[Buildroot] [PATCH] opkg: Add option to enable package verification support with GnuPG

[Buildroot] [PATCH] opkg: Add option to enable package verification support with GnuPG

[Philipp Claves]

Hello,

This set of patches enables the opkg support for verifying package signatures 
with gnupg.

The first two patches add the required libraries (libassuan and libgpgme).
The third adds new option: opkg-gnupg-support. It selects the needed packages 
and sets the --enable-gpg configure option for opkg.

The patch dependency chain is:
  (0003) opkg -> (0002) libgpgme -> (0001) libassuan

Comments are welcome.

Regards,
Philipp Claves
-- 
Budelmann Elektronik GmbH
Von-Renesse-Weg 60
48163 M?nster
Germany

Tel.  +49 (0)2501 9208440
Fax   +49 (0)2501 5887024
claves at budelmann-elektronik.com
www.budelmann-elektronik.com

General Managers: Dipl.-Kffr. Jeannine Budelmann,
Dipl.-Ing. Christoph Budelmann, Ing?nieur diplom? de
l'Ecole nationale d'Electronique et de ses Applications
Registered Office: M?nster, Germany
Registered Court: M?nster HRB 12729     
VAT Identification Number: DE 272 067 273
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-libassuan-IPC-library.patch
Type: text/x-patch
Size: 2213 bytes
Desc: not available
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20130228/36e85af4/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-GnuPG-Made-Easy-gpgme-library.patch
Type: text/x-patch
Size: 2261 bytes
Desc: not available
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20130228/36e85af4/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-opkg-Add-gnupg-signature-checking-support.patch
Type: text/x-patch
Size: 1647 bytes
Desc: not available
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20130228/36e85af4/attachment-0002.bin>

[Buildroot] [PATCH] opkg: Add option to enable package verification support with GnuPG

[Thomas Petazzoni]

Dear Philipp Claves,

On Thu, 28 Feb 2013 15:04:42 +0100, Philipp Claves wrote:

> This set of patches enables the opkg support for verifying package signatures 
> with gnupg.
> 
> The first two patches add the required libraries (libassuan and libgpgme).
> The third adds new option: opkg-gnupg-support. It selects the needed packages 
> and sets the --enable-gpg configure option for opkg.
> 
> The patch dependency chain is:
>   (0003) opkg -> (0002) libgpgme -> (0001) libassuan
> 
> Comments are welcome.

Thanks, they look (almost) good! Could you submit them, one mail per
patch, preferably using git send-email?

On libassuan, please wrap the help text, and add a final newline at the
end of the .mk file.

On libgpgme, please wrap the help text, add the final newline at the
end of the .mk file. The --with-gpg=/usr/bin/gpg doesn't look very
good. gpg is not a mandatory dependency of Buildroot, so if libgpgme
really needs gpg, then we should build host-gnupg I guess. But does it
really need it? Can you detail this --with-gpg option? Or maybe it's
just the path where gpg will be installed on the target? If it's the
case, then maybe a comment would be appropriate to clarify this.

In the opkg patch, in the .mk file, you should use
BR2_PACKAGE_OPKG_GPG_SIGN in your condition rather than
BR2_PACKAGE_LIBGPGME. Also, in your Config.in, you add GNUPG as a
dependency, but it is not listed in the .mk file. This is sometimes
correct if it is only a runtime dependency, in which case we usually
put a comment in the Config.in just above the corresponding select line.

Thanks!

Thomas
-- 
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com

[Buildroot] [PATCH] opkg: Add option to enable package verification support with GnuPG

[Thomas Petazzoni]

Dear Philipp Claves,

Please keep the Buildroot list posted for this discussion. Thanks!

On Fri, 01 Mar 2013 10:55:44 +0100, Philipp Claves wrote:

> > Thanks, they look (almost) good! Could you submit them, one mail per
> > patch, preferably using git send-email?
> Never used that and having my mail server password (--smtp-pass) logged in 
> .bash_history does not sound too appealing. Is there a good reason to use it?

You don't have to put your password on the command line. You can put
your password in ~/.gitconfig:

[sendemail]
smtppass = foobar

and of course make this file 600.

Another solution is to install msmtp, and then tell git to use it. In
this case, you have your SMTP password in the msmtp configuration file,
~/.msmtprc, which should be 600.

There are good reasons to use git send-email.

 * It allows to send the patches inline instead of as attachements.
   This is something most open-source communities want, because it
   allows anyone to hit the "Reply" button and make some review
   comments inline. See
   http://lxr.free-electrons.com/source/Documentation/SubmittingPatches#L219.

