Re: [ptxdist] [PATCH] ibrdtn: add packaging rules for IBR-DTN and dtndht

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Sun, Aug 28, 2016 at 08:36:19PM +0200, Roland Hieber wrote:
> On 28.08.2016 09:36, Robert Schwebel wrote:
> > You can use install_copy and avoid the last argument, this is the right
> > mechanism to create a directory with ownership and permissions.
> 
> Ah right thanks, it even says so in the manual :)
> 
> But thinking this through: /etc/ibrdtn/bpsec is meant to hold the
> private key and cert for the Bundle Security Protocol, which are meant
> to be generated by ibrdtn-genkey.sh, which uses openssl and hexdump to
> generate it.  So technically, IBRDTN_WITH_TLS has to select OPENSSL_BIN
> and BUSYBOX_HEXDUMP. However, if the target rootfs is read-only, running
> ibrdtn-genkey.sh on the target is futile, and in this case, those
> dependencies are unneccessary.  The key material would rather need to be
> generated at build time and/or put into projectroot/etc/ibrdtn/bpsec by
> the user.  So I'm rather thinking about adding a menuconfig option
> "install ibrdtn-genkey.sh", and let the users decide whether they want
> to generate keys on the target or deploy them via projectroot/.  I tried
> hacking the key generation into the targetinstall stage, but didn't get
> it to work, and that really seems more like a job for the configure script.

Should all devices have the same key or should each Device have its own
key? I'm don't know enough about this to make that decision.

If each device should have its own key, then take a look at what OpenSSH
does to generate its server keys:
- projectroot/etc/rc.once.d/openssh
- rules/openssh.postinst
- and the 'select RC_ONCE...' in openssh.in

rc-once is a mechanism where we remount read-write during the first boot to
do stuff that needs a writeable rootfs.

Michael

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de