[ci] Publish package checksums #149 #242
Conversation
Add make package/index to generate Packages file with SHA256 checksums. Filter to only include openwisp packages and save as Packages.sha256.checksum following OpenWRT's standard format. Fixes openwisp#149
shubhamk0205
force-pushed
the
issues/149-upload-package-checksums
branch
from
9ef2da4 to
32c5451
Compare
shubhamk0205
force-pushed
the
issues/149-upload-package-checksums
branch
from
4591a21 to
046744a
Compare
Ensure usign tool is compiled and installed before running make package/index. This fixes the 'usign: No such file or directory' error when cache is used. The usign tool is required for package signing during index generation.
Replace invalid tools/usign/compile target with proper tools/install. This ensures all required host tools including usign are built before running make package/index.
shubhamk0205
force-pushed
the
issues/149-upload-package-checksums
branch
4 times, most recently
from
e8daae4 to
ed1f00f
Compare
Add check for usign binary existence before running make package/index. If usign is missing from cache, build it using tools/usign/compile. Also ensures output directory exists before writing checksum file and uses improved awk filtering for better multi-package support. Closes openwisp#149
shubhamk0205
force-pushed
the
issues/149-upload-package-checksums
branch
from
ed1f00f to
49366ad
Compare
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
WalkthroughThe build script now ensures the Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Pre-merge checks✅ Passed checks (4 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
runbuild (1)
64-70: Consider validating the filtered output.The awk script correctly extracts package stanzas, but there's no verification that:
- The input Packages file exists and is readable
- Any openwisp packages were found and written to the checksum file
While the earlier
make package/indexshould ensure the Packages file exists, adding validation would make the script more robust and help catch unexpected issues during CI runs.🔎 Suggested validation
' "$BUILD_DIR/openwrt/bin/packages/$COMPILE_TARGET/Packages" \ >"$BUILD_DIR/openwrt/bin/packages/$COMPILE_TARGET/openwisp/Packages.sha256.checksum" + +# Verify that checksums were generated +if [ ! -s "$BUILD_DIR/openwrt/bin/packages/$COMPILE_TARGET/openwisp/Packages.sha256.checksum" ]; then + echo "Error: No openwisp packages found in Packages file" + exit 1 +fi
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
runbuild
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build and Upload Packages
🔇 Additional comments (1)
runbuild (1)
61-61: Remove theSIGNED_PACKAGES=variable; setCONFIG_SIGNED_PACKAGESin.configinstead.The
SIGNED_PACKAGES=make variable does not override theCONFIG_SIGNED_PACKAGESKconfig symbol used by OpenWrt's build system. To generate unsigned package indexes, you must disable signing in the.configfile before invokingmake package/index, either by:
- Setting
# CONFIG_SIGNED_PACKAGES is not setin.config, or- Running
make menuconfigand disabling "Signed packages"The current syntax will not prevent Packages.sig generation if
CONFIG_SIGNED_PACKAGESis enabled.Likely an incorrect or invalid review comment.
runbuild
Outdated
| # Build usign tool if not already built (required for package index generation) | ||
| if [ ! -f staging_dir/host/bin/usign ]; then | ||
| make -j"$CORES" tools/usign/compile || make -j1 V=s tools/usign/compile | ||
| fi |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, locate and examine the runbuild file
find . -name "runbuild" -type fRepository: openwisp/openwisp-config
Length of output: 78
🏁 Script executed:
# Once found, examine the context around lines 55-70
if [ -f runbuild ]; then
sed -n '45,75p' runbuild
fiRepository: openwisp/openwisp-config
Length of output: 1227
🌐 Web query:
OpenWrt 24.10 package index generation usign requirement SIGNED_PACKAGES
💡 Result:
Short answer: In OpenWrt 24.10 the SIGNED_PACKAGES build option controls whether the build/system generates signed package indexes (Packages.sig / sha256sums.sig / etc.). When SIGNED_PACKAGES is enabled the build will produce signature files for the Packages index and require a signing key (key-build / usign private key) to sign them; when it is disabled no Packages.sig is created and imagebuilder/SDK behavior falls back to unsigned indexes (or may still verify if opkg on target is configured to check signatures). [1][2][3]
What to do (practical steps)
- To enable signed package indexes: enable SIGNED_PACKAGES in your build (or export SIGNED_PACKAGES=1) and make sure the signing key pair is available to the build:
- Provide key-build (private) and key-build.pub (public) at the buildroot top-level (or export USIGN_PRIV_KEY and USIGN_PUB_KEY environment variables pointing to the key contents) so the build can create Packages.sig. [2][4]
- If using the ImageBuilder / SDK: either supply the keys (as above) or disable SIGNED_PACKAGES for local image builds; missing key-build will cause "Signing package index..." errors. The ImageBuilder/SDK changes and discussions explain that signing/verification were split so builds can opt in/out and that buildbot/master nodes normally perform signing. [3][5]
- If you want opkg on devices to verify signatures, ensure CHECK_SIGNATURE / installation of the public key under /etc/opkg/keys is configured (this is separate from creating signatures). [5]
References
- Patch/commit discussion of SIGNED_PACKAGES and separation of signing/verification options. [5]
- ImageBuilder/SDK signing discussions (ImageBuilder added package signature verification; errors when no key present). [3][4]
- Example OpenWrt release package directories showing .sig / sha256sums.sig presence for signed package repos. [1]
If you want, tell me whether you’re building in a CI, locally, or using ImageBuilder/SDK and I’ll give the exact Makefile/buildroot variable or example commands to provide the keys.