 * When sent inline, many e-mail clients wrap the lines, or do some
   funk replacement of tabs with spaces or stuff like that, which makes
   your patch impossible to apply.

 * When sent inline, one patch per e-mail, all patches get
   automatically picked up by our Patchwork tracking system. For now,
   only your last patch has been seen by Patchwork:
   http://patchwork.ozlabs.org/patch/223967/.

So really: one e-mail per patch, and patch inline. And to achieve that,
git send-email is the best solution.

> > On libassuan, please wrap the help text, and add a final newline at the
> > end of the .mk file.
> 80 columns in 2013? Anyway, it will be fixed.

Yes, 80 columns in 2013. The help text gets displayed in "menuconfig",
it isn't wrapped automatically by menuconfig and we want it to fit on
reasonably sized windows.

I guess all good text editors know how to automatically wrap stuff at
~80 columns, so it's just a matter of hitting a keystroke.

> > On libgpgme, please wrap the help text, add the final newline at the
> > end of the .mk file.
> Will be fixed.

Thanks.

> > The --with-gpg=/usr/bin/gpg doesn't look very
> > good. gpg is not a mandatory dependency of Buildroot, so if libgpgme
> > really needs gpg, then we should build host-gnupg I guess. But does it
> > really need it? Can you detail this --with-gpg option? Or maybe it's
> > just the path where gpg will be installed on the target? If it's the
> > case, then maybe a comment would be appropriate to clarify this.
> It is the install path on the target. Will add a comment.

Ok, thanks.

> > In the opkg patch, in the .mk file, you should use
> > BR2_PACKAGE_OPKG_GPG_SIGN in your condition rather than
> > BR2_PACKAGE_LIBGPGME.
> Oops, this is a leftover from testing. Will be fixed.

Perfect.

> 
> > Also, in your Config.in, you add GNUPG as a
> > dependency, but it is not listed in the .mk file. This is sometimes
> > correct if it is only a runtime dependency, in which case we usually
> > put a comment in the Config.in just above the corresponding select line.
> The dependencies are a little strange. Neither the libs nor opkg actually 
> require gnupg to build, but libgpgme and therefore opkg signature support 
> don't work without the binary in place. libassuan is standalone.
> 
> My solution is to hide (depends on) libgpgme if gnupg is not selected (because 
> it makes no sense without), but force gpg and libgpgme on if you want opkg 
> signature support. This option is intended as a user friendly way to select 
> all you need for it.
> 
> As an alternative it would be possible to make libgpg always visible and let 
> it automatically select gnupg.

If libgpgme practically cannot operate without /usr/bin/gpg being
present, then I would do:

config BR2_PACKAGE_LIBGPGME
	[...]
	# gnupg needed at runtime, but not a build dependency
	select BR2_PACKAGE_GNUPG

This way, if one day some other package uses libgpgme, it will
automatically ensure that gnupg is built/installed.

Best regards,

Thomas
-- 
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com

[Buildroot] [PATCH 1/3] Add libassuan IPC library

[Philipp Claves]

Signed-off-by: Philipp Claves <claves@budelmann-elektronik.com>
---
 package/Config.in              |  1 +
 package/libassuan/Config.in    | 10 ++++++++++
 package/libassuan/libassuan.mk | 15 +++++++++++++++
 3 files changed, 26 insertions(+)
 create mode 100644 package/libassuan/Config.in
 create mode 100644 package/libassuan/libassuan.mk

diff --git a/package/Config.in b/package/Config.in
index faee5c3..a6910a3 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -379,6 +379,7 @@ source "package/beecrypt/Config.in"
 source "package/gnutls/Config.in"
 source "package/libgcrypt/Config.in"
 source "package/libgpg-error/Config.in"
+source "package/libassuan/Config.in"
 source "package/libmcrypt/Config.in"
 source "package/libmhash/Config.in"
 source "package/libnss/Config.in"
diff --git a/package/libassuan/Config.in b/package/libassuan/Config.in
new file mode 100644
index 0000000..16fb599
--- /dev/null
+++ b/package/libassuan/Config.in
@@ -0,0 +1,10 @@
+config BR2_PACKAGE_LIBASSUAN
+	bool "libassuan"
+	select BR2_PACKAGE_LIBGPG_ERROR
+	help
+	  Libassuan is a small library implementing the so-called Assuan
+	  protocol.
+	  This protocol is used for IPC between most newer GnuPG components. 
+	  Both, server and client side functions are provided.
+
+	  http://www.gnupg.org/related_software/libassuan/
diff --git a/package/libassuan/libassuan.mk b/package/libassuan/libassuan.mk
new file mode 100644
index 0000000..69dbe71
--- /dev/null
+++ b/package/libassuan/libassuan.mk
@@ -0,0 +1,15 @@
+#############################################################
+#
+# libassuan
+#
+#############################################################
+
+LIBASSUAN_VERSION = 2.0.3
+LIBASSUAN_SITE = ftp://ftp.gnupg.org/gcrypt/libassuan/
+LIBASSUAN_SOURCE = libassuan-$(LIBASSUAN_VERSION).tar.bz2
+LIBASSUAN_LICENSE = LGPLv2.1+
+LIBASSUAN_LICENSE_FILES = COPYING.LIB
+LIBASSUAN_INSTALL_STAGING = YES
+LIBASSUAN_DEPENDENCIES = libgpg-error
+
+$(eval $(autotools-package))
-- 
1.8.1.4

