[PATCH] conf: add src/{,gz}/trusted option
Paul Spooren
mail at aparcar.org
Tue Sep 15 21:10:41 EDT 2020
This options allows to individually disable signature checks for
individual feeds. This option should only be used for local feeds or
remote feeds downloaded via HTTPS.
Within OpenWrt this option allows ImageBuilders to verify remote feeds
while also taking local feeds into account which are unsigned.
The two new config options are:
src/trusted
src/gz/trusted
Signed-off-by: Paul Spooren <mail at aparcar.org>
---
ImageBuilders offer a folder called "packages/" which includes at least
the packages kernel_*.ipk and libc*.ipk, additionally packages provided
by the user.
It is not possible to enable signature checks within the
ImageBuilder and allow an unsigned local package feed at the same time.
This patch is an option to set the special local packages feed to
"trusted".
As an alternative, the ImageBuilder could generate usign keys which sign
the local package feed, however those keys would then also be considered
for remote feeds which seems less secure.
libopkg/opkg_cmd.c | 2 +-
libopkg/opkg_conf.c | 28 ++++++++++++++++++++++++----
libopkg/pkg_hash.c | 2 +-
libopkg/pkg_src.c | 3 ++-
libopkg/pkg_src.h | 3 ++-
libopkg/pkg_src_list.c | 4 ++--
libopkg/pkg_src_list.h | 2 +-
7 files changed, 33 insertions(+), 11 deletions(-)
diff --git a/libopkg/opkg_cmd.c b/libopkg/opkg_cmd.c
index a329558..05c0c85 100644
--- a/libopkg/opkg_cmd.c
+++ b/libopkg/opkg_cmd.c
@@ -143,7 +143,7 @@ static int opkg_update_cmd(int argc, char **argv)
}
free(url);
#if defined(HAVE_USIGN)
- if (pkglist_dl_error == 0 && conf->check_signature) {
+ if (pkglist_dl_error == 0 && conf->check_signature && ! src->trusted) {
/* download detached signitures to verify the package lists */
/* get the url for the sig file */
if (src->extra_data) /* debian style? */
diff --git a/libopkg/opkg_conf.c b/libopkg/opkg_conf.c
index 38703ee..6097588 100644
--- a/libopkg/opkg_conf.c
+++ b/libopkg/opkg_conf.c
@@ -295,7 +295,7 @@ opkg_conf_parse_file(const char *filename,
if (!nv_pair_list_find
((nv_pair_list_t *) dist_src_list, name)) {
pkg_src_list_append(dist_src_list, name,
- value, extra, 0);
+ value, extra, 0, 0);
} else {
opkg_msg(ERROR,
"Duplicate dist declaration (%s %s). "
@@ -305,7 +305,7 @@ opkg_conf_parse_file(const char *filename,
if (!nv_pair_list_find
((nv_pair_list_t *) dist_src_list, name)) {
pkg_src_list_append(dist_src_list, name,
- value, extra, 1);
+ value, extra, 1, 0);
} else {
opkg_msg(ERROR,
"Duplicate dist declaration (%s %s). "
@@ -315,7 +315,7 @@ opkg_conf_parse_file(const char *filename,
if (!nv_pair_list_find
((nv_pair_list_t *) pkg_src_list, name)) {
pkg_src_list_append(pkg_src_list, name,
- value, extra, 0);
+ value, extra, 0, 0);
} else {
opkg_msg(ERROR,
"Duplicate src declaration (%s %s). "
@@ -325,7 +325,27 @@ opkg_conf_parse_file(const char *filename,
if (!nv_pair_list_find
((nv_pair_list_t *) pkg_src_list, name)) {
pkg_src_list_append(pkg_src_list, name,
- value, extra, 1);
+ value, extra, 1, 0);
+ } else {
