buildbot/scripts/signall.sh, branch v28

scripts: signall: skip updating hash of previous kmods/

2024-11-18T08:08:57Z

Handle case where a sha256sums might contain previous kmods/. In such case packages.adb for previous kmods/ needs to be skipped as not included in the sign tar and already signed by previous runs. Skip is limited to kmods/ entry as those are the only entry expected to be present in the sha256sums but not included in sign tar. Signed-off-by: Christian Marangi

Allow signing of artifacts with key provided by GPG agent

2024-11-05T05:07:59Z

In our case the GPG agent serves 0x1D53D1877742E911 key stored on Nitrokey3 USB dongle. GPG key is bind mounted from the host. References: https://lists.openwrt.org/pipermail/openwrt-devel/2023-May/041044.html Signed-off-by: Petr Štetiar

scripts: signall: silence pushd/popd directory changes

2024-11-04T20:35:37Z

Its not needed to have those visible in the job output as it might be misleading. Signed-off-by: Petr Štetiar

scripts: signall: fix finish function not called when apk adbsign failed

2024-09-29T18:21:02Z

The `finish 3` was not being called when the `apk adbsign` command failed within the `find` command using `-exec`. This happened because `find` does not exit with a non-zero status when the command executed by `-exec` fails, so the `|| finish 3` condition was not triggered. So lets replace the `find ... -exec ...` construct with a loop and call `finish 3` immediately if it fails. Fixes: a94d4e15fdc1 ("add APK signing logic") Signed-off-by: Petr Štetiar

scripts: signall: fix wrong sha256sum on apk packages.adb index

2024-09-29T17:59:15Z

Currently the sha256sum verification of apk's packages.adb index fails as the file is modified with `apk adbsign`. So lets update sha256sum of all packages.adb indexes after they were signed with `apk adbsign`. While at it fix formatting. Fixes: a94d4e15fdc1 ("add APK signing logic") Signed-off-by: Petr Štetiar

scripts: signall: fix wrong GPG signature on apk packages.adb index

2024-09-28T17:10:39Z

Currently the GPG signature verification of apk's packages.adb index fails as the file is modified with `apk adbsign` after its GPG signed. So lets fix it by moving the `apk adbsign` before the GPG signing step. Fixes: a94d4e15fdc1 ("add APK signing logic") Signed-off-by: Petr Štetiar

add APK signing logic

2024-08-10T11:19:10Z

With this commit it's possible to sign APK package indexes (packages.adb) via the `signall.sh` script, which is run on the buildmaster. As a consequence `apk` must be available on the buildmaster. This is the final step to replace OPKG with APK. Signed-off-by: Paul Spooren

scripts/signall.sh: make branch aware

2023-05-15T15:36:01Z

This commit is a NO-OP if signall.sh is called with a single argument, as is currently done, and will allow fetching branch-specific signing credentials if a branch name is passed as second argument. Signed-off-by: Thibaut VARÈNE

scripts: signall.sh store usign.key as usign.sec

2020-02-02T18:26:05Z

The signall.sh script signs all files inside a tar via GPG and signify-openbsd (similar to usign)e and attaches the signatures to the same archive. Using more recent versions of signify-openbsd requires a specific naming schema for keys, private ending with .sec and public with .pub. This was introduced at 763e1148f68f03cb2fa85d022500acf8c66af222[0]. This patch renames the stored key as usign.sec instead of usign.key. As of the temporary nature of the key storing, this very unlikely breaks any existing setups. [0]: https://github.com/openbsd/src/commit/763e1148f68f03cb2fa85d022500acf8c66af222 Signed-off-by: Paul Spooren [adjusted commit subject] Signed-off-by: Jo-Philipp Wich

scripts: signall.sh: use absolute paths when invoking gpg from find

2019-07-17T06:13:24Z

Signed-off-by: Jo-Philipp Wich