[Buildroot] [PATCH 2/3] Add GnuPG Made Easy (gpgme) library.

[Philipp Claves]

Signed-off-by: Philipp Claves <claves@budelmann-elektronik.com>
---
 package/Config.in            |  1 +
 package/libgpgme/Config.in   | 13 +++++++++++++
 package/libgpgme/libgpgme.mk | 17 +++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 package/libgpgme/Config.in
 create mode 100644 package/libgpgme/libgpgme.mk

diff --git a/package/Config.in b/package/Config.in
index a6910a3..252c306 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -379,6 +379,7 @@ source "package/beecrypt/Config.in"
 source "package/gnutls/Config.in"
 source "package/libgcrypt/Config.in"
 source "package/libgpg-error/Config.in"
+source "package/libgpgme/Config.in"
 source "package/libassuan/Config.in"
 source "package/libmcrypt/Config.in"
 source "package/libmhash/Config.in"
diff --git a/package/libgpgme/Config.in b/package/libgpgme/Config.in
new file mode 100644
index 0000000..6ebf8d2
--- /dev/null
+++ b/package/libgpgme/Config.in
@@ -0,0 +1,13 @@
+config BR2_PACKAGE_LIBGPGME
+	bool "libgpgme"
+	#gnupg is not needed to build, but at runtime.
+	select BR2_PACKAGE_GNUPG
+	select BR2_PACKAGE_LIBGPG_ERROR
+	select BR2_PACKAGE_LIBASSUAN
+	help
+	  GnuPG Made Easy (GPGME) is a library designed to make access to GnuPG
+	  easier for applications.
+	  
+	  opkg uses libpgpme for signature verification.
+
+	  http://www.gnupg.org/related_software/gpgme/
diff --git a/package/libgpgme/libgpgme.mk b/package/libgpgme/libgpgme.mk
new file mode 100644
index 0000000..833a83c
--- /dev/null
+++ b/package/libgpgme/libgpgme.mk
@@ -0,0 +1,17 @@
+#############################################################
+#
+# libgpgme
+#
+#############################################################
+
+LIBGPGME_VERSION = 1.3.2
+LIBGPGME_SITE = ftp://ftp.gnupg.org/gcrypt/gpgme/
+LIBGPGME_SOURCE = gpgme-$(LIBGPGME_VERSION).tar.bz2
+LIBGPGME_LICENSE = LGPLv2.1+
+LIBGPGME_LICENSE_FILES = COPYING.LESSER
+LIBGPGME_INSTALL_STAGING = YES
+#libgpgme, needs to know the gpg binary path on the target.
+LIBGPGME_CONF_OPT = --with-gpg=/usr/bin/gpg --without-gpgsm --without-gpgconf --without-g13
+LIBGPGME_DEPENDENCIES = libassuan libgpg-error
+
+$(eval $(autotools-package))
-- 
1.8.1.4

[Buildroot] [PATCH 3/3] opkg: Add gnupg signature checking support.

