[ptxdist] Do ipkg-push with SHA256 checksums

[ptxdist] Do ipkg-push with SHA256 checksums

[Simon Falsig]

Hi,

I'm trying to setup ipkg-push to repository, generating a signed Packages list with SHA256 checksums (using opkg, and the --checksum SHA256 parameter). From what I can see though, the ipkg-push is done by scripts/ipkg-push, which doesn't have a way of setting the checksum type, and just calls ${TYPE}-make-index without any parameters. I can easily hack something together to make this work for me (by just modifying the ipkg-push script), but is there a more correct way?

Judging from the ipkg-push file, it's made to support not just opkg, but also ipkg, which I don't think supports the SHA256 checksum. So just blindly adding the checksum parameter to the commandline would not maintain the generic support. On the other hand, I haven't found any other users of the script than ones where it's called with opkg as the type.

Suggestions:
- Make ipkg-push just support opkg, and allow the checksumtype to be specified as a parameter to the script (image_ipkg.make already generates the local using opkg-make-index only)
- Maintain ipkg/opkg support by making some more elaborate parameters (for instance an "make-index-extra" that is then just passed from ipkg-push to ${TYPE}-make-index
- Pull index generation out of ipkg-push, and let it be done by image_ipkg.make instead (which seems to be the only other place that is currently calling any of the -make-index functions)
- Something entirely different

Any input is welcome! Thanks in advance!
Simon Falsig


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] Do ipkg-push with SHA256 checksums

[Michael Olbrich]

Hi,

On Tue, Apr 07, 2020 at 10:33:31AM +0000, Simon Falsig wrote:
> I'm trying to setup ipkg-push to repository, generating a signed Packages
> list with SHA256 checksums (using opkg, and the --checksum SHA256
> parameter). From what I can see though, the ipkg-push is done by
> scripts/ipkg-push, which doesn't have a way of setting the checksum type,
> and just calls ${TYPE}-make-index without any parameters. I can easily
> hack something together to make this work for me (by just modifying the
> ipkg-push script), but is there a more correct way?
> 
> Judging from the ipkg-push file, it's made to support not just opkg, but
> also ipkg, which I don't think supports the SHA256 checksum. So just
> blindly adding the checksum parameter to the commandline would not
> maintain the generic support. On the other hand, I haven't found any
> other users of the script than ones where it's called with opkg as the
> type.

ipkg-push is pretty much unmaintained on my side. I don't use it at all.
This is the only reason why it still supports ipkg. We removed the ipkg
support pretty much everywhere else a long time ago.

I don't know much about this but it seem to me, that always having SHA256
checksums wont hurt, right?

With all that, I think:

> Suggestions:
> - Make ipkg-push just support opkg, and allow the checksumtype to be
>   specified as a parameter to the script (image_ipkg.make already
>   generates the local using opkg-make-index only)

This is the way to go. Just remove the 'type' option. And, unless there is
a good reason against it, just add the '--checksum SHA256' arguments
unconditionally.
Probably for the other user of opkg-make-index as well.

Michael

> - Maintain ipkg/opkg support by making some more elaborate parameters
>   (for instance an "make-index-extra" that is then just passed from
>   ipkg-push to ${TYPE}-make-index
> - Pull index generation out of ipkg-push, and let it be done by
>   image_ipkg.make instead (which seems to be the only other place that is
>   currently calling any of the -make-index functions)
> - Something entirely different

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] Do ipkg-push with SHA256 checksums

[Simon Falsig]

> > Judging from the ipkg-push file, it's made to support not just opkg, but
> > also ipkg, which I don't think supports the SHA256 checksum. So just
> > blindly adding the checksum parameter to the commandline would not
> > maintain the generic support. On the other hand, I haven't found any
> > other users of the script than ones where it's called with opkg as the
> > type.
>
> ipkg-push is pretty much unmaintained on my side. I don't use it at all.
> This is the only reason why it still supports ipkg. We removed the ipkg
> support pretty much everywhere else a long time ago.
>
> I don't know much about this but it seem to me, that always having SHA256
> checksums wont hurt, right?

I think the main issue would be that the target opkg package needs to be configured to have SHA256 support, and that thus not all targets might support it? I can easily keep md5 as the default, as long as there's a clean way to switch to sha256.

>
> With all that, I think:
>
> > Suggestions:
> > - Make ipkg-push just support opkg, and allow the checksumtype to be
> >   specified as a parameter to the script (image_ipkg.make already
> >   generates the local using opkg-make-index only)
>
> This is the way to go. Just remove the 'type' option. And, unless there is
> a good reason against it, just add the '--checksum SHA256' arguments
> unconditionally.
> Probably for the other user of opkg-make-index as well.

Sounds good, I've prepared a patch - allows the checksum type to be set in platformconfig, then propagates it to the script (replacing the 'type' argument with a 'checksum' argument instead), and also uses the selected type for the local index generation. 

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de