ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2025-02-22 10:01:03 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

apk: limit CONFIG_IPK_FILES_CHECKSUMS config to OPKG

Browse Source 
Limit CONFIG_IPK_FILES_CHECKSUMS config to OPKG as APK have different
way to validate package integrity (apk audit)

Link: https://github.com/openwrt/openwrt/pull/15543
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
This commit is contained in:
Christian Marangi 2024-05-26 19:54:29 +02:00
parent 8ca2e2852e
commit 25bbefcdd9
No known key found for this signature in database
GPG Key ID: AC001D09ADBFEAD7
3 changed files with 18 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
config/Config-build.in
View File

@ -113,6 +113,7 @@ menu "Global build settings"
config IPK_FILES_CHECKSUMS config IPK_FILES_CHECKSUMS
bool bool
prompt "Record files checksums in package metadata" prompt "Record files checksums in package metadata"
depends on !USE_APK
help help
This makes file checksums part of package metadata. It increases size This makes file checksums part of package metadata. It increases size
but provides you with pkg_check command to check for flash corruptions. but provides you with pkg_check command to check for flash corruptions.

13
include/package-pack.mk
View File

@ -226,15 +226,6 @@ endif
$(RSTRIP) $$(IDIR_$(1)) $(RSTRIP) $$(IDIR_$(1))
ifneq ($$(CONFIG_IPK_FILES_CHECKSUMS),)
(cd $$(IDIR_$(1)); \
( \
find . -type f \! -path ./CONTROL/\* -exec $(MKHASH) sha256 -n \{\} \; 2> /dev/null | \
sed 's|\([[:blank:]]\)\./| \1/|' > $$(IDIR_$(1))/CONTROL/files-sha256sum \
) || true \
)
endif
ifneq ($$(KEEP_$(1)),) ifneq ($$(KEEP_$(1)),)
@( \ @( \
keepfiles=""; \ keepfiles=""; \
@ -329,6 +320,10 @@ else
rm -rf $$(IDIR_$(1))/CONTROL/conffiles; \ rm -rf $$(IDIR_$(1))/CONTROL/conffiles; \
fi fi
ifneq ($$(CONFIG_IPK_FILES_CHECKSUMS),)
if [ -f $$(IDIR_$(1))/CONTROL/files-sha256sum ]; then mv -f $$(IDIR_$(1))/CONTROL/files-sha256sum $$(IDIR_$(1))/lib/apk/packages/$(1).files-sha256sum; fi
endif
if [ -z "$$$$(ls -A $$(IDIR_$(1))/CONTROL 2>/dev/null)" ]; then \ if [ -z "$$$$(ls -A $$(IDIR_$(1))/CONTROL 2>/dev/null)" ]; then \
rm -rf $$(IDIR_$(1))/CONTROL; \ rm -rf $$(IDIR_$(1))/CONTROL; \
else \ else \

19
package/base-files/files/sbin/pkg_check
View File

@ -23,6 +23,13 @@ MISSING=""
SUMMARY="" SUMMARY=""
NL=" NL="
" "
if [ -d /usr/lib/opkg ]; then
IPKG_INFO_DIR=/usr/lib/opkg/info
elif [ -d /lib/apk ];
IPKG_INFO_DIR=/lib/apk/packages
else
exti 1
fi
# Arguments parsing # Arguments parsing
while expr "x$1" : "x-" > /dev/null; do while expr "x$1" : "x-" > /dev/null; do
@ -49,12 +56,12 @@ done
# Check all packages by default # Check all packages by default
if [ -z "$1" ]; then if [ -z "$1" ]; then
set $(cd /usr/lib/opkg/info/; for i in *.files-sha256sum; do basename $i .files-sha256sum; done) set $(cd $IPKG_INFO_DIR; for i in *.files-sha256sum; do basename $i .files-sha256sum; done)
fi fi
# Iterate over packages # Iterate over packages
while [ "$1" ]; do while [ "$1" ]; do
if [ \! -f "/usr/lib/opkg/info/$1.files-sha256sum" ]; then if [ \! -f "$IPKG_INFO_DIR/$1.files-sha256sum" ]; then
if [ "$ERRFATAL" = no ]; then if [ "$ERRFATAL" = no ]; then
echo " * No checksums for $1 - skipping" echo " * No checksums for $1 - skipping"
echo echo
@ -72,13 +79,13 @@ while [ "$1" ]; do
fi fi
[ $QUIET = yes ] || echo " * Checking package $1:" [ $QUIET = yes ] || echo " * Checking package $1:"
ERR="" ERR=""
CHECK="$(sha256sum -c /usr/lib/opkg/info/$1.files-sha256sum 2> /dev/null)" CHECK="$(sha256sum -c $IPKG_INFO_DIR/$1.files-sha256sum 2> /dev/null)"
# Are the changed files config files? # Are the changed files config files?
if [ $? -ne 0 ] && [ "$(cat "/usr/lib/opkg/info/$1.files-sha256sum")" ]; then if [ $? -ne 0 ] && [ "$(cat "$IPKG_INFO_DIR/$1.files-sha256sum")" ]; then
NEWCHECK="$(echo "$CHECK" | grep '^.*: OK$')" NEWCHECK="$(echo "$CHECK" | grep '^.*: OK$')"
for i in $(echo "$CHECK" | sed -n 's|^\(.*\): FAILED$|\1|p'); do for i in $(echo "$CHECK" | sed -n 's|^\(.*\): FAILED$|\1|p'); do
if [ "$(grep "^$i\$" "/usr/lib/opkg/info/$1.conffiles" 2> /dev/null)" ] || \ if [ "$(grep "^$i\$" "$IPKG_INFO_DIR/$1.conffiles" 2> /dev/null)" ] || \
[ "$(echo "$i" | grep "^/etc/uci-defaults/")" ]; then [ "$(echo "$i" | grep "^/etc/uci-defaults/")" ]; then
NEWCHECK="${NEWCHECK}${NL}${i}: CONFIGURED" NEWCHECK="${NEWCHECK}${NL}${i}: CONFIGURED"
else else
@ -91,7 +98,7 @@ while [ "$1" ]; do
# Do we have changed files or not? # Do we have changed files or not?
if [ -z "$ERR" ]; then if [ -z "$ERR" ]; then
[ $QUIET = yes ] || [ ! -s "/usr/lib/opkg/info/$1.files-sha256sum" ] || echo "$CHECK" | sed 's|^| - |' [ $QUIET = yes ] || [ ! -s "$IPKG_INFO_DIR/$1.files-sha256sum" ] || echo "$CHECK" | sed 's|^| - |'
[ $QUIET = yes ] || echo " * Package $1 is ok" [ $QUIET = yes ] || echo " * Package $1 is ok"
[ $QUIET = yes ] || echo [ $QUIET = yes ] || echo
else else