From: Felix Fietkau <nbd@nbd.name>
Date: Tue, 12 Feb 2019 15:37:30 +0000 (+0100)
Subject: base-files: fix ucert verification
X-Git-Tag: v19.07.0-rc1~1325
X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=b044b52ab9553b8d94cfc5565d2ea5013364159d;p=openwrt%2Fstaging%2Fpepe2k.git

base-files: fix ucert verification

ucert needs to check the firmware part with metadata, but without the signature.
Use the new fwtool mode to extract that without altering the firmware image inside
the check

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---

diff --git a/package/base-files/files/lib/upgrade/fwtool.sh b/package/base-files/files/lib/upgrade/fwtool.sh
index 6d7300bad6..a0b3fb0a04 100644
--- a/package/base-files/files/lib/upgrade/fwtool.sh
+++ b/package/base-files/files/lib/upgrade/fwtool.sh
@@ -18,7 +18,8 @@ fwtool_check_signature() {
 		return 0
 	fi
 
-	ucert -V -m "$1" -c "/tmp/sysupgrade.ucert" -P /etc/opkg/keys
+	fwtool -q -T -s /dev/null "$1" | \
+		ucert -V -m - -c "/tmp/sysupgrade.ucert" -P /etc/opkg/keys
 
 	return $?
 }