imagebuilder: add package signature verification
[openwrt/staging/jow.git] / target / imagebuilder / files / Makefile
1 # Makefile for OpenWrt
2 #
3 # Copyright (C) 2007-2015 OpenWrt.org
4 #
5 # This is free software, licensed under the GNU General Public License v2.
6 # See /LICENSE for more information.
7 #
8
9 TOPDIR:=${CURDIR}
10 LC_ALL:=C
11 LANG:=C
12 export TOPDIR LC_ALL LANG
13 export OPENWRT_VERBOSE=s
14 all: help
15
16 export PATH:=$(TOPDIR)/staging_dir/host/bin:$(PATH)
17
18 ifneq ($(OPENWRT_BUILD),1)
19 override OPENWRT_BUILD=1
20 export OPENWRT_BUILD
21 endif
22
23 include rules.mk
24 include $(INCLUDE_DIR)/debug.mk
25 include $(INCLUDE_DIR)/depends.mk
26 include $(INCLUDE_DIR)/rootfs.mk
27
28 include $(INCLUDE_DIR)/version.mk
29 export REVISION
30
31 define Helptext
32 Available Commands:
33 help: This help text
34 info: Show a list of available target profiles
35 clean: Remove images and temporary build files
36 image: Build an image (see below for more information).
37
38 Building images:
39 By default 'make image' will create an image with the default
40 target profile and package set. You can use the following parameters
41 to change that:
42
43 make image PROFILE="<profilename>" # override the default target profile
44 make image PACKAGES="<pkg1> [<pkg2> [<pkg3> ...]]" # include extra packages
45 make image FILES="<path>" # include extra files from <path>
46 make image BIN_DIR="<path>" # alternative output directory for the images
47 make image EXTRA_IMAGE_NAME="<string>" # Add this to the output image filename (sanitized)
48 make image DISABLED_SERVICES="<svc1> [<svc2> [<svc3> ..]]" # Which services in /etc/init.d/ should be disabled
49 make image ADD_LOCAL_KEY=1 # store locally generated signing key in built images
50
51 Print manifest:
52 List "all" packages which get installed into the image.
53 You can use the following parameters:
54
55 make manifest PROFILE="<profilename>" # override the default target profile
56 make manifest PACKAGES="<pkg1> [<pkg2> [<pkg3> ...]]" # include extra packages
57
58 endef
59 $(eval $(call shexport,Helptext))
60
61 help: FORCE
62 echo "$$$(call shvar,Helptext)"
63
64
65 # override variables from rules.mk
66 PACKAGE_DIR:=$(TOPDIR)/packages
67 LISTS_DIR:=$(subst $(space),/,$(patsubst %,..,$(subst /,$(space),$(TARGET_DIR))))$(DL_DIR)
68 export OPKG_KEYS:=$(TOPDIR)/keys
69 OPKG:=$(call opkg,$(TARGET_DIR)) \
70 -f $(TOPDIR)/repositories.conf \
71 --verify-program $(SCRIPT_DIR)/opkg-key \
72 --cache $(DL_DIR) \
73 --lists-dir $(LISTS_DIR)
74
75 include $(INCLUDE_DIR)/target.mk
76 -include .profiles.mk
77
78 USER_PROFILE ?= $(firstword $(PROFILE_NAMES))
79 PROFILE_LIST = $(foreach p,$(PROFILE_NAMES), \
80 echo '$(patsubst DEVICE_%,%,$(p)):'; $(if $($(p)_NAME),echo ' $(subst ','"'"',$($(p)_NAME))'; ) \
81 echo ' Packages: $($(p)_PACKAGES)'; echo ' hasImageMetadata: $($(p)_HAS_IMAGE_METADATA)'; \
82 $(if $($(p)_SUPPORTED_DEVICES),echo ' SupportedDevices: $($(p)_SUPPORTED_DEVICES)';) )
83
84
85 .profiles.mk: .targetinfo
86 @$(SCRIPT_DIR)/target-metadata.pl profile_mk $< '$(BOARD)$(if $(SUBTARGET),/$(SUBTARGET))' > $@
