Possbile bug on key-build.ucert not being renewed

For Developers
1

If you have an openwrt local full build environment, with key-build.(,pub,ucert) files generated for you on first run, you may stumble upon error/problem after one year of working with this directory (and key-build files).

PROBLEM:
key-build.ucert, while being automatically generated , is created with 365days expiry, and after this date, without any warning you will start building images which fill fail sysupgrade's /usr/libexec/validate_firmware_image check.

Proposed solutions:

  1. renew ucert automatically (if it's being genered in automatic way, also renew could be automated)
    (btw: you must delete old key-build.ucert and have a new one generated from scratch, as chained verification is not working, at least for me :slight_smile: so stacked ucert file will also fail sysupgrade!
  2. at least put big warning at the end of build process.
2

Just got hit by this. Regular ucert package does not print errors, while ucert-full prints chain_verify: certificate expired.

There's no option to supply expiry date in ucert as far as I see.

https://git.openwrt.org/?p=project/ucert.git;a=blob;f=ucert.c;h=5523b02a7eb2b977ce4c28bfd3b4c082845d6513;hb=HEAD#l481

blobmsg_add_u64(&payloadbuf, "expiresat", tv.tv_sec + 60 * 60 * 24 * 365);