[Philipp Claves]

Signed-off-by: Philipp Claves <claves@budelmann-elektronik.com>
---
 package/opkg/Config.in | 9 +++++++++
 package/opkg/opkg.mk   | 9 ++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/package/opkg/Config.in b/package/opkg/Config.in
index eb997a7..b8b4a13 100644
--- a/package/opkg/Config.in
+++ b/package/opkg/Config.in
@@ -11,3 +11,12 @@ config BR2_PACKAGE_OPKG
 
 	  http://code.google.com/p/opkg/
 
+if BR2_PACKAGE_OPKG
+
+config BR2_PACKAGE_OPKG_GPG_SIGN
+	bool "opkg-gnupg-support"
+	select BR2_PACKAGE_LIBGPGME
+	help
+	  Enable opkg package signature checking support using gnupg/libgpgme.
+
+endif
diff --git a/package/opkg/opkg.mk b/package/opkg/opkg.mk
index 9932d3f..3c53299 100644
--- a/package/opkg/opkg.mk
+++ b/package/opkg/opkg.mk
@@ -9,7 +9,7 @@ OPKG_SOURCE = opkg-$(OPKG_VERSION).tar.gz
 OPKG_SITE = http://opkg.googlecode.com/svn/trunk/
 OPKG_SITE_METHOD = svn
 OPKG_INSTALL_STAGING = YES
-OPKG_CONF_OPT = --disable-curl --disable-gpg
+OPKG_CONF_OPT = --disable-curl
 OPKG_AUTORECONF = YES
 # Uses PKG_CHECK_MODULES() in configure.ac
 OPKG_DEPENDENCIES = host-pkgconf
@@ -19,6 +19,13 @@ define OPKG_CREATE_LOCKDIR
 	mkdir -p $(TARGET_DIR)/usr/lib/opkg
 endef
 
+ifeq ($(BR2_PACKAGE_OPKG_GPG_SIGN),y)
+	OPKG_CONF_OPT += --enable-gpg
+	OPKG_DEPENDENCIES += libgpgme
+else
+	OPKG_CONF_OPT += --disable-gpg
+endif
+
 OPKG_POST_INSTALL_TARGET_HOOKS += OPKG_CREATE_LOCKDIR
 
 $(eval $(autotools-package))
-- 
1.8.1.4

[Buildroot] [PATCH 3/3] opkg: Add gnupg signature checking support.

[Philipp Claves]

Hello,

Any status update on merging this patchset?

Regards,
Philipp Claves

On Freitag, March 1st 2013, 14:38:29 Philipp Claves wrote:
> Signed-off-by: Philipp Claves <claves@budelmann-elektronik.com>
> ---
>  package/opkg/Config.in | 9 +++++++++
>  package/opkg/opkg.mk   | 9 ++++++++-
>  2 files changed, 17 insertions(+), 1 deletion(-)
> 
> diff --git a/package/opkg/Config.in b/package/opkg/Config.in
> index eb997a7..b8b4a13 100644
> --- a/package/opkg/Config.in
> +++ b/package/opkg/Config.in
> @@ -11,3 +11,12 @@ config BR2_PACKAGE_OPKG
> 
>  	  http://code.google.com/p/opkg/
> 
> +if BR2_PACKAGE_OPKG
> +
> +config BR2_PACKAGE_OPKG_GPG_SIGN
> +	bool "opkg-gnupg-support"
> +	select BR2_PACKAGE_LIBGPGME
> +	help
> +	  Enable opkg package signature checking support using gnupg/libgpgme.
> +
> +endif
> diff --git a/package/opkg/opkg.mk b/package/opkg/opkg.mk
> index 9932d3f..3c53299 100644
> --- a/package/opkg/opkg.mk
> +++ b/package/opkg/opkg.mk
> @@ -9,7 +9,7 @@ OPKG_SOURCE = opkg-$(OPKG_VERSION).tar.gz
>  OPKG_SITE = http://opkg.googlecode.com/svn/trunk/
>  OPKG_SITE_METHOD = svn
>  OPKG_INSTALL_STAGING = YES
> -OPKG_CONF_OPT = --disable-curl --disable-gpg
> +OPKG_CONF_OPT = --disable-curl
>  OPKG_AUTORECONF = YES
>  # Uses PKG_CHECK_MODULES() in configure.ac
>  OPKG_DEPENDENCIES = host-pkgconf
> @@ -19,6 +19,13 @@ define OPKG_CREATE_LOCKDIR
>  	mkdir -p $(TARGET_DIR)/usr/lib/opkg
>  endef
> 
> +ifeq ($(BR2_PACKAGE_OPKG_GPG_SIGN),y)
> +	OPKG_CONF_OPT += --enable-gpg
> +	OPKG_DEPENDENCIES += libgpgme
> +else
> +	OPKG_CONF_OPT += --disable-gpg
> +endif
> +
>  OPKG_POST_INSTALL_TARGET_HOOKS += OPKG_CREATE_LOCKDIR
> 
>  $(eval $(autotools-package))
-- 
Budelmann Elektronik GmbH
Von-Renesse-Weg 60
48163 M?nster
Germany

Tel.  +49 (0)2501 9208440
Fax   +49 (0)2501 5887024
claves at budelmann-elektronik.com
www.budelmann-elektronik.com

General Managers: Dipl.-Kffr. Jeannine Budelmann,
Dipl.-Ing. Christoph Budelmann, Ing?nieur diplom? de
l'Ecole nationale d'Electronique et de ses Applications
Registered Office: M?nster, Germany
Registered Court: M?nster HRB 12729     
VAT Identification Number: DE 272 067 273

[Buildroot] [PATCH 3/3] opkg: Add gnupg signature checking support.

