aboutsummaryrefslogtreecommitdiff
path: root/linux/makepkg
diff options
context:
space:
mode:
authorAqua-sama <aqua@iserlohn-fortress.net>2019-03-22 16:48:12 +0200
committerAqua-sama <aqua@iserlohn-fortress.net>2019-03-22 16:48:12 +0200
commitf9e85b7ddddd3b6a87dfc4d907cb1fbe16e22e77 (patch)
treec5e30ac4b1b0103ac00918f04c729fefb97f89d8 /linux/makepkg
parentAdd PluginLoader class (diff)
downloadsmolbote-f9e85b7ddddd3b6a87dfc4d907cb1fbe16e22e77.tar.xz
Replace xxd with python script
Diffstat (limited to 'linux/makepkg')
-rw-r--r--linux/makepkg/PKGBUILD39
1 files changed, 27 insertions, 12 deletions
diff --git a/linux/makepkg/PKGBUILD b/linux/makepkg/PKGBUILD
index 3907ff8..badf319 100644
--- a/linux/makepkg/PKGBUILD
+++ b/linux/makepkg/PKGBUILD
@@ -26,6 +26,18 @@ sha512sums=('SKIP'
#validgpgkeys=(# Aqua-sama <aqua@iserlohn-fortress.net>
# BB1C090188E3E32B375C13FD095DE26BC16D2E98)
+## Build Options
+
+# Run menuconfig
+#_menuconfig=
+
+# Enable plugin signing:
+# - generate a 4096-bit RSA key and embed the public key into the binary
+# - apply the plugin signing patch to the config, enabling PluginLoader::verify
+# - sign the plugins with the private key, and install the signatures
+# Because this embeds the public key into the executable, enabling this option will break reproducible builds.
+_signPlugins=
+
prepare() {
cd $srcdir/smolbote
@@ -33,16 +45,18 @@ prepare() {
git config submodule.3rd-party/SingleApplication/SingleApplication.git.url $srcdir/SingleApplication
git submodule update 3rd-party/SingleApplication/SingleApplication.git
- msg "Creating OpenSSL signing key"
- mkdir $srcdir/signing
- cd $srcdir/signing
- # generate rsa keypair
- openssl genrsa -out privateKey.pem 4096
- msg2 "RSA/4096 key created in $srcdir/signing/privateKey.pem. Keep this key if you want to sign additional plugins."
-
- openssl rsa -in privateKey.pem -pubout -out publicKey.pem
- xxd -i publicKey.pem $srcdir/smolbote/src/plugin/publicKey.h
- msg2 "Public key exported, and will be embedded into the resulting application. This will break reproducible builds."
+ if [ -n $_signPlugins ]; then
+ msg "Creating OpenSSL signing key"
+ mkdir $srcdir/signing
+ cd $srcdir/signing
+ # generate rsa keypair
+ openssl genrsa -out privateKey.pem 4096
+ msg2 "Keypair written to $srcdir/signing/privateKey.pem."
+
+ openssl rsa -in privateKey.pem -pubout -out publicKey.pem
+ ./tools/hexdump.py --name='publicKey_pem' publicKey.pem $srcdir/smolbote/src/plugin/publicKey.h
+ msg2 "Public key exported to $srcdir/signing/publicKey.pem."
+ fi
}
pkgver() {
@@ -71,7 +85,7 @@ build() {
# b_lto: Use link time optimization
meson --buildtype=plain --prefix=/usr/local --auto-features=disabled \
-Db_pie=true -Db_lto=true -Dcpp_link_args="-fuse-ld=gold" \
- -DPlasma=enabled -Dmanpage=enabled \
+ -Dmanpage=enabled \
$srcdir/build
# Run menuconfig
@@ -87,9 +101,10 @@ package() {
cd $srcdir/build
DESTDIR="$pkgdir" ninja install
- msg Signing plugins
+ msg "Signing plugins"
for so in $pkgdir/usr/local/lib/smolbote/plugins/*.so; do
openssl dgst -sha256 -sign $srcdir/signing/privateKey.pem -out $so.sig $so
+ install -m644 $so.sig $pkgdir/usr/lib/smolbote/plugins/$so.sig
done
}