Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add APK signing logic #46

Merged
merged 2 commits into from
Aug 10, 2024
Merged

add APK signing logic #46

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0c140e5
add APK signing logic
aparcar Aug 6, 2024
8be4f5b
docker: bump rsync Debian version
aparcar Aug 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions docker/config.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,12 @@ comment = Example GPG key
key = RWRCSwAAAADUvtjCkFEF4bWWxpPBo9o8R5FK6Rz5aPUsaZONLu8kxIjud9Fd+Mgu7J2fFJDVyKFAXNH6pKS+AuBW3v+TQT5m1J0W/JYTjqzIrgAZhRtm5v3vSKRl3HUD2zEEbG5j3tg=
comment = Example usign key

[apk]
key = -----BEGIN EC PRIVATE KEY-----
MHcCAQEEIIP54p1G0UgCleLObh07Gxq0S0Iz22OQpkUj8S1AzXB9oAoGCCqGSM49
...
-----END EC PRIVATE KEY-----

[worker 1]
phase = 1
name = buildworker-phase1
Expand Down
2 changes: 1 addition & 1 deletion docker/rsync/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM debian:9
FROM debian:12

COPY docker/rsync/files/entry.sh /entry.sh

Expand Down
4 changes: 4 additions & 0 deletions phase1/config.ini.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,10 @@ gpg_passphrase = secret password
gpg_comment = Unattended build signature
usign_key = RWRCSwAAA...OihABfuLvGRVfVaJ6wLf0=
usign_comment = Unattended build signature
apk_key = -----BEGIN EC PRIVATE KEY-----
MHcCAQEEIIP54p1G0UgCleLObh07Gxq0S0Iz22OQpkUj8S1AzXB9oAoGCCqGSM49
...
-----END EC PRIVATE KEY-----
binary_url = [email protected]::upload-binary
binary_password = example
source_url = [email protected]::upload-sources
Expand Down
3 changes: 2 additions & 1 deletion phase1/master.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1370,7 +1370,8 @@ def prepareFactory(target):
"find bin/targets/%(kw:target)s/%(kw:subtarget)s%(prop:libc)s/ "
"bin/targets/%(kw:target)s/%(kw:subtarget)s%(prop:libc)s/kmods/ "
"-mindepth 1 -maxdepth 2 -type f -name sha256sums -print0 -or "
"-name Packages -print0 | xargs -0 tar -czf sign.tar.gz",
"-name Packages -print0 -or -name packages.adb -print0 "
"| xargs -0 tar -czf sign.tar.gz",
target=target,
subtarget=subtarget,
),
Expand Down
7 changes: 6 additions & 1 deletion phase2/config.ini.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,12 @@ comment = Unattended build signature
key = RWRCSwAAA...OihABfuLvGRVfVaJ6wLf0=
comment = Unattended build signature

[apk]
key = -----BEGIN EC PRIVATE KEY-----
MHcCAQEEIIP54p1G0UgCleLObh07Gxq0S0Iz22OQpkUj8S1AzXB9oAoGCCqGSM49
...
-----END EC PRIVATE KEY-----

[worker 1]
phase = 2
name = worker-example-1
Expand All @@ -57,4 +63,3 @@ phase = 2
name = worker-example-2
password = example2
builds = 3

2 changes: 1 addition & 1 deletion phase2/master.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -591,7 +591,7 @@ for arch in arches:
name = "signpack",
description = "Packing files to sign",
workdir = "build/sdk",
command = "find bin/packages/%s/ -mindepth 2 -maxdepth 2 -type f -name Packages -print0 | xargs -0 tar -czf sign.tar.gz" %(arch[0]),
command = "find bin/packages/%s/ -mindepth 2 -maxdepth 2 -type f -name Packages -print0 -or -name packages.adb -print0 | xargs -0 tar -czf sign.tar.gz" %(arch[0]),
haltOnFailure = True
))

Expand Down
13 changes: 13 additions & 0 deletions scripts/signall.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,13 +58,17 @@ GPGCOMMENT="$(iniget "${CONFIG_INI:-config.ini}" gpg comment)"

USIGNKEY="$(iniget "${CONFIG_INI:-config.ini}" usign key)"
USIGNCOMMENT="$(iniget "${CONFIG_INI:-config.ini}" usign comment)"

APKSIGNKEY="$(iniget "${CONFIG_INI:-config.ini}" apk key)"
else
GPGKEY="$(iniget "${CONFIG_INI:-config.ini}" "branch $branch" "gpg_key")"
GPGPASS="$(iniget "${CONFIG_INI:-config.ini}" "branch $branch" "gpg_passphrase")"
GPGCOMMENT="$(iniget "${CONFIG_INI:-config.ini}" "branch $branch" "gpg_comment")"

USIGNKEY="$(iniget "${CONFIG_INI:-config.ini}" "branch $branch" "usign_key")"
USIGNCOMMENT="$(iniget "${CONFIG_INI:-config.ini}" "branch $branch" "usign_comment")"

APKSIGNKEY="$(iniget "${CONFIG_INI:-config.ini}" "branch $branch" "apk_key")"
fi

if echo "$GPGKEY" | grep -q "BEGIN PGP PRIVATE KEY BLOCK"; then
Expand Down Expand Up @@ -101,6 +105,15 @@ if [ -n "$USIGNKEY" ]; then
signify-openbsd -S -s "$(readlink -f "$tmpdir/usign.sec")" -m "{}" \; || finish 5
fi

if [ -n "$APKSIGNKEY" ]; then
umask 077
echo "$APKSIGNKEY" > "$tmpdir/apk.pem"

umask 022
find "$tmpdir/tar/" -type f -name "packages.adb" -exec \
"${APK_BIN:-apk}" adbsign --allow-untrusted --sign-key "$(readlink -f "$tmpdir/apk.pem")" "{}" \; || finish 6
Copy link
Member

@ynezz ynezz Sep 23, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For some reason this fails https://buildbot.staging.openwrt.org/images/#/builders/1/builds/21/steps/47/logs/stdio:

/scripts/signall.sh /master/signing/mediatek.filogic.tar.gz master

** RUNNING ON BUILDMASTER **
 in dir /master
 argv: ['/scripts/signall.sh', '/master/signing/mediatek.filogic.tar.gz', 'master']
 env: {'CONFIG_INI': '/config/config.ini'}
gpg: keybox '/master/signall.4246/gpg/pubring.kbx' created
gpg: /master/signall.4246/gpg/trustdb.gpg: trustdb created
gpg: key CD84BCED626471F1: public key "OpenWrt Build System (PGP key for unattended snapshot builds) <[email protected]>" imported
gpg: key CD84BCED626471F1: secret key imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg:       secret keys read: 1
gpg:   secret keys imported: 1
find: ‘apk’: No such file or directory
find: ‘apk’: No such file or directory

but the signfiles step is marked as successful, although there is haltOnFailure=True defined for this step, so in this case the build should fail. Probably some issue with exit code handling/passing somewhere?

fi

tar -C "$tmpdir/tar/" -czf "$tarball" . || finish 6

finish 0