[ptxdist] [PATCH 1/2] opkg: Version bump. 0.4.5 -> 0.5.0.

[ptxdist] [PATCH 1/2] opkg: Version bump. 0.4.5 -> 0.5.0.

[Christian Melki]

Various fixes and updates. Notable addition is zstd compression support.
Deprecated functions: Openssl signature validation and pathfinder
validation.
Seems the preferred validation method is using gpg.

https://git.yoctoproject.org/opkg/log/

* Remove openssl, pathfinder support.
* Disable zstd by default.
* Remove signature handling from installation.
* Remove signature handling variables from opkg.conf
* Remove signature handling variables from ptxdist internal
"prepare_work_dir.sh"

Signed-off-by: Christian Melki <christian.melki@t2data.com>
---
 projectroot/etc/opkg/opkg.conf                |  4 ---
 rules/opkg.in                                 | 33 -------------------
 rules/opkg.make                               | 26 ++-------------
 .../lib/ptxd_make_image_prepare_work_dir.sh   |  3 --
 4 files changed, 3 insertions(+), 63 deletions(-)

diff --git a/projectroot/etc/opkg/opkg.conf b/projectroot/etc/opkg/opkg.conf
index 67a64838f..dd1de5f4e 100644
--- a/projectroot/etc/opkg/opkg.conf
+++ b/projectroot/etc/opkg/opkg.conf
@@ -16,7 +16,3 @@ option info_dir /usr/share/opkg/info
 arch	@ARCH@	10
 arch	all	1
 arch	noarch	1
-
-@CHECKSIG@
-@CAPATH@
-@CAFILE@
diff --git a/rules/opkg.in b/rules/opkg.in
index c9160509c..2ab09503e 100644
--- a/rules/opkg.in
+++ b/rules/opkg.in
@@ -4,7 +4,6 @@ menuconfig OPKG
 	tristate
 	select LIBARCHIVE
 	select LIBCURL if OPKG_CURL
-	select OPENSSL if OPKG_OPENSSL
 	prompt "opkg                          "
 	help
 	  Opkg is a lightweight package management system based on Ipkg.
@@ -13,21 +12,6 @@ menuconfig OPKG
 
 if OPKG
 
-config OPKG_PATHFINDER
-	bool
-	prompt "pathfinder support"
-	# needs pathfinder-openssl
-	depends on BROKEN
-	help
-	  Pathfinder is designed to provide a mechanism for any
-	  program to perform RFC3280-compliant path validation
-	  of X.509 certificates, even when some of the intermediate
-	  certificates are not present on the local machine. It will
-	  automatically download any such certificates (and their
-	  CRLs) from the Internet as needed using the AIA and CRL
-	  distribution point extensions of the certificate it is
-	  processing.
-
 config OPKG_CURL
 	bool
 	prompt "libcurl support"
@@ -42,12 +26,6 @@ config OPKG_SHA256
 	help
 	  FIXME
 
-config OPKG_OPENSSL
-	bool
-	prompt "openssl signature checking"
-	help
-	  FIXME
-
 config OPKG_SSL_CURL
 	bool
 	prompt "libcurl certificate authentication"
@@ -97,17 +75,6 @@ config OPKG_OPKG_CONF_URL
 
 	  If you don't want to use this feature, keep the whole entry empty.
 
-config OPKG_OPKG_CONF_CHECKSIG
-	bool
-	prompt "enable repository signature checking"
-	depends on OPKG_OPENSSL
-	help
-	  Set the following options in opkg.conf:
-	     option check_signature 1
-	     option signature_ca_path /etc/ssl/certs
-	     option signature_ca_file /etc/ssl/certs/opkg.crt
-	
-	  Repository will only be used if it's signature can be validated.
 endif
 
 endif
diff --git a/rules/opkg.make b/rules/opkg.make
index 88d25ce29..0ae8b4bce 100644
--- a/rules/opkg.make
+++ b/rules/opkg.make
@@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_OPKG) += opkg
 #
 # Paths and names
 #
-OPKG_VERSION	:= 0.4.5
-OPKG_MD5	:= 5dc41ad37d88803b5e0f456a9c5a0811
+OPKG_VERSION	:= 0.5.0
+OPKG_MD5	:= b85f4bafd53d0cdffbcef178319901fa
 OPKG		:= opkg-$(OPKG_VERSION)
 OPKG_SUFFIX	:= tar.gz
 OPKG_URL	:= http://downloads.yoctoproject.org/releases/opkg/$(OPKG).$(OPKG_SUFFIX)
@@ -38,13 +38,12 @@ OPKG_CONF_OPT	:= \
 	$(GLOBAL_LARGE_FILE_OPTION) \
 	--disable-libopkg-api \
 	--disable-static \
-	--$(call ptx/endis, PTXCONF_OPKG_PATHFINDER)-pathfinder \
 	--disable-xz \
 	--disable-bzip2 \
 	--disable-lz4 \
+	--disable-zstd \
 	--$(call ptx/endis, PTXCONF_OPKG_CURL)-curl \
 	--$(call ptx/endis, PTXCONF_OPKG_SHA256)-sha256 \
-	--$(call ptx/endis, PTXCONF_OPKG_OPENSSL)-openssl \
 	--$(call ptx/endis, PTXCONF_OPKG_SSL_CURL)-ssl-curl \
 	--$(call ptx/endis, PTXCONF_OPKG_GPG)-gpg \
 	--without-static-libopkg \
@@ -76,31 +75,12 @@ endif
 
