From 4a45e69d190f72ed94878487b271ed7651dd9efa Mon Sep 17 00:00:00 2001 From: Paul Spooren Date: Tue, 24 Sep 2019 12:32:54 -1000 Subject: build: separate signing logic This separates the options for signature creation and verification * SIGNED_PACKAGES create Packages.sig * SIGNED_IMAGES add ucert signature to created images * CHECK_SIGNATURE add verification capabilities to images * INSTALL_LOCAL_KEY add local key-build to /etc/opkg/keys Right now the buildbot.git contains some hacks to create images that have signature verification capabilities while not storing private keys on buildbot slaves. This commit allows to disable these steps for the buildbots and only perform signing on the master. Signed-off-by: Paul Spooren --- package/base-files/Makefile | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) (limited to 'package/base-files/Makefile') diff --git a/package/base-files/Makefile b/package/base-files/Makefile index f105d2cd27..588c958f80 100644 --- a/package/base-files/Makefile +++ b/package/base-files/Makefile @@ -37,7 +37,7 @@ endif define Package/base-files SECTION:=base CATEGORY:=Base system - DEPENDS:=+netifd +libc +procd +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool + DEPENDS:=+netifd +libc +procd +jsonfilter +SIGNATURE_CHECK:usign +SIGNATURE_CHECK:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool TITLE:=Base filesystem for OpenWrt URL:=http://openwrt.org/ VERSION:=$(PKG_RELEASE)-$(REVISION) @@ -116,12 +116,6 @@ ifdef CONFIG_SIGNED_PACKAGES $(STAGING_DIR_HOST)/bin/ucert -I -c $(BUILD_KEY).ucert -p $(BUILD_KEY).pub -s $(BUILD_KEY) endef - - define Package/base-files/install-key - mkdir -p $(1)/etc/opkg/keys - $(CP) $(BUILD_KEY).pub $(1)/etc/opkg/keys/`$(STAGING_DIR_HOST)/bin/usign -F -p $(BUILD_KEY).pub` - - endef endif ifeq ($(CONFIG_NAND_SUPPORT),) @@ -130,9 +124,16 @@ ifeq ($(CONFIG_NAND_SUPPORT),) endef endif +ifdef CONFIG_INSTALL_LOCAL_KEY + define Package/base-files/install-local-key + mkdir -p $(1)/etc/opkg/keys + $(CP) $(BUILD_KEY).pub $(1)/etc/opkg/keys/`$(STAGING_DIR_HOST)/bin/usign \ + -F -p $(BUILD_KEY).pub` +endef + define Package/base-files/install $(CP) ./files/* $(1)/ - $(Package/base-files/install-key) + $(Package/base-files/install-local-key) $(Package/base-files/nand-support) if [ -d $(GENERIC_PLATFORM_DIR)/base-files/. ]; then \ $(CP) $(GENERIC_PLATFORM_DIR)/base-files/* $(1)/; \ -- cgit v1.2.3