Catcrafts/fp6-img
Watch
2
0
Fork
You've already forked fp6-img
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

imsd: sign from a readable copy of the abuild key

Browse source 
Run 49 died in section 3b: pmbootstrap's abuild-keygen runs inside the
chroot as its own user (uid 12345), so the key in config_abuild/ is 0600 to
that uid and the build user cannot read it; openssl dgst -sign exited 1 and
apk-resign.py swallowed its stderr. Take a private copy via sudo for the
duration of the re-sign, and make the script name an unreadable key and let
openssl's stderr through instead of hiding it.
This commit is contained in:
Jorijn van der Graaf 2026-09-02 17:21:30 +02:00
commit 0b488e40ec
Signed by: jorijnvdgraaf
GPG key ID: 2937E59CDCC1BCFB
2 changed files with 19 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
build.sh
View file

@ -268,9 +268,15 @@ if [ ! -f "$ABUILD_KEY" ]; then
echo "expected exactly one abuild key in $WORKDIR/config_abuild" >&2
exit 1
fi
# abuild-keygen ran inside the chroot as pmbootstrap's user (uid 12345), so
# the key is 0600 to that uid and unreadable here (run 49 died on exactly
# this); sign from a private copy taken via sudo, then drop it.
KEYCOPY="$IMSD_DL/abuild-key.rsa"
sudo install -m 0600 -o "$(id -un)" "$ABUILD_KEY" "$KEYCOPY"
for _f in "$IMSD_DL"/*.apk; do
python3 ./apk-resign.py "$_f" "$ABUILD_KEY" "$(basename "$ABUILD_KEY").pub"
python3 ./apk-resign.py "$_f" "$KEYCOPY" "$(basename "$ABUILD_KEY").pub"
done
rm -f "$KEYCOPY"
mkdir -p "$WORKDIR/packages/edge/aarch64"
mv "$IMSD_DL"/*.apk "$WORKDIR/packages/edge/aarch64/"
pmbootstrap index