 	@$(call install_lib,  opkg, 0, 0, 0644, libopkg)
 
-ifdef PTXCONF_IMAGE_IPKG_SIGN_OPENSSL
-	@$(call install_copy, opkg, 0, 0, 0644, $(PTXCONF_IMAGE_IPKG_SIGN_OPENSSL_SIGNER), /etc/ssl/certs/opkg.crt)
-endif
-
 ifdef PTXCONF_OPKG_OPKG_CONF
 	@$(call install_alternative, opkg, 0, 0, 0644, /etc/opkg/opkg.conf)
 	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @SRC@, \
 		$(PTXCONF_OPKG_OPKG_CONF_URL))
 	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @ARCH@, \
 		$(PTXDIST_IPKG_ARCH_STRING))
-ifdef PTXCONF_OPKG_OPKG_CONF_CHECKSIG
-	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CHECKSIG@, \
-		"option check_signature 1")
-	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CAPATH@, \
-		"option signature_ca_path /etc/ssl/certs")
-	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CAFILE@, \
-		"option signature_ca_file /etc/ssl/certs/opkg.crt")
-else
-	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CHECKSIG@, \
-		"#option check_signature 0")
-	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CAPATH@, \
-		"#option signature_ca_path /etc/ssl/certs")
-	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CAFILE@, \
-		"#option signature_ca_file /etc/ssl/certs/opkg.crt")
-endif
 endif
 
 	@$(call install_finish, opkg)
diff --git a/scripts/lib/ptxd_make_image_prepare_work_dir.sh b/scripts/lib/ptxd_make_image_prepare_work_dir.sh
index fa65ce8ec..aaa676e09 100644
--- a/scripts/lib/ptxd_make_image_prepare_work_dir.sh
+++ b/scripts/lib/ptxd_make_image_prepare_work_dir.sh
@@ -39,9 +39,6 @@ ${list[*]}
 
     ARCH="${PTXDIST_IPKG_ARCH_STRING}" \
     SRC="" \
-    CHECKSIG="" \
-    CAPATH="" \
-    CAFILE="" \
 	ptxd_replace_magic "${ptxd_reply}" >> "${xpkg_conf}" &&
 
     DESTDIR="${work_dir}" \
-- 
2.34.1

[ptxdist] [PATCH 2/2] host-opkg: Follow options after upgrade of opkg.

[Christian Melki]

* Add / remove options according to the upgrade of opkg
from 0.4.5 -> 0.5.0

Signed-off-by: Christian Melki <christian.melki@t2data.com>
---
 rules/host-opkg.make | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/rules/host-opkg.make b/rules/host-opkg.make
index 68c26e48b..a8cae57ce 100644
--- a/rules/host-opkg.make
+++ b/rules/host-opkg.make
@@ -32,13 +32,12 @@ HOST_OPKG_CONF_OPT	:= \
 	$(HOST_AUTOCONF) \
 	--disable-libopkg-api \
 	--disable-static \
-	--disable-pathfinder \
 	--disable-xz \
 	--disable-bzip2 \
 	--disable-lz4 \
+	--disable-zstd \
 	--disable-curl \
 	--disable-sha256 \
-	--disable-openssl \
 	--disable-ssl-curl \
 	--disable-gpg \
 	--without-static-libopkg \
-- 
2.34.1

Re: [ptxdist] [APPLIED] opkg: Version bump. 0.4.5 -> 0.5.0.

[Michael Olbrich]

Thanks, applied as d75a073299db04d0156396098bb7e6a72c6d542a.

