RepoMirrors/abuild
1
0
Fork 0
mirror of https://gitlab.alpinelinux.org/alpine/abuild.git synced 2024-12-21 06:30:05 +00:00
Code Issues Projects Releases Wiki Activity

abuild-sign: add support for RSA256 signatures

Browse Source 
Supported by apk-tools since v2.7.0 (2017).
This commit is contained in:
Dimitri John Ledkov 2024-04-29 12:03:04 +01:00
parent a45d12d4c3
commit f4ea93f5f2
No known key found for this signature in database
2 changed files with 58 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
abuild-sign.in
View File

@ -31,8 +31,8 @@ do_sign() {
trap 'die "failed to sign $i"' EXIT
set -e
cd "$repo"
sig=".SIGN.RSA.$keyname"
$openssl dgst -sha1 -sign "$privkey" -out "$sig" "$i"
sig=".SIGN.$type.$keyname"
$openssl dgst $dgstargs -sign "$privkey" -out "$sig" "$i"
if [ -n "$SOURCE_DATE_EPOCH" ]; then
touch -h -d "@$SOURCE_DATE_EPOCH" "$sig"
@ -61,6 +61,7 @@ usage() {
-k, --private KEY The private key to use for signing
-p, --public KEY The name of public key. apk add will look for
/etc/apk/keys/KEY
-t, --type TYPE The signature type RSA or RSA256
-q, --quiet
-h, --help Show this help
@ -72,7 +73,7 @@ privkey="$PACKAGER_PRIVKEY"
pubkey=
quiet=
args=$(getopt -o ek:p:qh --long installed,private:,public:,quiet,help -n "$program" -- "$@")
args=$(getopt -o ek:p:t:qh --long installed,private:,public:,type:,quiet,help -n "$program" -- "$@")
if [ $? -ne 0 ]; then
usage >&2
exit 2
@ -83,6 +84,7 @@ while true; do
-e|--installed) check_installed=true;;
-k|--private) privkey=$2; shift;;
-p|--public) pubkey=$2; shift;;
-t|--type) type=$2; shift;;
-q|--quiet) quiet=1;; # suppresses msg
-h|--help) usage; exit;;
--) shift; break;;
@ -112,6 +114,18 @@ if [ -z "$pubkey" ]; then
pubkey=${PACKAGER_PUBKEY:-"${privkey}.pub"}
fi
if [ -z "$type" ]; then
type=RSA
fi
case $type in
RSA) dgstargs="-sha1";;
RSA256) dgstargs="-sha256";;
*)
echo "$program: supported types are RSA and RSA256" >&2
exit 1
;;
esac
if $check_installed; then
if ! [ -e "$privkey" ]; then
echo "$program: $privkey: File not found" >&2

44
tests/abuild_sign_test
View File

@ -9,7 +9,10 @@ init_tests \
abuild_sign_installed_missing_pub \
abuild_sign_installed_missing_priv \
abuild_sign_installed \
abuild_sign_owner
abuild_sign_owner_type_invalid \
abuild_sign_owner_type_default \
abuild_sign_owner_type_rsa \
abuild_sign_owner_type_rsa256
export ABUILD_SHAREDIR="$(atf_get_srcdir)/.."
@ -63,7 +66,14 @@ abuild_sign_installed_body() {
abuild-sign --installed
}
abuild_sign_owner_body() {
abuild_sign_owner_type_invalid_body() {
init_keys
atf_check -s exit:1 \
-e match:"abuild-sign: supported types are RSA and RSA256" \
abuild-sign -t DSA foo.tar.gz
}
abuild_sign_owner_type_default_body() {
init_keys
echo foo > .PKGINFO
tar -zcf foo.tar.gz .PKGINFO || atf_fail "Failed to create unsigned test archive"
@ -73,6 +83,34 @@ abuild_sign_owner_body() {
abuild-sign foo.tar.gz
atf_check -s exit:0 \
-o match:"0/0.*\.SIGN\.RSA" \
-o match:"0/0.*\.SIGN\.RSA\." \
tar -ztvf foo.tar.gz
}
abuild_sign_owner_type_rsa_body() {
init_keys
echo foo > .PKGINFO
tar -zcf foo.tar.gz .PKGINFO || atf_fail "Failed to create unsigned test archive"
atf_check -s exit:0 \
-e match:"Signed" \
abuild-sign -t RSA foo.tar.gz
atf_check -s exit:0 \
-o match:"0/0.*\.SIGN\.RSA\." \
tar -ztvf foo.tar.gz
}
abuild_sign_owner_type_rsa256_body() {
init_keys
echo foo > .PKGINFO
tar -zcf foo.tar.gz .PKGINFO || atf_fail "Failed to create unsigned test archive"
atf_check -s exit:0 \
-e match:"Signed" \
abuild-sign -t RSA256 foo.tar.gz
atf_check -s exit:0 \
-o match:"0/0.*\.SIGN\.RSA256\." \
tar -ztvf foo.tar.gz
}