🏁 Script executed:
# Check if usign is used elsewhere in the script after line 70
wc -l runbuildRepository: openwisp/openwisp-config
Length of output: 79
🏁 Script executed:
# View the entire script to see if usign is used after line 70
cat -n runbuildRepository: openwisp/openwisp-config
Length of output: 2868
Remove the usign build or clarify why it's actually needed—the current comment contradicts the actual unsigned package generation.
Line 55's comment claims usign is "required for package index generation," but line 60 explicitly states the generated index is "unsigned - no usign needed." According to OpenWrt 24.10 documentation, when SIGNED_PACKAGES is empty (as in line 61), unsigned package index generation does not require the usign binary. The usign tool is never used elsewhere in the script, making the build at lines 55-58 appear unnecessary for this workflow.
Either remove the usign build entirely, or if it's needed for a hidden reason, clarify the comment to explain the actual requirement. The current comment is factually incorrect.
🤖 Prompt for AI Agents
In file runbuild around lines 55-58: the comment and code build usign even
though downstream the script generates an unsigned package index and
SIGNED_PACKAGES is empty, so the usign build appears unnecessary; either remove
the three-line usign build block entirely (and any dead references) or, if usign
is actually required for a separate hidden step, update the comment to
explicitly state that reason and point to where usign is consumed; before
removing, grep the script and related build steps to confirm usign is not
referenced elsewhere and if removing, also delete the corresponding staging_dir
artifact handling to avoid orphaned logic.
- Build tools/install if usign binary is not present in staging_dir/host/bin - Only builds tools when usign is actually missing (efficient check) - Fixes 'usign: No such file or directory' error in CI - Handles both CI_CACHE and non-cache scenarios The error occurred because make package/index requires the usign binary to exist even when SIGNED_PACKAGES= is set to skip signing. This is due to OpenWRT's SHA-512 padding workaround in the Makefile that runs unconditionally. Using tools/install instead of tools/usign/compile ensures all tool dependencies are properly built and avoids 'No rule to make target' errors.
shubhamk0205
force-pushed
the
issues/149-upload-package-checksums
branch
from
a848b45 to
3c69722
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
runbuild (1)
65-72: Consider adding defensive checks for the Packages file and filtered output.The awk filtering logic is correct—it captures entire package stanzas from "Package: openwisp-" until the blank line separator. However, consider adding checks to fail early with clear error messages:
- Verify the source Packages file exists before filtering
- Verify the filtered output is non-empty (at least one openwisp package found)
🔎 Proposed defensive checks
# Filter Packages file to include only openwisp packages and save as checksum file +PACKAGES_FILE="$BUILD_DIR/openwrt/bin/packages/$COMPILE_TARGET/Packages" +if [ ! -f "$PACKAGES_FILE" ]; then + echo "ERROR: Packages file not found at $PACKAGES_FILE" + exit 1 +fi + mkdir -p "$BUILD_DIR/openwrt/bin/packages/$COMPILE_TARGET/openwisp" +CHECKSUM_FILE="$BUILD_DIR/openwrt/bin/packages/$COMPILE_TARGET/openwisp/Packages.sha256.checksum" + awk ' /^Package: openwisp-/ {flag=1} flag {print} /^$/ {flag=0} -' "$BUILD_DIR/openwrt/bin/packages/$COMPILE_TARGET/Packages" \ - >"$BUILD_DIR/openwrt/bin/packages/$COMPILE_TARGET/openwisp/Packages.sha256.checksum" +' "$PACKAGES_FILE" > "$CHECKSUM_FILE" + +if [ ! -s "$CHECKSUM_FILE" ]; then + echo "WARNING: No openwisp packages found in Packages file" + exit 1 +fi
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
runbuild
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: QA-Checks and Tests
🔇 Additional comments (3)
runbuild (3)
62-63: LGTM! Package index generation command is correct.The
make package/index SIGNED_PACKAGES=command correctly generates an unsigned package index. The emptySIGNED_PACKAGES=value explicitly requests unsigned index generation, which aligns with the PR objectives.
74-77: LGTM! Move and symlink operations are correct.The operations correctly move the openwisp package directory (containing the checksum file) to the versioned directory and update the latest symlink to point to it. The
|| trueon line 76 safely handles the case where the latest symlink doesn't exist yet.
55-60: Remove the usign build (lines 55–60)—the "SHA-512 padding workaround" claim contradicts both line 62 and OpenWrt documentation.The comment on line 56 claims usign is required for a "SHA-512 padding workaround" even for unsigned package indices, but this contradicts the comment on line 62 which explicitly states "(unsigned - no usign needed)". OpenWrt documentation confirms that unsigned package index generation (with
SIGNED_PACKAGES=) does not require usign; usign is only needed if you want to sign the index with a detached.sigfile.Since the index is generated unsigned and the comment on line 62 acknowledges no usign is needed, lines 55–60 waste build time. Either remove this unnecessary tool build, or clarify in the code comments why usign is actually required for your use case.
Likely an incorrect or invalid review comment.
2 participants
Checklist
Reference to Existing Issue
Closes #149
Description of Changes
Implements package checksum publishing to enable package verification.
Changes:
make package/indexin runbuild to generatePackagesfile with SHA256 checksumsawkPackages.sha256.checksumfollowing OpenWRT's standard formatResult:
Users can now verify downloaded packages using the published SHA256 checksums.
Note: No tests added as this is a build script change only.
Screenshot
N/A