ci: validate package signatures

.github/workflows/build.yaml

@@ -45,6 +45,11 @@ jobs:
     name: build-packages
     runs-on: ubuntu-24.04
     needs: build-meta
+    outputs:
+      usign-public-key:
+        ${{ steps.build-keypair.outputs.usign-public-key }}
+      usign-fingerprint:
+        ${{ steps.build-keypair.outputs.usign-fingerprint }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -94,17 +99,26 @@ jobs:
         with:
           path: /tmp/openwrt-sdk
           key: ${{ steps.cache-key-sdk.outputs.cache-key }}
+      - name: Get build keypair
+        id: build-keypair
+        env:
+          GHA_PRIVATE_KEY: ${{ secrets.USIGN_PRIVATE_KEY }}
+          GHA_PUBLIC_KEY: ${{ vars.USIGN_PUBLIC_KEY }}
+        run: |
+          bash $GITHUB_WORKSPACE/contrib/build-key.sh /tmp/openwrt-sdk/staging_dir/host/bin/usign
+      - name: Save secret build-key
+        run: |
+          echo "${{ steps.build-keypair.outputs.usign-private-key }}" > /tmp/openwrt-sdk/key-build
       - name: Create SDK configuration
         run: |
-          cd /tmp/openwrt-sdk
-          echo "# CONFIG_SIGNED_PACKAGES is not set" > /tmp/openwrt-sdk/.config
           echo CONFIG_FFDA_OOB_FIRMWARE_VERSION=\"${{ needs.build-meta.outputs.firmware-version }}\" >> /tmp/openwrt-sdk/.config
-          make defconfig
+          make -C /tmp/openwrt-sdk defconfig
       - name: Build packages
         run: |
-          cd /tmp/openwrt-sdk
-          make package/ffda-oob-firmware/compile V=s -j4
-          make package/index
+          make -C /tmp/openwrt-sdk package/ffda-oob-firmware/compile V=s -j4
+      - name: Generate package index
+        run: |
+          make -C /tmp/openwrt-sdk package/index V=s
       - name: Show binary output directory structure
         run: |
           tree /tmp/openwrt-sdk/bin
@@ -161,9 +175,11 @@ jobs:
         with:
           path: /tmp/openwrt-imagebuilder
           key: ${{ steps.cache-key-ib.outputs.cache-key }}
+      - name: Save public build-key
+        run: |
+          echo "${{ needs.build-packages.outputs.usign-public-key }}" > /tmp/openwrt-imagebuilder/keys/${{ needs.build-packages.outputs.usign-fingerprint }}
       - name: Link repositories
         run: |
-          sed -i '/^option check_signature/d' /tmp/openwrt-imagebuilder/repositories.conf
           echo "src oobfw file:///tmp/packages/packages-oobfw" >> /tmp/openwrt-imagebuilder/repositories.conf
           echo "src oobpkgs file:///tmp/packages/packages-oobpkgs" >> /tmp/openwrt-imagebuilder/repositories.conf
       - name: Set Version information

contrib/build-key.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+USIGN_PATH="$1"
+KEY_PATH="$(mktemp -d)"
+
+if [ -z "$USIGN_PATH" ] || [ -z "$KEY_PATH" ]; then
+	echo "Usage: $0 <usign_path> <key_path>"
+	exit 1
+fi
+
+$USIGN_PATH -G -p "$KEY_PATH/public.key" -s "$KEY_PATH/private.key"
+
+if [ -n "$GHA_PRIVATE_KEY" ] && [ -n "$GHA_PUBLIC_KEY" ]; then
+	echo "GHA_PRIVATE_KEY and GHA_PUBLIC_KEY is set"
+
+	echo "$GHA_PRIVATE_KEY" > "$KEY_PATH/private.key"
+	echo "$GHA_PUBLIC_KEY" > "$KEY_PATH/public.key"
+fi
+
+USIGN_PRIVATE_KEY="$(cat $KEY_PATH/private.key)"
+USIGN_PUBLIC_KEY="$(cat $KEY_PATH/public.key)"
+USIGN_FINGERPRINT="$($USIGN_PATH -F -p $KEY_PATH/public.key)"
+
+echo "usign-private-key<<EOF" >> "$GITHUB_OUTPUT"
+echo "$USIGN_PRIVATE_KEY" >> "$GITHUB_OUTPUT"
+echo "EOF" >> "$GITHUB_OUTPUT"
+
+echo "usign-public-key<<EOF" >> "$GITHUB_OUTPUT"
+echo "$USIGN_PUBLIC_KEY" >> "$GITHUB_OUTPUT"
+echo "EOF" >> "$GITHUB_OUTPUT"
+
+echo "usign-fingerprint<<EOF" >> "$GITHUB_OUTPUT"
+echo "$USIGN_FINGERPRINT" >> "$GITHUB_OUTPUT"
+echo "EOF" >> "$GITHUB_OUTPUT"
+
+rm -rf "$KEY_PATH"