)" -x "$@.sig" ;\ - ucert -A -c "$@.ucert" -x "$@.sig" ;\ - fwtool -S "$@.ucert" "$@" ;\ + [ -z "$(SIGNED_IMAGES)" \ + -o ! -s "$(BUILD_KEY)" \ + -o ! -s "$(BUILD_KEY).ucert" \ + -o ! -s "$@" ] || { \ + cp "$(BUILD_KEY).ucert" "$@.ucert" ;\ + usign -S -m "$@" -s "$(BUILD_KEY)" -x "$@.sig" ;\ + ucert -A -c "$@.ucert" -x "$@.sig" ;\ + fwtool -S "$@.ucert" "$@" ;\ } endef diff --git a/package/base-files/Makefile b/package/base-files/Makefile index f105d2cd27..588c958f80 100644 --- a/package/base-files/Makefile +++ b/package/base-files/Makefile @@ -37,7 +37,7 @@ endif define Package/base-files SECTION:=base CATEGORY:=Base system - DEPENDS:=+netifd +libc +procd +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool + DEPENDS:=+netifd +libc +procd +jsonfilter +SIGNATURE_CHECK:usign +SIGNATURE_CHECK:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool TITLE:=Base filesystem for OpenWrt URL:=http://openwrt.org/ VERSION:=$(PKG_RELEASE)-$(REVISION) @@ -116,12 +116,6 @@ ifdef CONFIG_SIGNED_PACKAGES $(STAGING_DIR_HOST)/bin/ucert -I -c $(BUILD_KEY).ucert -p $(BUILD_KEY).pub -s $(BUILD_KEY) endef - - define Package/base-files/install-key - mkdir -p $(1)/etc/opkg/keys - $(CP) $(BUILD_KEY).pub $(1)/etc/opkg/keys/`$(STAGING_DIR_HOST)/bin/usign -F -p $(BUILD_KEY).pub` - - endef endif ifeq ($(CONFIG_NAND_SUPPORT),) @@ -130,9 +124,16 @@ ifeq ($(CONFIG_NAND_SUPPORT),) endef endif +ifdef CONFIG_INSTALL_LOCAL_KEY + define Package/base-files/install-local-key + mkdir -p $(1)/etc/opkg/keys + $(CP) $(BUILD_KEY).pub $(1)/etc/opkg/keys/`$(STAGING_DIR_HOST)/bin/usign \ + -F -p $(BUILD_KEY).pub` +endef + define Package/base-files/install $(CP) ./files/* $(1)/ - $(Package/base-files/install-key) + $(Package/base-files/install-local-key) $(Package/base-files/nand-support) if [ -d $(GENERIC_PLATFORM_DIR)/base-files/. ]; then \ $(CP) $(GENERIC_PLATFORM_DIR)/base-files/* $(1)/; \ |