base-files: fix ucert verification

ucert needs to check the firmware part with metadata, but without the signature.
Use the new fwtool mode to extract that without altering the firmware image inside
the check

Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/package/base-files/files/lib/upgrade/fwtool.sh b/package/base-files/files/lib/upgrade/fwtool.sh
index 6d7300bad632c76e9d24a4c227a9734b7ad55aac..a0b3fb0a04826282855abc8644d83a79d00374b7 100644 (file)
--- a/package/base-files/files/lib/upgrade/fwtool.sh
+++ b/package/base-files/files/lib/upgrade/fwtool.sh
@@ -18,7 +18,8 @@ fwtool_check_signature() {
                return 0
        fi
 
-       ucert -V -m "$1" -c "/tmp/sysupgrade.ucert" -P /etc/opkg/keys
+       fwtool -q -T -s /dev/null "$1" | \
+               ucert -V -m - -c "/tmp/sysupgrade.ucert" -P /etc/opkg/keys
 
        return $?
 }