This separates the options for signature creation and verification
* SIGNED_PACKAGES create Packages.sig
* SIGNED_IMAGES add ucert signature to created images
* CHECK_SIGNATURE add verification capabilities to images
* INSTALL_LOCAL_KEY add local key-build to /etc/opkg/keys
Right now the buildbot.git contains some hacks to create images that
have signature verification capabilities while not storing private keys
on buildbot slaves. This commit allows to disable these steps for the
buildbots and only perform signing on the master.
Signed-off-by: Paul Spooren <mail@aparcar.org>
- Enabling per-device rootfs support
...
- Enabling per-device rootfs support
...
+ config INSTALL_LOCAL_KEY
+ bool "Install local usign key into image"
+ default n
+
config SIGNED_PACKAGES
bool "Cryptographically signed package lists"
config SIGNED_PACKAGES
bool "Cryptographically signed package lists"
+ default n
+
+ config SIGNED_IMAGES
+ bool "Cryptographically signed firmware images"
+ default n
config SIGNATURE_CHECK
bool "Enable signature checking in opkg"
config SIGNATURE_CHECK
bool "Enable signature checking in opkg"
- default SIGNED_PACKAGES
comment "General build options"
comment "General build options"
define Build/append-metadata
$(if $(SUPPORTED_DEVICES),-echo $(call metadata_json,$(SUPPORTED_DEVICES)) | fwtool -I - $@)
define Build/append-metadata
$(if $(SUPPORTED_DEVICES),-echo $(call metadata_json,$(SUPPORTED_DEVICES)) | fwtool -I - $@)
- [ ! -s "$(BUILD_KEY)" -o ! -s "$(BUILD_KEY).ucert" -o ! -s "$@" ] || { \
- cp "$(BUILD_KEY).ucert" "$@.ucert" ;\
- usign -S -m "$@" -s "$(BUILD_KEY)" -x "$@.sig" ;\
- ucert -A -c "$@.ucert" -x "$@.sig" ;\
- fwtool -S "$@.ucert" "$@" ;\
+ [ -z "$(SIGNED_IMAGES)" \
+ -o ! -s "$(BUILD_KEY)" \
+ -o ! -s "$(BUILD_KEY).ucert" \
+ -o ! -s "$@" ] || { \
+ cp "$(BUILD_KEY).ucert" "$@.ucert" ;\
+ usign -S -m "$@" -s "$(BUILD_KEY)" -x "$@.sig" ;\
+ ucert -A -c "$@.ucert" -x "$@.sig" ;\
+ fwtool -S "$@.ucert" "$@" ;\
define Package/base-files
SECTION:=base
CATEGORY:=Base system
define Package/base-files
SECTION:=base
CATEGORY:=Base system
- DEPENDS:=+netifd +libc +procd +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool
+ DEPENDS:=+netifd +libc +procd +jsonfilter +SIGNATURE_CHECK:usign +SIGNATURE_CHECK:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool
TITLE:=Base filesystem for OpenWrt
URL:=http://openwrt.org/
VERSION:=$(PKG_RELEASE)-$(REVISION)
TITLE:=Base filesystem for OpenWrt
URL:=http://openwrt.org/
VERSION:=$(PKG_RELEASE)-$(REVISION)
$(STAGING_DIR_HOST)/bin/ucert -I -c $(BUILD_KEY).ucert -p $(BUILD_KEY).pub -s $(BUILD_KEY)
endef
$(STAGING_DIR_HOST)/bin/ucert -I -c $(BUILD_KEY).ucert -p $(BUILD_KEY).pub -s $(BUILD_KEY)
endef
-
- define Package/base-files/install-key
- mkdir -p $(1)/etc/opkg/keys
- $(CP) $(BUILD_KEY).pub $(1)/etc/opkg/keys/`$(STAGING_DIR_HOST)/bin/usign -F -p $(BUILD_KEY).pub`
-
- endef
endif
ifeq ($(CONFIG_NAND_SUPPORT),)
endif
ifeq ($(CONFIG_NAND_SUPPORT),)
+ifdef CONFIG_INSTALL_LOCAL_KEY
+ define Package/base-files/install-local-key
+ mkdir -p $(1)/etc/opkg/keys
+ $(CP) $(BUILD_KEY).pub $(1)/etc/opkg/keys/`$(STAGING_DIR_HOST)/bin/usign \
+ -F -p $(BUILD_KEY).pub`
+endef
+
define Package/base-files/install
$(CP) ./files/* $(1)/
define Package/base-files/install
$(CP) ./files/* $(1)/
- $(Package/base-files/install-key)
+ $(Package/base-files/install-local-key)
$(Package/base-files/nand-support)
if [ -d $(GENERIC_PLATFORM_DIR)/base-files/. ]; then \
$(CP) $(GENERIC_PLATFORM_DIR)/base-files/* $(1)/; \
$(Package/base-files/nand-support)
if [ -d $(GENERIC_PLATFORM_DIR)/base-files/. ]; then \
$(CP) $(GENERIC_PLATFORM_DIR)/base-files/* $(1)/; \