opkg: Add option to enable package verification support with GnuPG

This set of patches enables the opkg support for verifying package signatures with gnupg.

The first two patches add the required libraries (libassuan and libgpgme). The third adds new option: opkg-gnupg-support. It selects the needed packages and sets the --enable-gpg configure option for opkg.

The patch dependency chain is:
(0003) opkg -> (0002) libgpgme -> (0001) libassuan

Comments are welcome.

Quoted 2 lines

Thanks, they look (almost) good! Could you submit them, one mail per patch, preferably using git send-email?

Never used that and having my mail server password (--smtp-pass) logged in .bash_history does not sound too appealing. Is there a good reason to use it?

Quoted 2 lines

On libassuan, please wrap the help text, and add a final newline at the end of the .mk file.

80 columns in 2013? Anyway, it will be fixed.

Quoted 2 lines

On libgpgme, please wrap the help text, add the final newline at the end of the .mk file.

Will be fixed.

Quoted 6 lines

The --with-gpg=/usr/bin/gpg doesn't look very
good. gpg is not a mandatory dependency of Buildroot, so if libgpgme really needs gpg, then we should build host-gnupg I guess. But does it really need it? Can you detail this --with-gpg option? Or maybe it's just the path where gpg will be installed on the target? If it's the case, then maybe a comment would be appropriate to clarify this.

It is the install path on the target. Will add a comment.

Quoted 3 lines

In the opkg patch, in the .mk file, you should use BR2_PACKAGE_OPKG_GPG_SIGN in your condition rather than BR2_PACKAGE_LIBGPGME.

Oops, this is a leftover from testing. Will be fixed.

Quoted 5 lines

Also, in your Config.in, you add GNUPG as a
dependency, but it is not listed in the .mk file. This is sometimes correct if it is only a runtime dependency, in which case we usually put a comment in the Config.in just above the corresponding select line.

The dependencies are a little strange. Neither the libs nor opkg actually require gnupg to build, but libgpgme and therefore opkg signature support don't work without the binary in place. libassuan is standalone.

My solution is to hide (depends on) libgpgme if gnupg is not selected (because it makes no sense without), but force gpg and libgpgme on if you want opkg signature support. This option is intended as a user friendly way to select all you need for it.

As an alternative it would be possible to make libgpg always visible and let it automatically select gnupg.

Signed-off-by Philipp Claves <[email protected]>

---
 package/opkg/Config.in | 9 +++++++++
 package/opkg/opkg.mk   | 9 ++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

package/opkg/Config.in +9 -0

index eb997a7..b8b4a13 100644
@@ -11,3 +11,12 @@ config BR2_PACKAGE_OPKG
 
 	  http://code.google.com/p/opkg/
 
+if BR2_PACKAGE_OPKG
+
+config BR2_PACKAGE_OPKG_GPG_SIGN
+	bool "opkg-gnupg-support"
+	select BR2_PACKAGE_LIBGPGME
+	help
+	  Enable opkg package signature checking support using gnupg/libgpgme.
+
+endif

package/opkg/opkg.mk +8 -1

index 9932d3f..3c53299 100644
@@ -9,7 +9,7 @@ OPKG_SOURCE = opkg-$(OPKG_VERSION).tar.gz
 OPKG_SITE = http://opkg.googlecode.com/svn/trunk/
 OPKG_SITE_METHOD = svn
 OPKG_INSTALL_STAGING = YES
-OPKG_CONF_OPT = --disable-curl --disable-gpg
+OPKG_CONF_OPT = --disable-curl
 OPKG_AUTORECONF = YES
 # Uses PKG_CHECK_MODULES() in configure.ac
 OPKG_DEPENDENCIES = host-pkgconf

@@ -19,6 +19,13 @@ define OPKG_CREATE_LOCKDIR
 	mkdir -p $(TARGET_DIR)/usr/lib/opkg
 endef
 
+ifeq ($(BR2_PACKAGE_OPKG_GPG_SIGN),y)
+	OPKG_CONF_OPT += --enable-gpg
+	OPKG_DEPENDENCIES += libgpgme
+else
+	OPKG_CONF_OPT += --disable-gpg
+endif
+
 OPKG_POST_INSTALL_TARGET_HOOKS += OPKG_CREATE_LOCKDIR
 
 $(eval $(autotools-package))

Any status update on merging this patchset?

Quoted 1 line · Philipp Claves

Any status update on merging this patchset?

Thomas sent comments about your patches and we assumed you would that
re-send them taking into account the review feedback. If you are not planning to send updated patches, please tell us. Then somebody else may pick up the patches (but don't count on it).

Dear Arnout Vandecappelle,

Quoted 8 lines · Arnout Vandecappelle

Quoted 2 lines · Philipp Claves

Any status update on merging this patchset?

Thomas sent comments about your patches and we assumed you would that

re-send them taking into account the review feedback. If you are not planning to send updated patches, please tell us. Then somebody else may pick up the patches (but don't count on it).

I sent some comments on March, 1st at 11 AM, and at 2 PM on the same day, Philipp resubmitted updated versions of his patches. I haven't reviewed the latest version from Philipp. So I think that the ball is on our side (Buildroot reviewers) and not on Philipp side.

Thomas

Signed-off-by Philipp Claves <[email protected]>

---
 package/Config.in              |  1 +
 package/libassuan/Config.in    | 10 ++++++++++
 package/libassuan/libassuan.mk | 15 +++++++++++++++
 3 files changed, 26 insertions(+)
 create mode 100644 package/libassuan/Config.in
 create mode 100644 package/libassuan/libassuan.mk