14119 2020-11-07 10:38:06 +0000 ipk package and package feed signing 2026-07-14 21:58:34 +0000 1 1 7 Build System, Metadata & Runtime OE-Core oe-core other 3.1.4 x86 Multiple NEW Medium enhancement 5.99 1 pokylinux pokylinux randy.macleod richard.purdie --- --- Don't know oldest_to_newest 88572 0 pokylinux 2020-11-07 10:38:06 +0000 I am playing around with ipk and signed package feeds and hit a well-known issue with Ubuntu 18: Many errors like that: ERROR: tzdata-2020a-r0 do_package_write_ipk: GPG exited with code 2: gpg: signing failed: Cannot allocate memory gpg: signing failed: Cannot allocate memory which seems to be related to that: https://github.com/sbt/sbt-pgp/issues/168 I am not quite sure, but I am afraid the build system uses gpg from my Linux disto: # gpg --version gpg (GnuPG) 2.2.4 libgcrypt 1.8.1 Copyright (C) 2017 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: /root/.gnupg Supported algorithms: Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 At the moment I build with BB_NUMBER_THREADS = "1" to avoid parallel invocations of gpg. I hope there is a better solution to this. -# Newer versions of gpg (at least 2.1.5 and 2.2.1) have issues when signing occurs in parallel -# so, unfortunately, the signing must be done serially. Once the upstream problem is fixed, -# the following line must be removed otherwise we loose all the intrinsic parallelism from -# bitbake. For more information, check https://bugzilla.yoctoproject.org/show_bug.cgi?id=12022. -do_package_write_rpm[lockfiles] += "${TMPDIR}/gpg.lock" +PACKAGE_WRITE_DEPS += "gnupg-native" Is the upstream version (gnupg-native) fixed? Can I somehow enforce the usage of gnupg-native (with a newer libcrypt) instead of gpg which comes with my Linux distro to overcome the problem? It might be that something similar was already resolved here: https://bugzilla.yoctoproject.org/show_bug.cgi?id=12022 or here: https://patchwork.openembedded.org/patch/142916/ but all this was quite some time ago and me 3.1.2 version should work. 88573 1 pokylinux 2020-11-08 03:11:04 +0000 It looks like the packages are signed, or at least each package has some .asc file now e.g. ./all/tzdata_2020a-r0.0_all.ipk.asc ./all/tzdata_2020a-r0.0_all.ipk Is this used? On the target I don't see any keys: ls /etc/opkg/ arch.conf base-feeds.conf opkg.conf ----- cat /etc/opkg/arch.conf arch all 1 arch any 6 arch noarch 11 arch armv5hf-vfp 16 arch armv5thf-vfp 21 arch armv5ehf-vfp 26 arch armv5tehf-vfp 31 arch armv6hf-vfp 36 arch armv6thf-vfp 41 arch armv7ahf-vfp 46 arch armv7at2hf-vfp 51 arch multi_v7_ml 56 ----- cat /etc/opkg/base-feeds.conf src/gz uri-all-0 http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/all src/gz uri-armv7at2hf-vfp-0 http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp src/gz uri-multi_v7_ml-0 http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/multi_v7_ml ----- cat /etc/opkg/opkg.conf # Must have one or more source entries of the form: # # src <src-name> <source-url> # # and one or more destination entries of the form: # # dest <dest-name> <target-path> # # where <src-name> and <dest-names> are identifiers that # should match [a-zA-Z0-9._-]+, <source-url> should be a # URL that points to a directory containing a Familiar # Packages file, and <target-path> should be a directory # that exists on the target system. # Proxy Support #option http_proxy http://proxy.tld:3128 #option ftp_proxy http://proxy.tld:3128 #option proxy_username <username> #option proxy_password <password> # Enable GPGME signature # option check_signature 1 # Offline mode (for use in constructing flash images offline) #option offline_root target # Default destination for installed packages dest root / option lists_dir /var/lib/opkg/lists ----- It looks like, for some reason, option check_signature 1 is not enabled by default. 88574 2 pokylinux 2020-11-08 03:15:27 +0000 after updating /etc/opkg/opkg.conf: # Enable GPGME signature option check_signature 1 opkg update Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/all/Packages.gz. Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/all/Packages.sig. wget: server returned error: HTTP/1.1 404 Not Found Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/Packages.gz. Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/Packages.sig. wget: server returned error: HTTP/1.1 404 Not Found Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/multi_v7_ml/Packages.gz. Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/multi_v7_ml/Packages.sig. wget: server returned error: HTTP/1.1 404 Not Found Collected errors: * opkg_download_backend: Failed to download http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/all/Packages.sig, wget returned 1. * pkg_src_download_signature: Failed to download signature for uri-all-0. * opkg_download_backend: Failed to download http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/Packages.sig, wget returned 1. * pkg_src_download_signature: Failed to download signature for uri-armv7at2hf-vfp-0. * opkg_download_backend: Failed to download http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/multi_v7_ml/Packages.sig, wget returned 1. * pkg_src_download_signature: Failed to download signature for uri-multi_v7_ml-0. root@multi-v7-ml:/etc/opkg# 88575 3 pokylinux 2020-11-08 06:33:46 +0000 I think first of all I would like to know what should work and how it is supposed to work. 1) GPG signed packages Are they supposed to work? How? 2) GPG signed package feed Is this supposed to work? How? At the moment I get something like this when I try to install something: root@multi-v7-ml:/etc/opkg# opkg update Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/all/Packages.gz. Updated source 'uri-all-0'. Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/Packages.gz. Updated source 'uri-armv7at2hf-vfp-0'. Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/multi_v7_ml/Packages.gz. Updated source 'uri-multi_v7_ml-0'. root@multi-v7-ml:/etc/opkg# opkg install socat Installing openssl-conf (1.1.1g) on root Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/openssl-conf_1.1.1g-r0.0_armv7at2hf-vfp.ipk. Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/openssl-conf_1.1.1g-r0.0_armv7at2hf-vfp.ipk.asc. Removing corrupt package file /var/cache/opkg/259c9a2b8ab82706cdc12418377ef39a_openssl-conf_1.1.1g-r0.0_armv7at2hf-vfp.ipk. Collected errors: * opkg_verify_gpg_signature: GPG signature checking not supported * opkg_install_pkg: Failed to download openssl-conf. Perhaps you need to run 'opkg update'? And there are more dependencies missing. Even after I install all of them I get: root@multi-v7-ml:/etc/opkg# opkg install socat Installing socat (1.7.3.4) on root Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/socat_1.7.3.4-r0.0_armv7at2hf-vfp.ipk. Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/socat_1.7.3.4-r0.0_armv7at2hf-vfp.ipk.asc. Removing corrupt package file /var/cache/opkg/e04f6b0b80a178af9a026a426dcc3e2e_socat_1.7.3.4-r0.0_armv7at2hf-vfp.ipk. Collected errors: * opkg_verify_gpg_signature: GPG signature checking not supported * opkg_install_pkg: Failed to download socat. Perhaps you need to run 'opkg update'? root@multi-v7-ml:/etc/opkg# 88576 4 pokylinux 2020-11-08 06:37:27 +0000 This might explain it: #ifdef HAVE_GPGME #include "opkg_gpg.h" #else /* Dummy gpg signature verification. */ int opkg_verify_gpg_signature(const char *file, const char *sigfile) { (void)file; (void)sigfile; opkg_msg(ERROR, "GPG signature checking not supported\n"); return -1; } #endif opkg seems to be compiled in a way that does not support GPG signatures. 88577 5 pokylinux 2020-11-08 07:31:05 +0000 a bbappend with something like this might fix the problem: PACKAGECONFIG_append += " gpg curl ssl-curl openssl sha256" 88579 6 pokylinux 2020-11-08 22:05:04 +0000 at the moment I am stuck here: root@multi-v7-ml:/etc/opkg# opkg-key list /etc/opkg/gpg/pubring.kbx ------------------------- pub rsa4096 2020-11-08 [SC] 5AF9D0B2D912A43D33D42283DDAF4E22711C5AE8 uid [ unknown] ipkkey (ipkkey) <ipkkey@reliableembeddedsystems.com> sub rsa4096 2020-11-08 [E] root@multi-v7-ml:/etc/opkg# opkg install strace Installing strace (5.5) on root Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/strace_5.5-r0.0_armv7at2hf-vfp.ipk. Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/strace_5.5-r0.0_armv7at2hf-vfp.ipk.sig. Removing corrupt package file /var/cache/opkg/8367fa7a9862abe8862f7896764b7a50_strace_5.5-r0.0_armv7at2hf-vfp.ipk. Collected errors: * opkg_verify_gpg_signature: No sufficently trusted public keys found. * opkg_install_pkg: Failed to download strace. Perhaps you need to run 'opkg update'? 88580 7 pokylinux 2020-11-08 23:16:28 +0000 something like this seems to fix it: vi /usr/bin/opkg-key echo " trust - Trust the key" trust) (echo trust &echo 5 &echo y &echo quit) | $GPG --command-fd 0 --edit-key ipkkey ;; 88581 8 pokylinux 2020-11-09 01:35:29 +0000 I somehow managed to have signed packages working now by *) adding key *) trusting key *) etc/opkg.conf changes which was achieved by additions to local.conf and opkg_%.bbappend opkg-keyrings_1.0.bbappend ---- I seriously doubt that this was (ever) tested! ---- Next up are signed package feeds, which do not work by default, most likely because the files produced by default are .asc files and opkg wants .sig by default. 88582 9 pokylinux 2020-11-09 01:36:11 +0000 forgot: *) reconfiguring opkg to use gpg 88597 10 randy.macleod 2020-11-12 15:39:52 +0000 Robert, can you send a patch? Bonus marks if there's a test to help us detect regressions. 88607 11 pokylinux 2020-11-12 17:37:23 +0000 Well things are not that simple ;) That's what I plan to do: 1) Write a series of articles what I did to get it working. Hopefully someone can review that and tell me what to improve in order to be upstreamable 2) I don't think it's just a patch, but I need: 2.1) a patch to meta/classes/sign_ipk.bbclass to use native-gpg which allows for "parallel" invocation of gpg (from multiple recipes at the same time) 2.2) a custom meta-layer with a .bbappend to 2.2.1) add the key to the rootfs 2.2.2) add to the opkg-key command a "trust" option (which should go into the main recipe as a patch?) 2.2.3) to tell opkg.conf that package signing should be enabled - maybe by default if the relevant setting in local.conf is made 2.2.4) to tell opkg.conf that package feed signing should be used - maybe by default if the relevant setting in local.conf is made 2.2.5) to tell opkg.conf that signature_type gpg (default) is used .sig - maybe by default if the relevant setting in local.conf is made -> the other option would be ascii keys The defaults between opkg and bitbake classes are exactly the opposite (ascii the one binary the other) 3) various settings in local.conf which configure package/package feed signing There are various inconsistencies between the classes and what opkg can do (as far as I understand) e.g. opkg seems to support either binary or ascii keys, but in the config I could choose binary for package signing and ascii for package feed signing. --------------- Besides I also need: 4) proper date/time on the target for gpg to work e.g. via ntp 5) gpg keys generation/export/import ---------------- So all this is a mix of documentation, configuration and patches/hacks ---------------- Once all this is done I can also have a look into a test similar to the one for rpms. 88608 12 pokylinux 2020-11-12 17:43:18 +0000 I forgot: *) a post_install_append file to also trust the key and not just add it to the system. At the moment I have this in my custom layer, but I guess this should go into the recipe instead of bbappend. *) gpg needs to be compiled with gpg support, which is not the default, but maybe could be added based on .local.conf (signing) settings. 88609 13 pokylinux 2020-11-12 17:46:29 +0000 not gpg, but opkg needs to be compiled with gpg support 89651 14 randy.macleod 2021-03-18 15:04:05 +0000 3.3 development is closed, move to 3.4 96798 15 randy.macleod 2023-10-24 14:24:20 +0000 Bulk move from 4.99 or 0.00 to 5.99 105845 16 richard.purdie 2026-06-11 15:38:54 +0000 Did you write the articles? It would be good to put the details here if there is anything further? 106167 17 pokylinux 2026-07-14 21:58:34 +0000 I did not write any articles. The only thing I have is some layer I hacked together 5 years ago: https://gitlab.com/meta-layers/meta-pkg Not sure when I will have time to play with this.