Michael

[sent from post-receive hook]

On Wed, 25 May 2022 11:45:22 +0200, Christian Melki <christian.melki@t2data.com> wrote:
> Various fixes and updates. Notable addition is zstd compression support.
> Deprecated functions: Openssl signature validation and pathfinder
> validation.
> Seems the preferred validation method is using gpg.
> 
> https://git.yoctoproject.org/opkg/log/
> 
> * Remove openssl, pathfinder support.
> * Disable zstd by default.
> * Remove signature handling from installation.
> * Remove signature handling variables from opkg.conf
> * Remove signature handling variables from ptxdist internal
> "prepare_work_dir.sh"
> 
> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> Message-Id: <20220513132057.1883947-1-christian.melki@t2data.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/projectroot/etc/opkg/opkg.conf b/projectroot/etc/opkg/opkg.conf
> index 67a64838ff63..dd1de5f4e2a0 100644
> --- a/projectroot/etc/opkg/opkg.conf
> +++ b/projectroot/etc/opkg/opkg.conf
> @@ -16,7 +16,3 @@ option info_dir /usr/share/opkg/info
>  arch	@ARCH@	10
>  arch	all	1
>  arch	noarch	1
> -
> -@CHECKSIG@
> -@CAPATH@
> -@CAFILE@
> diff --git a/rules/opkg.in b/rules/opkg.in
> index c9160509c366..fa913537c08d 100644
> --- a/rules/opkg.in
> +++ b/rules/opkg.in
> @@ -4,7 +4,6 @@ menuconfig OPKG
>  	tristate
>  	select LIBARCHIVE
>  	select LIBCURL if OPKG_CURL
> -	select OPENSSL if OPKG_OPENSSL
>  	prompt "opkg                          "
>  	help
>  	  Opkg is a lightweight package management system based on Ipkg.
> @@ -13,21 +12,6 @@ menuconfig OPKG
>  
>  if OPKG
>  
> -config OPKG_PATHFINDER
> -	bool
> -	prompt "pathfinder support"
> -	# needs pathfinder-openssl
> -	depends on BROKEN
> -	help
> -	  Pathfinder is designed to provide a mechanism for any
> -	  program to perform RFC3280-compliant path validation
> -	  of X.509 certificates, even when some of the intermediate
> -	  certificates are not present on the local machine. It will
> -	  automatically download any such certificates (and their
> -	  CRLs) from the Internet as needed using the AIA and CRL
> -	  distribution point extensions of the certificate it is
> -	  processing.
> -
>  config OPKG_CURL
>  	bool
>  	prompt "libcurl support"
> @@ -42,12 +26,6 @@ config OPKG_SHA256
>  	help
>  	  FIXME
>  
> -config OPKG_OPENSSL
> -	bool
> -	prompt "openssl signature checking"
> -	help
> -	  FIXME
> -
>  config OPKG_SSL_CURL
>  	bool
>  	prompt "libcurl certificate authentication"
> @@ -57,8 +35,6 @@ config OPKG_SSL_CURL
>  config OPKG_GPG
>  	bool
>  	prompt "signature checking with gpg"
> -	# gpg and openssl are mutually exclusive
> -	depends on ! OPKG_OPENSSL
>  	# needs gpgme
>  	depends on BROKEN
>  	help
> @@ -97,17 +73,6 @@ config OPKG_OPKG_CONF_URL
>  
>  	  If you don't want to use this feature, keep the whole entry empty.
>  
> -config OPKG_OPKG_CONF_CHECKSIG
> -	bool
> -	prompt "enable repository signature checking"
> -	depends on OPKG_OPENSSL
> -	help
> -	  Set the following options in opkg.conf:
> -	     option check_signature 1
> -	     option signature_ca_path /etc/ssl/certs
> -	     option signature_ca_file /etc/ssl/certs/opkg.crt
> -	
> -	  Repository will only be used if it's signature can be validated.
>  endif
>  
>  endif
> diff --git a/rules/opkg.make b/rules/opkg.make
> index 88d25ce29256..0ae8b4bce7b4 100644
> --- a/rules/opkg.make
> +++ b/rules/opkg.make
> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_OPKG) += opkg
>  #
>  # Paths and names
>  #
> -OPKG_VERSION	:= 0.4.5
> -OPKG_MD5	:= 5dc41ad37d88803b5e0f456a9c5a0811
> +OPKG_VERSION	:= 0.5.0
> +OPKG_MD5	:= b85f4bafd53d0cdffbcef178319901fa
>  OPKG		:= opkg-$(OPKG_VERSION)
>  OPKG_SUFFIX	:= tar.gz
>  OPKG_URL	:= http://downloads.yoctoproject.org/releases/opkg/$(OPKG).$(OPKG_SUFFIX)
> @@ -38,13 +38,12 @@ OPKG_CONF_OPT	:= \
>  	$(GLOBAL_LARGE_FILE_OPTION) \
>  	--disable-libopkg-api \
>  	--disable-static \
> -	--$(call ptx/endis, PTXCONF_OPKG_PATHFINDER)-pathfinder \
>  	--disable-xz \
>  	--disable-bzip2 \
>  	--disable-lz4 \
> +	--disable-zstd \
>  	--$(call ptx/endis, PTXCONF_OPKG_CURL)-curl \
>  	--$(call ptx/endis, PTXCONF_OPKG_SHA256)-sha256 \
> -	--$(call ptx/endis, PTXCONF_OPKG_OPENSSL)-openssl \
>  	--$(call ptx/endis, PTXCONF_OPKG_SSL_CURL)-ssl-curl \
>  	--$(call ptx/endis, PTXCONF_OPKG_GPG)-gpg \
>  	--without-static-libopkg \
> @@ -76,31 +75,12 @@ endif
>  
>  	@$(call install_lib,  opkg, 0, 0, 0644, libopkg)
>  
> -ifdef PTXCONF_IMAGE_IPKG_SIGN_OPENSSL
> -	@$(call install_copy, opkg, 0, 0, 0644, $(PTXCONF_IMAGE_IPKG_SIGN_OPENSSL_SIGNER), /etc/ssl/certs/opkg.crt)
> -endif
> -
>  ifdef PTXCONF_OPKG_OPKG_CONF
>  	@$(call install_alternative, opkg, 0, 0, 0644, /etc/opkg/opkg.conf)
>  	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @SRC@, \
>  		$(PTXCONF_OPKG_OPKG_CONF_URL))
>  	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @ARCH@, \
>  		$(PTXDIST_IPKG_ARCH_STRING))
> -ifdef PTXCONF_OPKG_OPKG_CONF_CHECKSIG
> -	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CHECKSIG@, \
> -		"option check_signature 1")
> -	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CAPATH@, \
> -		"option signature_ca_path /etc/ssl/certs")
> -	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CAFILE@, \
> -		"option signature_ca_file /etc/ssl/certs/opkg.crt")
> -else
> -	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CHECKSIG@, \
> -		"#option check_signature 0")
> -	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CAPATH@, \
> -		"#option signature_ca_path /etc/ssl/certs")
> -	@$(call install_replace, opkg, /etc/opkg/opkg.conf, @CAFILE@, \
> -		"#option signature_ca_file /etc/ssl/certs/opkg.crt")
> -endif
>  endif
>  
>  	@$(call install_finish, opkg)
> diff --git a/scripts/lib/ptxd_make_image_prepare_work_dir.sh b/scripts/lib/ptxd_make_image_prepare_work_dir.sh
> index fa65ce8ec3e1..aaa676e09544 100644
> --- a/scripts/lib/ptxd_make_image_prepare_work_dir.sh
> +++ b/scripts/lib/ptxd_make_image_prepare_work_dir.sh
> @@ -39,9 +39,6 @@ ${list[*]}
>  
>      ARCH="${PTXDIST_IPKG_ARCH_STRING}" \
>      SRC="" \
> -    CHECKSIG="" \
> -    CAPATH="" \
> -    CAFILE="" \
>  	ptxd_replace_magic "${ptxd_reply}" >> "${xpkg_conf}" &&
>  
>      DESTDIR="${work_dir}" \

