aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--target/imagebuilder/Makefile8
-rw-r--r--target/imagebuilder/files/Makefile33
2 files changed, 39 insertions, 2 deletions
diff --git a/target/imagebuilder/Makefile b/target/imagebuilder/Makefile
index 8b2f4e5af6..a96f8618e8 100644
--- a/target/imagebuilder/Makefile
+++ b/target/imagebuilder/Makefile
@@ -61,6 +61,14 @@ else
-exec $(CP) -t $(IB_LDIR)/ {} +
endif
+ifneq ($(CONFIG_SIGNATURE_CHECK),)
+ echo '' >> $(PKG_BUILD_DIR)/repositories.conf
+ echo 'option check_signature' >> $(PKG_BUILD_DIR)/repositories.conf
+ $(INSTALL_DIR) $(PKG_BUILD_DIR)/keys
+ $(CP) -L $(STAGING_DIR_ROOT)/etc/opkg/keys/ $(PKG_BUILD_DIR)/
+ $(CP) -L $(STAGING_DIR_ROOT)/usr/sbin/opkg-key $(PKG_BUILD_DIR)/scripts/
+endif
+
$(CP) $(TOPDIR)/target/linux $(PKG_BUILD_DIR)/target/
if [ -d $(TOPDIR)/staging_dir/host/lib/grub ]; then \
$(CP) $(TOPDIR)/staging_dir/host/lib/grub/ $(PKG_BUILD_DIR)/staging_dir/host/lib; \
diff --git a/target/imagebuilder/files/Makefile b/target/imagebuilder/files/Makefile
index 0ce5f8b39b..65cba92b32 100644
--- a/target/imagebuilder/files/Makefile
+++ b/target/imagebuilder/files/Makefile
@@ -46,6 +46,7 @@ Building images:
make image BIN_DIR="<path>" # alternative output directory for the images
make image EXTRA_IMAGE_NAME="<string>" # Add this to the output image filename (sanitized)
make image DISABLED_SERVICES="<svc1> [<svc2> [<svc3> ..]]" # Which services in /etc/init.d/ should be disabled
+ make image ADD_LOCAL_KEY=1 # store locally generated signing key in built images
Print manifest:
List "all" packages which get installed into the image.
@@ -64,8 +65,10 @@ help: FORCE
# override variables from rules.mk
PACKAGE_DIR:=$(TOPDIR)/packages
LISTS_DIR:=$(subst $(space),/,$(patsubst %,..,$(subst /,$(space),$(TARGET_DIR))))$(DL_DIR)
+export OPKG_KEYS:=$(TOPDIR)/keys
OPKG:=$(call opkg,$(TARGET_DIR)) \
-f $(TOPDIR)/repositories.conf \
+ --verify-program $(SCRIPT_DIR)/opkg-key \
--cache $(DL_DIR) \
--lists-dir $(LISTS_DIR)
@@ -133,7 +136,9 @@ package_index: FORCE
@echo Building package index... >&2
@mkdir -p $(TMP_DIR) $(TARGET_DIR)/tmp
(cd $(PACKAGE_DIR); $(SCRIPT_DIR)/ipkg-make-index.sh . > Packages && \
- gzip -9nc Packages > Packages.gz \
+ gzip -9nc Packages > Packages.gz; \
+ $(if $(CONFIG_SIGNATURE_CHECK), \
+ $(STAGING_DIR_HOST)/bin/usign -S -m Packages -s $(BUILD_KEY)); \
) >/dev/null 2>/dev/null
$(OPKG) update >&2 || true
@@ -165,9 +170,14 @@ prepare_rootfs: FORCE
@echo Finalizing root filesystem...
$(CP) $(TARGET_DIR) $(TARGET_DIR_ORIG)
+ $(if $(CONFIG_SIGNATURE_CHECK), \
+ $(if $(ADD_LOCAL_KEY), \
+ OPKG_KEYS=$(TARGET_DIR)/etc/opkg/keys/ \
+ $(SCRIPT_DIR)/opkg-key add $(BUILD_KEY).pub \
+ ) \
+ )
$(call prepare_rootfs,$(TARGET_DIR),$(USER_FILES),$(DISABLED_SERVICES))
-
build_image: FORCE
@echo
@echo Building images...
@@ -206,8 +216,26 @@ ifneq ($(PROFILE),)
endif
endif
+_check_keys: FORCE
+ifneq ($(CONFIG_SIGNATURE_CHECK),)
+ @if [ ! -s $(BUILD_KEY) -o ! -s $(BUILD_KEY).pub ]; then \
+ echo Generate local signing keys... >&2; \
+ $(STAGING_DIR_HOST)/bin/usign -G \
+ -s $(BUILD_KEY) -p $(BUILD_KEY).pub -c "Local build key"; \
+ $(SCRIPT_DIR)/opkg-key add $(BUILD_KEY).pub; \
+ fi
+ if [ ! -s $(BUILD_KEY).ucert ]; then \
+ echo Generate local certificate... >&2; \
+ $(STAGING_DIR_HOST)/bin/ucert -I \
+ -c $(BUILD_KEY).ucert \
+ -p $(BUILD_KEY).pub \
+ -s $(BUILD_KEY); \
+ fi
+endif
+
image:
$(MAKE) -s _check_profile
+ $(MAKE) -s _check_keys
(unset PROFILE FILES PACKAGES MAKEFLAGS; \
$(MAKE) -s _call_image \
$(if $(PROFILE),USER_PROFILE="$(PROFILE_FILTER)") \
@@ -218,6 +246,7 @@ image:
manifest: FORCE
$(MAKE) -s _check_profile
+ $(MAKE) -s _check_keys
(unset PROFILE FILES PACKAGES MAKEFLAGS; \
$(MAKE) -s _call_manifest \
$(if $(PROFILE),USER_PROFILE="$(PROFILE_FILTER)") \