catspeed-cc/openwrt
1
1
Fork 0
Code

sdk: add support to sign each .apk package by sdk

Browse Source 
Add support to signing each package's .apk file into SDK.
This adds into SDK the feature added by f20794a to the normal builds.

Currently SDK does not sign the compiled packages, causing untrusted
package errors at package installation. The reason is the logic of
defaulting to 'n' in BUILDBOT and 'y' elsewhere. As downloadable SDKs
are compiled by the buildbot, the option gets 'n' set as the default.
And the option is not among the few build options exposed in the SDK
menuconfig, so the user can't easily change it.

Enable the feature by default:

* Exclude the SIGN_EACH_PACKAGE option from sdk/convert-config.pl
* Default to 'y' and expose the option in the SDK config menu.

(Avoiding untrusted errors naturally requires the user to copy the
public key into the router, quite similar as with full builds.)

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/23104
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
This commit is contained in:
Hannu Nyman 2026-04-26 21:16:48 +03:00 committed by Robert Marko
parent 30c4c4301e
commit 9a6c754d7d
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
target/sdk/convert-config.pl
View File

@ -8,6 +8,7 @@ while (<>) {
my $type; my $type;
chomp; chomp;
next if /^CONFIG_SIGNED_PACKAGES/; next if /^CONFIG_SIGNED_PACKAGES/;
next if /^CONFIG_SIGN_EACH_PACKAGE/;
if (/^CONFIG_((BINARY)|(DOWNLOAD))_FOLDER=(.*)$/) { if (/^CONFIG_((BINARY)|(DOWNLOAD))_FOLDER=(.*)$/) {
# We don't want to preserve the build setting of # We don't want to preserve the build setting of

9
target/sdk/files/Config.in
View File

@ -18,6 +18,15 @@ menu "Global build settings"
bool "Cryptographically sign package lists" bool "Cryptographically sign package lists"
default y default y
config SIGN_EACH_PACKAGE
bool "Cryptographically sign each package .apk file"
depends on USE_APK
default y
help
Sign also the individual package .apk file. Removes the need for
--allow-untrusted when installing self-compiled packages to a
firmware compiled by the same buildhost as public key matches.
comment "General build options" comment "General build options"
config BUILD_PATENTED config BUILD_PATENTED