packages: apply usign padding workarounds to package indexes if needed
authorJo-Philipp Wich <jo@mein.io>
Wed, 7 Aug 2019 05:15:07 +0000 (07:15 +0200)
committerJo-Philipp Wich <jo@mein.io>
Wed, 7 Aug 2019 05:15:07 +0000 (07:15 +0200)
commite1f588e446c7ceb696b644b37aeab9b3476e2a57
treec4ead1de0d49e2d4c7400aac67a50e1c80cc5943
parentf565f276e2c06ac8f3176e0b16d6f2d40cd653d4
packages: apply usign padding workarounds to package indexes if needed

Since usign miscalculates SHA-512 digests for input sizes of exactly
64 + N * 128 + 110 or 64 + N * 128 + 111 bytes, we need to apply some
white space padding to avoid triggering the hashing edge case.

While usign itself has been fixed already, there is still many firmwares
in the wild which use broken usign versions to verify current package
indexes so we'll need to carry this workaround in the forseeable future.

Ref: https://forum.openwrt.org/t/signature-check-failed/41945
Ref: https://git.openwrt.org/5a52b379902471cef495687547c7b568142f66d2
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
package/Makefile