[Arnout Vandecappelle]

On 08/04/13 12:26, Philipp Claves wrote:
> Any status update on merging this patchset?

  Thomas sent comments about your patches and we assumed you would that 
re-send them taking into account the review feedback. If you are not 
planning to send updated patches, please tell us. Then somebody else may 
pick up the patches (but don't count on it).

  Regards,
  Arnout

-- 
Arnout Vandecappelle                          arnout at mind be
Senior Embedded Software Architect            +32-16-286500
Essensium/Mind                                http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium           BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7CB5 E4CC 6C2E EFD4 6E3D A754 F963 ECAB 2450 2F1F

[Buildroot] [PATCH 3/3] opkg: Add gnupg signature checking support.

[Thomas Petazzoni]

Dear Arnout Vandecappelle,

On Tue, 09 Apr 2013 18:03:45 +0200, Arnout Vandecappelle wrote:
> On 08/04/13 12:26, Philipp Claves wrote:
> > Any status update on merging this patchset?
> 
>   Thomas sent comments about your patches and we assumed you would that 
> re-send them taking into account the review feedback. If you are not 
> planning to send updated patches, please tell us. Then somebody else may 
> pick up the patches (but don't count on it).

I sent some comments on March, 1st at 11 AM, and at 2 PM on the same
day, Philipp resubmitted updated versions of his patches. I haven't
reviewed the latest version from Philipp. So I think that the ball is
on our side (Buildroot reviewers) and not on Philipp side.

Thomas
-- 
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com

[Buildroot] [PATCH 3/3] opkg: Add gnupg signature checking support.

[Philipp Claves]

Knock Knock

Am Mittwoch, 10. April 2013, 19:40:36 schrieb Thomas Petazzoni:
> Dear Arnout Vandecappelle,
> 
> On Tue, 09 Apr 2013 18:03:45 +0200, Arnout Vandecappelle wrote:
> > On 08/04/13 12:26, Philipp Claves wrote:
> > > Any status update on merging this patchset?
> > > 
> >   Thomas sent comments about your patches and we assumed you would that
> > 
> > re-send them taking into account the review feedback. If you are not
> > planning to send updated patches, please tell us. Then somebody else may
> > pick up the patches (but don't count on it).
> 
> I sent some comments on March, 1st at 11 AM, and at 2 PM on the same
> day, Philipp resubmitted updated versions of his patches. I haven't
> reviewed the latest version from Philipp. So I think that the ball is
> on our side (Buildroot reviewers) and not on Philipp side.
> 
> Thomas
-- 
Budelmann Elektronik GmbH
Von-Renesse-Weg 60
48163 M?nster
Germany

Tel.  +49 (0)2501 9208440
Fax   +49 (0)2501 5887024
claves at budelmann-elektronik.com
www.budelmann-elektronik.com

General Managers: Dipl.-Kffr. Jeannine Budelmann,
Dipl.-Ing. Christoph Budelmann, Ing?nieur diplom? de
l'Ecole nationale d'Electronique et de ses Applications
Registered Office: M?nster, Germany
Registered Court: M?nster HRB 12729     
VAT Identification Number: DE 272 067 273

[Buildroot] [PATCH 1/3] Add libassuan IPC library

[Thomas Petazzoni]

Dear Philipp Claves,

On Fri,  1 Mar 2013 14:38:27 +0100, Philipp Claves wrote:
> Signed-off-by: Philipp Claves <claves@budelmann-elektronik.com>
> ---
>  package/Config.in              |  1 +
>  package/libassuan/Config.in    | 10 ++++++++++
>  package/libassuan/libassuan.mk | 15 +++++++++++++++
>  3 files changed, 26 insertions(+)
>  create mode 100644 package/libassuan/Config.in
>  create mode 100644 package/libassuan/libassuan.mk

I finally merged your libassuan, libgpgme and opkg signature support
patches.

Thanks for your contribution,

Thomas
-- 
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com