Bug 14119

It looks like the packages are signed, or at least each package has some .asc file now

e.g.

./all/tzdata_2020a-r0.0_all.ipk.asc
./all/tzdata_2020a-r0.0_all.ipk

Is this used?

On the target I don't see any keys:

ls /etc/opkg/
arch.conf        base-feeds.conf  opkg.conf 

-----
cat /etc/opkg/arch.conf 
arch all 1
arch any 6
arch noarch 11
arch armv5hf-vfp 16
arch armv5thf-vfp 21
arch armv5ehf-vfp 26
arch armv5tehf-vfp 31
arch armv6hf-vfp 36
arch armv6thf-vfp 41
arch armv7ahf-vfp 46
arch armv7at2hf-vfp 51
arch multi_v7_ml 56
-----
cat /etc/opkg/base-feeds.conf
src/gz uri-all-0 http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/all
src/gz uri-armv7at2hf-vfp-0 http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp
src/gz uri-multi_v7_ml-0 http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/multi_v7_ml
-----
cat /etc/opkg/opkg.conf 
# Must have one or more source entries of the form:
#
#   src <src-name> <source-url>
#
# and one or more destination entries of the form:
#
#   dest <dest-name> <target-path>
#
# where <src-name> and <dest-names> are identifiers that
# should match [a-zA-Z0-9._-]+, <source-url> should be a
# URL that points to a directory containing a Familiar
# Packages file, and <target-path> should be a directory
# that exists on the target system.

# Proxy Support
#option http_proxy http://proxy.tld:3128
#option ftp_proxy http://proxy.tld:3128
#option proxy_username <username>
#option proxy_password <password>

# Enable GPGME signature
# option check_signature 1

# Offline mode (for use in constructing flash images offline)
#option offline_root target

# Default destination for installed packages
dest root /
option lists_dir /var/lib/opkg/lists
-----

It looks like, for some reason, option check_signature 1 is not enabled by default.

after updating /etc/opkg/opkg.conf:

# Enable GPGME signature
option check_signature 1

opkg update
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/all/Packages.gz.
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/all/Packages.sig.
wget: server returned error: HTTP/1.1 404 Not Found
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/Packages.gz.
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/Packages.sig.
wget: server returned error: HTTP/1.1 404 Not Found
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/multi_v7_ml/Packages.gz.
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/multi_v7_ml/Packages.sig.
wget: server returned error: HTTP/1.1 404 Not Found
Collected errors:
 * opkg_download_backend: Failed to download http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/all/Packages.sig, wget returned 1.
 * pkg_src_download_signature: Failed to download signature for uri-all-0.
 * opkg_download_backend: Failed to download http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/Packages.sig, wget returned 1.
 * pkg_src_download_signature: Failed to download signature for uri-armv7at2hf-vfp-0.
 * opkg_download_backend: Failed to download http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/multi_v7_ml/Packages.sig, wget returned 1.
 * pkg_src_download_signature: Failed to download signature for uri-multi_v7_ml-0.
root@multi-v7-ml:/etc/opkg#

I think first of all I would like to know what should work and how it is supposed to work.

1) GPG signed packages 

Are they supposed to work?

How?

2) GPG signed package feed

Is this supposed to work?

How?

At the moment I get something like this when I try to install something:

root@multi-v7-ml:/etc/opkg# opkg update
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/all/Packages.gz.
Updated source 'uri-all-0'.
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/Packages.gz.
Updated source 'uri-armv7at2hf-vfp-0'.
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/multi_v7_ml/Packages.gz.
Updated source 'uri-multi_v7_ml-0'.


root@multi-v7-ml:/etc/opkg# opkg install socat
Installing openssl-conf (1.1.1g) on root
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/openssl-conf_1.1.1g-r0.0_armv7at2hf-vfp.ipk.
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/openssl-conf_1.1.1g-r0.0_armv7at2hf-vfp.ipk.asc.
Removing corrupt package file /var/cache/opkg/259c9a2b8ab82706cdc12418377ef39a_openssl-conf_1.1.1g-r0.0_armv7at2hf-vfp.ipk.
Collected errors:
 * opkg_verify_gpg_signature: GPG signature checking not supported
 * opkg_install_pkg: Failed to download openssl-conf. Perhaps you need to run 'opkg update'?

