config: introduce separate CONFIG_SIGNATURE_CHECK option

Introduce a new option CONFIG_SIGNATURE_CHECK which defaults to the value
of CONFIG_SIGNED_PACKAGES and thus is enabled by default.

This option is needed to support building target opkg with enabled
signature verification while having the signed package lists disabled.

Our buildbots currently disable package signing globally in the
buildroot and SDK to avoid the need to ship private signing keys to
the build workers and to prevent the triggering of random key generation
on the worker nodes since package signing happens off-line on the master
nodes.

As unintended side-effect, updated opkg packages will get built with
disabled signature verification, hence the need for a new override option.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit f565f276e2c06ac8f3176e0b16d6f2d40cd653d4)

diff --git a/config/Config-build.in b/config/Config-build.in
index a082a5e0e2ed9ad3e9749440c3f244aee8668072..162510b646e7288cc43fcca84a5efac0d558d72c 100644 (file)
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -34,6 +34,10 @@ menu "Global build settings"
                bool "Cryptographically signed package lists"
                default y
 
+       config SIGNATURE_CHECK
+               bool "Enable signature checking in opkg"
+               default SIGNED_PACKAGES
+
        comment "General build options"
 
        config DISPLAY_SUPPORT

diff --git a/package/system/opkg/Makefile b/package/system/opkg/Makefile
index 43b9ebdb4f72589af777a6b7d8697d58edbca29d..ed3cd5ebf434e43d72831222a981a17a48a96340 100644 (file)
--- a/package/system/opkg/Makefile
+++ b/package/system/opkg/Makefile
@@ -25,7 +25,7 @@ PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 
 # Extend depends from version.mk
 PKG_CONFIG_DEPENDS += \
-       CONFIG_SIGNED_PACKAGES \
+       CONFIG_SIGNATURE_CHECK \
        CONFIG_TARGET_INIT_PATH
 
 PKG_BUILD_PARALLEL:=1
@@ -88,7 +88,7 @@ define Package/opkg/install
        $(INSTALL_DATA) ./files/opkg$(2).conf $(1)/etc/opkg.conf
        $(INSTALL_BIN) ./files/20_migrate-feeds $(1)/etc/uci-defaults/
        $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/opkg-cl $(1)/bin/opkg
-  ifneq ($(CONFIG_SIGNED_PACKAGES),)
+  ifneq ($(CONFIG_SIGNATURE_CHECK),)
        echo "option check_signature" >> $(1)/etc/opkg.conf
   endif
        $(INSTALL_DIR) $(1)/usr/sbin