Re: [ptxdist] [APPLIED] host-opkg: Follow options after upgrade of opkg.

[Michael Olbrich]

Thanks, applied as 4248c22e09f5e5c502aba29b299d2eb006767a87.

Michael

[sent from post-receive hook]

On Wed, 25 May 2022 11:45:23 +0200, Christian Melki <christian.melki@t2data.com> wrote:
> * Add / remove options according to the upgrade of opkg
> from 0.4.5 -> 0.5.0
> 
> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> Message-Id: <20220513132057.1883947-2-christian.melki@t2data.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/host-opkg.make b/rules/host-opkg.make
> index 68c26e48b4a5..a8cae57ce031 100644
> --- a/rules/host-opkg.make
> +++ b/rules/host-opkg.make
> @@ -32,13 +32,12 @@ HOST_OPKG_CONF_OPT	:= \
>  	$(HOST_AUTOCONF) \
>  	--disable-libopkg-api \
>  	--disable-static \
> -	--disable-pathfinder \
>  	--disable-xz \
>  	--disable-bzip2 \
>  	--disable-lz4 \
> +	--disable-zstd \
>  	--disable-curl \
>  	--disable-sha256 \
> -	--disable-openssl \
>  	--disable-ssl-curl \
>  	--disable-gpg \
>  	--without-static-libopkg \