87
88 staging_dir/host/.prereq-build: include/prereq-build.mk
89 mkdir -p tmp
90 @$(_SINGLE)$(NO_TRACE_MAKE) -j1 -r -s -f $(TOPDIR)/include/prereq-build.mk prereq IB=1 2>/dev/null || { \
91 echo "Prerequisite check failed. Use FORCE=1 to override."; \
92 false; \
93 }
94 ifneq ($(realpath $(TOPDIR)/include/prepare.mk),)
95 @$(_SINGLE)$(NO_TRACE_MAKE) -j1 -r -s -f $(TOPDIR)/include/prepare.mk prepare 2>/dev/null || { \
96 echo "Preparation failed."; \
97 false; \
98 }
99 endif
100 touch $@
101
102 _call_info: FORCE
103 echo 'Current Target: "$(TARGETID)"'
104 echo 'Current Revision: "$(REVISION)"'
105 echo 'Default Packages: $(DEFAULT_PACKAGES)'
106 echo 'Available Profiles:'
107 echo; $(PROFILE_LIST)
108
109 BUILD_PACKAGES:=$(USER_PACKAGES) $(sort $(DEFAULT_PACKAGES) $($(USER_PROFILE)_PACKAGES) kernel)
110 # "-pkgname" in the package list means remove "pkgname" from the package list
111 BUILD_PACKAGES:=$(filter-out $(filter -%,$(BUILD_PACKAGES)) $(patsubst -%,%,$(filter -%,$(BUILD_PACKAGES))),$(BUILD_PACKAGES))
112 PACKAGES:=
113
114 _call_image: staging_dir/host/.prereq-build
115 echo 'Building images for $(BOARD)$(if $($(USER_PROFILE)_NAME), - $($(USER_PROFILE)_NAME))'
116 echo 'Packages: $(BUILD_PACKAGES)'
117 echo
118 rm -rf $(TARGET_DIR) $(TARGET_DIR_ORIG)
119 mkdir -p $(TARGET_DIR) $(BIN_DIR) $(TMP_DIR) $(DL_DIR)
120 $(MAKE) package_reload
121 $(MAKE) package_install
122 $(MAKE) -s prepare_rootfs
123 $(MAKE) -s build_image
124 $(MAKE) -s json_overview_image_info
125 $(MAKE) -s checksum
126
127 _call_manifest: FORCE
128 rm -rf $(TARGET_DIR)
129 mkdir -p $(TARGET_DIR) $(BIN_DIR) $(TMP_DIR) $(DL_DIR)
130 $(MAKE) package_reload >/dev/null
131 $(MAKE) package_install >/dev/null
132 $(OPKG) list-installed
133
134 package_index: FORCE
135 @echo >&2
136 @echo Building package index... >&2
137 @mkdir -p $(TMP_DIR) $(TARGET_DIR)/tmp
138 (cd $(PACKAGE_DIR); $(SCRIPT_DIR)/ipkg-make-index.sh . > Packages && \
139 gzip -9nc Packages > Packages.gz; \
140 $(if $(CONFIG_SIGNATURE_CHECK), \
141 $(STAGING_DIR_HOST)/bin/usign -S -m Packages -s $(BUILD_KEY)); \
142 ) >/dev/null 2>/dev/null
143 $(OPKG) update >&2 || true
144
145 package_reload:
146 if [ -d "$(PACKAGE_DIR)" ] && ( \
147 [ ! -f "$(PACKAGE_DIR)/Packages" ] || \
148 [ ! -f "$(PACKAGE_DIR)/Packages.gz" ] || \
149 [ "`find $(PACKAGE_DIR) -cnewer $(PACKAGE_DIR)/Packages.gz`" ] ); then \
150 echo "Package list missing or not up-to-date, generating it." >&2 ;\
151 $(MAKE) package_index; \
152 else \
153 mkdir -p $(TARGET_DIR)/tmp; \
154 $(OPKG) update >&2 || true; \
155 fi
156
157 package_list: FORCE
158 @$(MAKE) -s package_reload
159 @$(OPKG) list --size 2>/dev/null
160
161 package_install: FORCE
162 @echo
163 @echo Installing packages...
164 $(OPKG) install $(firstword $(wildcard $(LINUX_DIR)/libc_*.ipk $(PACKAGE_DIR)/libc_*.ipk))
165 $(OPKG) install $(firstword $(wildcard $(LINUX_DIR)/kernel_*.ipk $(PACKAGE_DIR)/kernel_*.ipk))
166 $(OPKG) install $(BUILD_PACKAGES)
167
168 prepare_rootfs: FORCE
169 @echo
170 @echo Finalizing root filesystem...
