Apk UNTRUSTED signature errors with packages compiled with SDK

For Developers
1

Trying to use SDK and package it output doesn't look like signed with key files it generated. Even after I added that key into /etc/apk/key it still says untrusted signature when apk in client try to verify

2

Your build key in the build host is in the buildroot root dir where you run the commands, and in the router the public key should be in /etc/apk/keys ( not in 'key' like in your message).

OpenWrt SNAPSHOT, r34136-8ef7b4ee4b
 -----------------------------------------------------
 16:26:35 up 46 min,  load average: 0.00, 0.00, 0.00
root@router5:~# ls /etc/apk
arch            keys            repositories.d  world
root@router5:~# ls /etc/apk/keys/
openwrt-snapshots.pem  public-key.pem

Individual packages compiled by the full toolchain should be now signed by default in master, but not in 25.12. commit enabling that was

From PR https://github.com/openwrt/openwrt/pull/22221

But I have not tried with SDK to see if that logic gets used there.

3

I just ran snapshow x86 sdk to test, (I was 25.12 sdk for backport) it don't have sign each .apk option in menuconfig, although searching that flag it menuconfig did find it at Config-build.in:597 but don't expose it. (default disabled)

4

Hmmm... Then it will likely need to be separately added to SDK for usage there. The option (from my commit) defaults to "y" if not building in buildbot, where it defaults to "n". But as the SDK is compiled by the buildbot, the option possibly gets "n" set as the default for SDK, too.

You might manually edit the Config-build.in in the SDK root, until the option gets somehow properly enabled for the SDK.
Just change the default on line 819 to y.

    817 config SIGN_EACH_PACKAGE
    818         bool
    819         default n
    820
5

Possible solution for the SDK build process might be:

  • Exclude the option from the collected defaults embedded in to SDK Config-build.in
  • Default to 'y' and expose it in the SDK config menu. (not sure if that USE_APK works ok)
--- a/target/sdk/convert-config.pl
+++ b/target/sdk/convert-config.pl
@@ -8,6 +8,7 @@ while (<>) {
 	my $type;
 	chomp;
 	next if /^CONFIG_SIGNED_PACKAGES/;
+	next if /^CONFIG_SIGN_EACH_PACKAGE/;
 
 	if (/^CONFIG_((BINARY)|(DOWNLOAD))_FOLDER=(.*)$/) {
 		# We don't want to preserve the build setting of
diff --git a/target/sdk/files/Config.in b/target/sdk/files/Config.in
index 0cf68faa6e..422b0bb782 100644
--- a/target/sdk/files/Config.in
+++ b/target/sdk/files/Config.in
@@ -18,6 +18,15 @@ menu "Global build settings"
 		bool "Cryptographically sign package lists"
 		default y
 
+	config SIGN_EACH_PACKAGE
+		bool "Cryptographically sign each package .apk file"
+		depends on USE_APK
+		default y
+		help
+		  Sign also the individual package .apk file. Removes the need for
+		  --allow-untrusted when installing self-compiled packages to a
+		  firmware compiled by the same buildhost as public key matches.
+
 	comment "General build options"
 
 	config BUILD_PATENTED

I will compile SDK and see what happens...

6

I made a PR out of it: