cleanup /etc/opkg/keys on upgrades

[rotanid]

we discussed in today's gluon meetup that we want to clear old opkg signing keys on each upgrade
currently, nodes that are around for years might have a load of old signing keys in that directory if the keys weren't re-used for new builds by the community.

[maurerle]

currently I have a bunch of untrusted comment: Local build key and a key for 19.07, 21.02 and 22.03 each starting with:
untrusted comment: Public usign key for 22.03 release builds

Do you think there is any way to distinguish between the current and previous keys?

I see 2 ways out:

1. delete all keys resulting in one release without usable opkg, have a working one shortly after
2. use reused keys for the future and add a different comment in a the reused key and delete all Local build key keys.

Both ways include having a package which contains something like this (tested and works):

#!/usr/bin/lua
local handle = io.popen("ls /etc/opkg/keys -1")
local files = handle:read("*a")
handle:close()

for file in files:gmatch("[^\r\n]+") do
  local filePath = "/etc/opkg/keys/" .. file
  local fileHandle = io.open(filePath, "r")
  local fileContent = fileHandle:read("*all")
  fileHandle:close()

  if fileContent:find("untrusted comment: Local build key") then
    os.remove(filePath)
    print("Deleted file:", filePath)
  end
end

should this be part of a optional gluon-package to be run on upgrade or is this more something for the community-repo?

[Djfe]

From the gluon meetup

Roughly where this code can be added:
Once a sysupgrade test was successful, empty the keys folder (right before the actual sysupgrade is run)
https://github.com/freifunk-gluon/packages/blob/master/admin/autoupdater/src/autoupdater.c#L385

Other code related to the autoupdater:
https://github.com/freifunk-gluon/packages/tree/master/admin/autoupdater
Other code related to the sysupgrade itself:
https://github.com/openwrt/openwrt/blob/main/package/base-files/files/sbin/sysupgrade
https://github.com/openwrt/openwrt/tree/main/package/base-files/files/lib/upgrade (for example stage2)

[maurerle]

That seems like a good way to do it:
I would add the above script right here:
https://github.com/freifunk-gluon/packages/tree/master/admin/autoupdater/files/usr/lib/autoupdater/upgrade.d

so that it gets picked up right after checking if the upgrade should actually be done here:
https://github.com/freifunk-gluon/packages/blob/master/admin/autoupdater/src/autoupdater.c#L420