171
172 $(CP) $(TARGET_DIR) $(TARGET_DIR_ORIG)
173 $(if $(CONFIG_SIGNATURE_CHECK), \
174 $(if $(ADD_LOCAL_KEY), \
175 OPKG_KEYS=$(TARGET_DIR)/etc/opkg/keys/ \
176 $(SCRIPT_DIR)/opkg-key add $(BUILD_KEY).pub \
177 ) \
178 )
179 $(call prepare_rootfs,$(TARGET_DIR),$(USER_FILES),$(DISABLED_SERVICES))
180
181 build_image: FORCE
182 @echo
183 @echo Building images...
184 rm -rf $(BUILD_DIR)/json_info_files/
185 $(NO_TRACE_MAKE) -C target/linux/$(BOARD)/image install TARGET_BUILD=1 IB=1 EXTRA_IMAGE_NAME="$(EXTRA_IMAGE_NAME)" \
186 $(if $(USER_PROFILE),PROFILE="$(USER_PROFILE)")
187
188 $(BIN_DIR)/profiles.json: FORCE
189 $(if $(CONFIG_JSON_OVERVIEW_IMAGE_INFO), \
190 WORK_DIR=$(BUILD_DIR)/json_info_files \
191 $(SCRIPT_DIR)/json_overview_image_info.py $@ \
192 )
193
194 json_overview_image_info: $(BIN_DIR)/profiles.json
195
196 checksum: FORCE
197 @echo
198 @echo Calculating checksums...
199 @$(call sha256sums,$(BIN_DIR))
200
201 clean:
202 rm -rf $(TMP_DIR) $(DL_DIR) $(TARGET_DIR) $(BIN_DIR)
203
204
205 info:
206 (unset PROFILE FILES PACKAGES MAKEFLAGS; $(MAKE) -s _call_info)
207
208 PROFILE_FILTER = $(filter DEVICE_$(PROFILE) $(PROFILE),$(PROFILE_NAMES))
209
210 _check_profile: FORCE
211 ifneq ($(PROFILE),)
212 ifeq ($(PROFILE_FILTER),)
213 @echo 'Profile "$(PROFILE)" does not exist!'
214 @echo 'Use "make info" to get a list of available profile names.'
215 @exit 1
216 endif
217 endif
218
219 _check_keys: FORCE
220 ifneq ($(CONFIG_SIGNATURE_CHECK),)
221 @if [ ! -s $(BUILD_KEY) -o ! -s $(BUILD_KEY).pub ]; then \
222 echo Generate local signing keys... >&2; \
223 $(STAGING_DIR_HOST)/bin/usign -G \
224 -s $(BUILD_KEY) -p $(BUILD_KEY).pub -c "Local build key"; \
225 $(SCRIPT_DIR)/opkg-key add $(BUILD_KEY).pub; \
226 fi
227 if [ ! -s $(BUILD_KEY).ucert ]; then \
228 echo Generate local certificate... >&2; \
229 $(STAGING_DIR_HOST)/bin/ucert -I \
230 -c $(BUILD_KEY).ucert \
231 -p $(BUILD_KEY).pub \
232 -s $(BUILD_KEY); \
233 fi
234 endif
235
236 image:
237 $(MAKE) -s _check_profile
238 $(MAKE) -s _check_keys
239 (unset PROFILE FILES PACKAGES MAKEFLAGS; \
240 $(MAKE) -s _call_image \
241 $(if $(PROFILE),USER_PROFILE="$(PROFILE_FILTER)") \
242 $(if $(FILES),USER_FILES="$(FILES)") \
243 $(if $(PACKAGES),USER_PACKAGES="$(PACKAGES)") \
244 $(if $(BIN_DIR),BIN_DIR="$(BIN_DIR)") \
245 $(if $(DISABLED_SERVICES),DISABLED_SERVICES="$(DISABLED_SERVICES)"))
246
247 manifest: FORCE
248 $(MAKE) -s _check_profile
249 $(MAKE) -s _check_keys
250 (unset PROFILE FILES PACKAGES MAKEFLAGS; \
251 $(MAKE) -s _call_manifest \
252 $(if $(PROFILE),USER_PROFILE="$(PROFILE_FILTER)") \
253 $(if $(PACKAGES),USER_PACKAGES="$(PACKAGES)"))
254
255 whatdepends: FORCE
256 ifeq ($(PACKAGE),)
257 @echo 'Variable `PACKAGE` is not set but required by `whatdepends`'
258 @exit 1
259 endif
260 @$(MAKE) -s package_reload
261 @$(OPKG) whatdepends -A $(PACKAGE)
262
263 .SILENT: help info image manifest whatdepends