Arch Linux

n8henrie

Member

From: Shiprock, NM

Registered: 2014-03-30

Posts: 45

Website

[SOLVED] asc signature not being automatically verified by makepkg

I was going to try my hand at updating https://aur.archlinux.org/packages/arm- … chain-bin/, which has been flagged out-of-date for a while.

I noticed that signature files are provided at https://developer.arm.com/tools-and-sof … /downloads as `.asc` files -- per the release notes, they are MD5.

I was thinking that adding the appropriate `.asc` file to `sources` would result in automatic verification and make future PKGBUILD updates simpler by using the provided signature files instead of having to manually update the values.

https://wiki.archlinux.org/index.php/PKGBUILD#Sources

Files in the source array with extensions .sig, .sign, or .asc are recognized by makepkg as PGP signatures and will be automatically used to verify the integrity of the corresponding source file.

Unfortunately it's not working as I expected:

# Maintainer: Andrew Chen <andrew@xortux.com>

_target=arm-none-linux-gnueabihf
_pkgver=10.2-2020.11

pkgname=${_target}-toolchain-bin
pkgver=${_pkgver//-/_}
pkgrel=1
pkgdesc="GNU Toolchain for the Cortex-A Family"
arch=('x86_64')
url="https://developer.arm.com/tools-and-software/open-source-software/developer-tools/gnu-toolchain/gnu-a/downloads"
license=('GPL' 'LGPL')
options=(!emptydirs !strip staticlibs)
source_url="https://developer.arm.com/-/media/Files/downloads/gnu-a/${_pkgver}/binrel/gcc-arm-${_pkgver}-x86_64-${_target}.tar.xz"
source=(
  "$source_url"
  "${source_url}.asc"
)

package() {
  mkdir -p ${pkgdir}/usr
  cp -a ${srcdir}/gcc-arm-${_pkgver}-x86_64-${_target}/* ${pkgdir}/usr

  rm -f ${pkgdir}/usr/*-manifest.txt
  rm -rf ${pkgdir}/usr/lib64
  rm -rf ${pkgdir}/usr/include
  rm -rf ${pkgdir}/usr/share/{doc,gcc-*,gdb,info,locale}
  rm -rf ${pkgdir}/usr/share/man/{man5,man7}
}

$ makepkg -s
==> Making package: arm-none-linux-gnueabihf-toolchain-bin 10.2_2020.11-1 (Thu 18 Feb 2021 09:13:42 AM MST)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
  -> Found gcc-arm-10.2-2020.11-x86_64-arm-none-linux-gnueabihf.tar.xz
  -> Found gcc-arm-10.2-2020.11-x86_64-arm-none-linux-gnueabihf.tar.xz.asc
==> ERROR: Integrity checks are missing for: source

Is this because the `.asc` file is an MD5 hash and not a PGP signature as expected by makepkg? I have manually verified that `md5sum` gives me the same output as what's in the `.asc file.

Is there a better way for me to use a signature file in a PKGBUILD?

Should I just give up and add an array of signatures for integrity checking (which will require manual updating in the future)? If so, should I go with MD5, since these are what is already provided by the source, or generate something more robust like a sha256?

Thanks in advance for any suggestions.

Last edited by n8henrie (2021-02-18 20:52:54)

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: [SOLVED] asc signature not being automatically verified by makepkg

Is this because the `.asc` file is an MD5 hash and not a PGP signature as expected by makepkg?

Yes

Is there a better way for me to use a signature file in a PKGBUILD?

You don't have a signature file. You have a manifest.

eschwartz

Fellow

Registered: 2014-08-08

Posts: 4,097

Re: [SOLVED] asc signature not being automatically verified by makepkg

Upstream is using an invalid filename for a file typically called "MD5SUMS" or "foo.md5" or something along those lines. The ".asc" filetype has NO meaning where it's ever valid to just contain checksums, and its use on the website you linked to constitutes a pointless waste of time and actual trickery due to being a bait-and-switch.

---

Managing AUR repos The Right Way -- aurpublish (now a standalone tool)

n8henrie

Member

From: Shiprock, NM

Registered: 2014-03-30

Posts: 45

Website

Re: [SOLVED] asc signature not being automatically verified by makepkg

Is there a better way for me to use a signature file in a PKGBUILD?

You don't have a signature file. You have a manifest.

Thanks for the correction.

Is there a better way for me to use a manifest in a PKGBUILD?

n8henrie

Member

From: Shiprock, NM

Registered: 2014-03-30

Posts: 45

Website

Re: [SOLVED] asc signature not being automatically verified by makepkg

Upstream is using an invalid filename for a file typically called "MD5SUMS" or "foo.md5" or something along those lines.

For the case I've described above, it doesn't seem that renaming the file to `foo.md5` (and replacing `foo.asc` with `foo.md5` in sources) has any effect.

So it seems like there is not a mechanism to have an AUR package automatically use a md5 / sha manifest (e.g. via a URL that can also be predicted via `$pkgver`) -- I should expect to manually add this to the PKGBUILD with each update, correct?

Also, it looks like my question above regarding MD5 vs a stronger checksum is answered here: "The checksum type and values should always be those provided by upstream".

eschwartz

Fellow

Registered: 2014-08-08

Posts: 4,097

Re: [SOLVED] asc signature not being automatically verified by makepkg

makepkg does not and will not support downloading a manifest file in order to define the md5sums=() array. You may copy the contents of the manifest file into the PKGBUILD, though.

Keep in mind that integrity checksums don't make any real security guarantee (it does provide TOFU), unlike PGP signatures. The most important thing md5sums=() does is let makepkg programmatically detect an erroring download or a case where upstream updates the file to a new version but does not provide versioned filenames.s

---

Managing AUR repos The Right Way -- aurpublish (now a standalone tool)

n8henrie

Member

From: Shiprock, NM

Registered: 2014-03-30

Posts: 45

Website

Re: [SOLVED] asc signature not being automatically verified by makepkg

Awesome, thanks for the help.