Re: opkg and gpg signed ipk packages

[Mark Hatle <mark.hatle@windriver.com>]

On 5/19/15 7:01 AM, Otavio Salvador wrote:
> On Tue, May 19, 2015 at 8:47 AM, Sona Sarmadi <sona.sarmadi@enea.com> wrote:
>>
>>>> I'm guessing you would want something like this in your custom distro
>>>> config (or local.conf if you must):
>>>>
>>>> PACKAGECONFIG_append_pn-opkg = " sha256"
>>>> PACKAGECONFIG_append_pn-opkg-native = " sha256"
>>>
>>
>> Thanks a lot guys for your help, this is now working :)
>> There is support for sha256 in opkg but not in the opkg-utils.
>> opkg-utils (opkg.py) just uses md5 as default option. I changed
>>
>> opkg.py:
>> ........
>>         # compute the MD5.
>>         if not self.fn:
>>             self.md5 = 'Unknown'
>>         else:
>>             f = open(self.fn, "rb")
>>             sum = hashlib.md5()
>> to
>>             sum = hashlib.sha256()
>>
>> and now I get checksum sha256 in the "Packages" file:
>>
>> SHA256Sum: 6be1fb5b9dab3de5848fd578d515d05adc5c6cd3b0009f8c1b13ab1250cee594
>>
>> Do you think this patch would be of interest for someone?
> 
> Yes but it would be good to make it choosable at distro level.

I agree.. and RPM(5) has the ability to switch the default checksum from MD5 to
others as well.  So a global distro setting would make sense.  (I don't know how
the deb package manager is configured.)

Let me know if we come up with a distribution level switch (or if we just want
to make the policy be sha256, as it's definitely better then MD5) and I can help
make the RPM configuration change as well.

--Mark