And there are more dependencies missing.
Even after I install all of them I get:

root@multi-v7-ml:/etc/opkg# opkg install socat
Installing socat (1.7.3.4) on root
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/socat_1.7.3.4-r0.0_armv7at2hf-vfp.ipk.
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/socat_1.7.3.4-r0.0_armv7at2hf-vfp.ipk.asc.
Removing corrupt package file /var/cache/opkg/e04f6b0b80a178af9a026a426dcc3e2e_socat_1.7.3.4-r0.0_armv7at2hf-vfp.ipk.
Collected errors:
 * opkg_verify_gpg_signature: GPG signature checking not supported
 * opkg_install_pkg: Failed to download socat. Perhaps you need to run 'opkg update'?
root@multi-v7-ml:/etc/opkg#

This might explain it:

#ifdef HAVE_GPGME
#include "opkg_gpg.h"
#else
/* Dummy gpg signature verification. */
int opkg_verify_gpg_signature(const char *file, const char *sigfile)
{
    (void)file;
    (void)sigfile;

    opkg_msg(ERROR, "GPG signature checking not supported\n");
    return -1;
}
#endif


opkg seems to be compiled in a way that does not support GPG signatures.

a bbappend with something like this might fix the problem:

PACKAGECONFIG_append += " gpg curl ssl-curl openssl sha256"

at the moment I am stuck here:

root@multi-v7-ml:/etc/opkg# opkg-key list
/etc/opkg/gpg/pubring.kbx
-------------------------
pub   rsa4096 2020-11-08 [SC]
      5AF9D0B2D912A43D33D42283DDAF4E22711C5AE8
uid           [ unknown] ipkkey (ipkkey) <ipkkey@reliableembeddedsystems.com>
sub   rsa4096 2020-11-08 [E]

root@multi-v7-ml:/etc/opkg# opkg install strace
Installing strace (5.5) on root
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/strace_5.5-r0.0_armv7at2hf-vfp.ipk.
Downloading http://192.168.42.1/imx6q-phytec-mira-rdk-nand/core-image-minimal-package-repo/3.1.2/core-image-minimal-package-ipk/armv7at2hf-vfp/strace_5.5-r0.0_armv7at2hf-vfp.ipk.sig.
Removing corrupt package file /var/cache/opkg/8367fa7a9862abe8862f7896764b7a50_strace_5.5-r0.0_armv7at2hf-vfp.ipk.
Collected errors:
 * opkg_verify_gpg_signature: No sufficently trusted public keys found.
 * opkg_install_pkg: Failed to download strace. Perhaps you need to run 'opkg update'?

something like this seems to fix it:

vi /usr/bin/opkg-key

echo "  trust               - Trust the key"

   trust)
        (echo trust &echo 5 &echo y &echo quit) | $GPG --command-fd 0 --edit-key ipkkey
        ;;

I somehow managed to have signed packages working now by 

*) adding key
*) trusting key
*) etc/opkg.conf changes

which was achieved by 

additions to local.conf 

and 

opkg_%.bbappend  
opkg-keyrings_1.0.bbappend

----

I seriously doubt that this was (ever) tested!

----

Next up are signed package feeds, which do not work by default, most likely because the files produced by default are .asc files and opkg wants .sig by default.

forgot:

*) reconfiguring opkg to use gpg

Robert, can you send a patch? Bonus marks if there's a test to help us detect regressions.

Well things are not that simple ;)

That's what I plan to do:

1) Write a series of articles what I did to get it working.

Hopefully someone can review that and tell me what to improve in order to be upstreamable

2) I don't think it's just a patch, but I need:

2.1) a patch to meta/classes/sign_ipk.bbclass to use native-gpg which allows for "parallel" invocation of gpg (from multiple recipes at the same time)

2.2) a custom meta-layer with a .bbappend to 

2.2.1) add the key to the rootfs

2.2.2) add to the opkg-key command a "trust" option (which should go into the main recipe as a patch?)

2.2.3) to tell opkg.conf that package signing should be enabled - maybe by default if the relevant setting in local.conf is made

2.2.4) to tell opkg.conf that package feed signing should be used - maybe by default if the relevant setting in local.conf is made

2.2.5) to tell opkg.conf that signature_type gpg (default) is used .sig - maybe by default if the relevant setting in local.conf is made -> the other option would be ascii keys

The defaults between opkg and bitbake classes are exactly the opposite (ascii the one binary the other)

3) various settings in local.conf which configure package/package feed signing

There are various inconsistencies between the classes and what opkg can do (as far as I understand) e.g. opkg seems to support either binary or ascii keys, but in the config I could choose binary for package signing and ascii for package feed signing.

---------------

Besides I also need:

4) proper date/time on the target for gpg to work e.g. via ntp

5) gpg keys generation/export/import

----------------

So all this is a mix of documentation, configuration and patches/hacks

----------------

Once all this is done I can also have a look into a test similar to the one for rpms.

I forgot:

*) a post_install_append file to also trust the key and not just add it to the system.

At the moment I have this in my custom layer, but I guess this should go into the recipe instead of bbappend.

*) gpg needs to be compiled with gpg support, which is not the default, but maybe could be added based on .local.conf (signing) settings.

not gpg, but opkg needs to be compiled with gpg support

3.3 development is closed, move to 3.4

Bulk move from 4.99 or 0.00 to 5.99

Did you write the articles? It would be good to put the details here if there is anything further?

I did not write any articles. The only thing I have is some layer I hacked together 5 years ago: https://gitlab.com/meta-layers/meta-pkg

Not sure when I will have time to play with this.