Little script to sign OpenWRT packages after running a build. I used this because I couldn't figure out how to do it automatically when using the SDK.

sign-openwrt-packages

#!/bin/bash

#
# AUTHOR: Andy Savage <[email protected]>
# GITHUB: https://gist.github.com/hongkongkiwi/cfef6910c5c644eaebc9
# PURPOSE: After building one or more packages in OpenWRT this script signs them with a key file
#          this can then be easily used in opkg to verify signatures.
#

KEY_DIR="$HOME/signify-keys"
USIGN="/bin/signify-openbsd"
KEY="${KEY_DIR}/mime.key"
PUB="${KEY_DIR}/mime.pub"
LOCAL_PUB="key.pub"
SCRIPT_DIR=`dirname "$0"`
SCRIPT_DIR=`readlink -e "$SCRIPT_DIR"`
DIR="${1:-${SCRIPT_DIR}/bin}"

# NOTE: When using debian install the signify-openbsd package
# You can generate your own ssl keys using signify-openbsd -G -s mime.key -p mime.pub -n
# All credit to here: http://www.karl.idv.hk/tag/openwrt

command -v "$USIGN" >/dev/null 2>&1 || { echo >&2 "I require signify-openbsd but it's not installed.  Aborting."; exit 1; }

if [ $DIR == "-h" ] || [ $DIR == "--help" ]; then
	echo "USAGE: $0 <bin_dir>"
	exit 0
fi

if [ ! -f "$KEY" ] || [ ! -f "$PUB" ]; then
        echo "Could not find private key or public key files.  Aborting."
	echo "You can genereate a keypair using:"
	echo "\t$USIGN -G -n -p mime.pub -s mime.key"
	exit 1
fi

if [ ! -d "$DIR" ]; then
        echo "$DIR is not a valid directory to find package files.  Aborting."
        exit 1
fi

PACKAGES_COUNT=`find $DIR -name "Packages" | wc -l`

if [[ $PACKAGES_COUNT == 0 ]]; then
	echo "No Packages found to sign (have you build them yet?).  Aborting."
	exit 1
fi

find $DIR -name "Packages" | while IFS= read -r packages_file; 
do
    package_dir=$(dirname "$packages_file")
    if [ -f "$package_dir/Packages.sig" ]; then
	rm "$package_dir/Packages.sig"
    fi
    FRIENDLY_NAME="${packages_file##$DIR/}"
    SIGN=`$USIGN -S -m "$packages_file" -s "$KEY" -x "$package_dir/Packages.sig"`
    test $? -ne 0 && echo "Signing failed!" || echo "Signed $FRIENDLY_NAME"
    VERIFY=`$USIGN -V -p "$PUB" -x "$package_dir/Packages.sig" -m "$packages_file"`
    test $? -ne 0 && echo "Verification failed! $FRIENDLY_NAME"
    # Copy our public key into the package dir so we can easily download it if this dir is exported via webserver
    cp "$PUB" "$package_dir/key.pub"
done

PUBLIC_KEY=`cat "$PUB"`
echo
echo "Public Key:"
echo "$PUBLIC_KEY"
echo
echo "Successfully signed $PACKAGES_COUNT packages"