aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJo-Philipp Wich <jo@mein.io>2019-08-07 07:15:07 +0200
committerJo-Philipp Wich <jo@mein.io>2019-08-07 07:25:11 +0200
commit128366e1a881b5a9dab4f454a7cf1c45e72a34f1 (patch)
tree0a41a6cf7fffcc7e7a89c2b6c27ca2db6b71b9cf
parent0b8ca9c27532935f8ef4ac041c0d95fe890e8fe7 (diff)
downloadupstream-128366e1a881b5a9dab4f454a7cf1c45e72a34f1.tar.gz
upstream-128366e1a881b5a9dab4f454a7cf1c45e72a34f1.tar.bz2
upstream-128366e1a881b5a9dab4f454a7cf1c45e72a34f1.zip
packages: apply usign padding workarounds to package indexes if needed
Since usign miscalculates SHA-512 digests for input sizes of exactly 64 + N * 128 + 110 or 64 + N * 128 + 111 bytes, we need to apply some white space padding to avoid triggering the hashing edge case. While usign itself has been fixed already, there is still many firmwares in the wild which use broken usign versions to verify current package indexes so we'll need to carry this workaround in the forseeable future. Ref: https://forum.openwrt.org/t/signature-check-failed/41945 Ref: https://git.openwrt.org/5a52b379902471cef495687547c7b568142f66d2 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit e1f588e446c7ceb696b644b37aeab9b3476e2a57)
-rw-r--r--package/Makefile8
1 files changed, 6 insertions, 2 deletions
diff --git a/package/Makefile b/package/Makefile
index cc1e9d4b66..7f4fd16498 100644
--- a/package/Makefile
+++ b/package/Makefile
@@ -80,8 +80,12 @@ $(curdir)/index: FORCE
mkdir -p $$d; \
cd $$d || continue; \
$(SCRIPT_DIR)/ipkg-make-index.sh . 2>&1 > Packages.manifest; \
- grep -vE '^(Maintainer|LicenseFiles|Source|Require)' Packages.manifest > Packages && \
- gzip -9nc Packages > Packages.gz; \
+ grep -vE '^(Maintainer|LicenseFiles|Source|Require)' Packages.manifest > Packages; \
+ case "$$(((64 + $$(stat -L -c%s Packages)) % 128))" in 110|111) \
+ $(call ERROR_MESSAGE,WARNING: Applying padding in $$d/Packages to workaround usign SHA-512 bug!); \
+ { echo ""; echo ""; } >> Packages;; \
+ esac; \
+ gzip -9nc Packages > Packages.gz; \
); done
ifdef CONFIG_SIGNED_PACKAGES
@echo Signing package index...