summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorHaris Okanovic <haris.okanovic@ni.com>2019-11-07 16:07:36 -0600
committerRichard Purdie <richard.purdie@linuxfoundation.org>2019-11-10 14:06:10 +0000
commitdfb8d75ae650cdf3b304211d908c8cc53ac384df (patch)
treeca8229ce0773b6f1830c34e1f581964ab2749916 /meta
parentad34c73cbf2099ee1e70e99ea63f6cec930c597c (diff)
downloadpoky-dfb8d75ae650cdf3b304211d908c8cc53ac384df.tar.gz
meta/lib/oe/package_manager.py: Enable sha256 checksums in opkg indexer
Pass `--checksum md5` and `--checksum sha256` to opkg-make-index. Sha256 checksum enables more reliable install-time validation of IPKs. This is particularly useful when installing from signed feeds -- I.e. feeds using signed Packages index files that deliver otherwise unsigned IPKs. Such feeds rely on hash validation of enclosed IPKs to thwart tampering. After download, opkg verifies IPK's checksum against the (signed) Packages index file. Weak hashes like md5 are prone to collision and therefore tampering. The md5 checksum is purely for backward compatibility. Sha256 validation was recently added to opkg. Newer builds of opkg will use it. Older builds still look for an md5 checksum. Md5 is deprecated and should be removed once old build are phased out. Testing: I ran `bitbake package-index` after building a few IPKs and verified MD5Sum and SHA256sum attributes are present in Packages. Using opkg-utils 0.4.0. Performance Impact: It takes about 40 seconds to cleanly re-index 8000 IPKs on an Intel Xeon E5-1620 machine. This was previously about 20 seconds. NOTE: It's recommended to delete all Packages* files after applying this patch. Otherwise, some IPKs won't have sha256. (From OE-Core rev: e462f47489f35902b6972f9837d9adfa542fc796) Signed-off-by: Haris Okanovic <haris.okanovic@ni.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/lib/oe/package_manager.py2
1 files changed, 1 insertions, 1 deletions
diff --git a/meta/lib/oe/package_manager.py b/meta/lib/oe/package_manager.py
index c7135ce918..4ff19cf09c 100644
--- a/meta/lib/oe/package_manager.py
+++ b/meta/lib/oe/package_manager.py
@@ -217,7 +217,7 @@ class OpkgIndexer(Indexer):
217 if not os.path.exists(pkgs_file): 217 if not os.path.exists(pkgs_file):
218 open(pkgs_file, "w").close() 218 open(pkgs_file, "w").close()
219 219
220 index_cmds.add('%s -r %s -p %s -m %s' % 220 index_cmds.add('%s --checksum md5 --checksum sha256 -r %s -p %s -m %s' %
221 (opkg_index_cmd, pkgs_file, pkgs_file, pkgs_dir)) 221 (opkg_index_cmd, pkgs_file, pkgs_file, pkgs_dir))
222 222
223 index_sign_files.add(pkgs_file) 223 index_sign_files.add(pkgs_file)