+ opkg_msg(ERROR,
+ "Duplicate src declaration (%s %s). "
+ "Skipping.\n", name, value);
+ }
+ } else if (strcmp(type, "src/trusted") == 0) {
+ if (!nv_pair_list_find
+ ((nv_pair_list_t *) pkg_src_list, name)) {
+ pkg_src_list_append(pkg_src_list, name,
+ value, extra, 0, 1);
+ } else {
+ opkg_msg(ERROR,
+ "Duplicate src declaration (%s %s). "
+ "Skipping.\n", name, value);
+ }
+ } else if (strcmp(type, "src/gz/trusted") == 0) {
+ if (!nv_pair_list_find
+ ((nv_pair_list_t *) pkg_src_list, name)) {
+ pkg_src_list_append(pkg_src_list, name,
+ value, extra, 1, 1);
} else {
opkg_msg(ERROR,
"Duplicate src declaration (%s %s). "
diff --git a/libopkg/pkg_hash.c b/libopkg/pkg_hash.c
index 52c64ff..21dc914 100644
--- a/libopkg/pkg_hash.c
+++ b/libopkg/pkg_hash.c
@@ -84,7 +84,7 @@ int dist_hash_add_from_file(const char *lists_dir, pkg_src_t * dist)
return -1;
}
pkg_src_list_append(&conf->pkg_src_list, subname,
- dist->value, "__dummy__", 0);
+ dist->value, "__dummy__", 0, 0);
}
free(list_file);
diff --git a/libopkg/pkg_src.c b/libopkg/pkg_src.c
index fae3ce3..dd26469 100644
--- a/libopkg/pkg_src.c
+++ b/libopkg/pkg_src.c
@@ -19,11 +19,12 @@
#include "libbb/libbb.h"
int pkg_src_init(pkg_src_t * src, const char *name, const char *base_url,
- const char *extra_data, int gzip)
+ const char *extra_data, int gzip, int trusted)
{
src->gzip = gzip;
src->name = xstrdup(name);
src->value = xstrdup(base_url);
+ src->trusted = trusted;
if (extra_data)
src->extra_data = xstrdup(extra_data);
else
diff --git a/libopkg/pkg_src.h b/libopkg/pkg_src.h
index 1320f1f..0ff2d92 100644
--- a/libopkg/pkg_src.h
+++ b/libopkg/pkg_src.h
@@ -25,10 +25,11 @@ typedef struct {
char *value;
char *extra_data;
int gzip;
+ int trusted;
} pkg_src_t;
int pkg_src_init(pkg_src_t * src, const char *name, const char *base_url,
- const char *extra_data, int gzip);
+ const char *extra_data, int gzip, int trusted);
void pkg_src_deinit(pkg_src_t * src);
#endif
diff --git a/libopkg/pkg_src_list.c b/libopkg/pkg_src_list.c
index cc24438..4ea254c 100644
--- a/libopkg/pkg_src_list.c
+++ b/libopkg/pkg_src_list.c
@@ -42,11 +42,11 @@ void pkg_src_list_deinit(pkg_src_list_t * list)
pkg_src_t *pkg_src_list_append(pkg_src_list_t * list,
const char *name, const char *base_url,
- const char *extra_data, int gzip)
+ const char *extra_data, int gzip, int trusted)
{
/* freed in pkg_src_list_deinit */
pkg_src_t *pkg_src = xcalloc(1, sizeof(pkg_src_t));
- pkg_src_init(pkg_src, name, base_url, extra_data, gzip);
+ pkg_src_init(pkg_src, name, base_url, extra_data, gzip, trusted);
void_list_append((void_list_t *) list, pkg_src);
diff --git a/libopkg/pkg_src_list.h b/libopkg/pkg_src_list.h
index 71a10f6..4e175e8 100644
--- a/libopkg/pkg_src_list.h
+++ b/libopkg/pkg_src_list.h
@@ -38,6 +38,6 @@ void pkg_src_list_deinit(pkg_src_list_t * list);
pkg_src_t *pkg_src_list_append(pkg_src_list_t * list, const char *name,
const char *root_dir, const char *extra_data,
- int gzip);
+ int gzip, int trusted);
#endif
--
2.25.1
More information about the openwrt-devel
mailing list