MIRRORS/meta-intel
1
0
Fork 0
mirror of git://git.yoctoproject.org/meta-intel.git synced 2025-07-19 12:59:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

uefi-comboapp.bbclass: Split signing functionality into its own bbclass

Browse Source 
In the future more secure boot implementations will be offered, with
each one needing the signing method. Instead of repeating a forty line
block of code across several recipes, just use a configurable bbclass.

Signed-off-by: California Sullivan <california.l.sullivan@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
This commit is contained in:
California Sullivan 2017-07-18 16:56:18 -07:00 committed by Saul Wold
parent 21086869be
commit 625a588f70
2 changed files with 55 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
classes/uefi-comboapp.bbclass
View File

@ -83,27 +83,14 @@ python create_uefiapps () {
create_uefiapp(d, uuid=uuid)
}
sign_uefiapps () {
if ${@ bb.utils.contains('IMAGE_FEATURES', 'secureboot', 'true', 'false', d) } &&
[ -f ${UEFIAPP_SIGNING_KEY} ] && [ -f ${UEFIAPP_SIGNING_CERT} ]; then
for i in `find ${DEPLOY_DIR_IMAGE}/ -name '${IMAGE_LINK_NAME}.boot*.efi'`; do
sbsign --key ${UEFIAPP_SIGNING_KEY} --cert ${UEFIAPP_SIGNING_CERT} $i
sbverify --cert ${UEFIAPP_SIGNING_CERT} $i.signed
mv $i.signed $i
done
fi
}
# This is intentionally split into different parts. This way, derived
# classes or images can extend the individual parts. We can also use
# whatever language (shell script or Python) is more suitable.
python do_uefiapp() {
bb.build.exec_func('create_uefiapps', d)
bb.build.exec_func('sign_uefiapps', d)
}
do_uefiapp[vardeps] += "APPEND DISK_SIGNATURE_UUID INITRD_LIVE KERNEL_IMAGETYPE IMAGE_LINK_NAME"
do_uefiapp[depends] += "${@ bb.utils.contains('IMAGE_FEATURES', 'secureboot', 'sbsigntool-native:do_populate_sysroot', '', d) }"
uefiapp_deploy_at() {
dest=$1
@ -126,26 +113,6 @@ do_uefiapp_deploy[depends] += "${PN}:do_uefiapp"
# This decides when/how we add our tasks to the image
python () {
import os
import hashlib
secureboot = bb.utils.contains('IMAGE_FEATURES', 'secureboot', True, False, d)
# Ensure that if the signing key or cert change, we rerun the uefiapp process
if secureboot:
for varname in ('UEFIAPP_SIGNING_CERT', 'UEFIAPP_SIGNING_KEY'):
filename = d.getVar(varname)
if filename is None:
bb.fatal('%s is not set.' % varname)
if not os.path.isfile(filename):
bb.fatal('%s=%s is not a file.' % (varname, filename))
with open(filename, 'rb') as f:
data = f.read()
hash = hashlib.sha256(data).hexdigest()
d.setVar('%s_HASH' % varname, hash)
# Must reparse and thus rehash on file changes.
bb.parse.mark_dependency(d, filename)
image_fstypes = d.getVar('IMAGE_FSTYPES', True)
initramfs_fstypes = d.getVar('INITRAMFS_FSTYPES', True)
@ -155,7 +122,11 @@ python () {
bb.build.addtask('uefiapp_deploy', 'do_image', 'do_rootfs', d)
}
do_uefiapp[vardeps] += "UEFIAPP_SIGNING_CERT_HASH UEFIAPP_SIGNING_KEY_HASH"
SIGN_AFTER ?= "do_uefiapp"
SIGN_BEFORE ?= "do_uefiapp_deploy"
SIGNING_DIR ?= "${DEPLOY_DIR_IMAGE}"
SIGNING_BINARIES ?= "${IMAGE_LINK_NAME}.boot*.efi"
inherit uefi-sign
# Legacy hddimg support below this line
efi_hddimg_populate() {

50
classes/uefi-sign.bbclass Normal file
View File

@ -0,0 +1,50 @@
# By default, sign all .efi binaries in ${B} after compiling and before deploying
SIGNING_DIR ?= "${B}"
SIGNING_BINARIES ?= "*.efi"
SIGN_AFTER ?= "do_compile"
SIGN_BEFORE ?= "do_deploy"
python () {
import os
import hashlib
# Ensure that if the signing key or cert change, we rerun the uefiapp process
if bb.utils.contains('IMAGE_FEATURES', 'secureboot', True, False, d):
for varname in ('SECURE_BOOT_SIGNING_CERT', 'SECURE_BOOT_SIGNING_KEY'):
filename = d.getVar(varname)
if filename is None:
bb.fatal('%s is not set.' % varname)
if not os.path.isfile(filename):
bb.fatal('%s=%s is not a file.' % (varname, filename))
with open(filename, 'rb') as f:
data = f.read()
hash = hashlib.sha256(data).hexdigest()
d.setVar('%s_HASH' % varname, hash)
# Must reparse and thus rehash on file changes.
bb.parse.mark_dependency(d, filename)
bb.build.addtask('uefi_sign', d.getVar('SIGN_BEFORE'), d.getVar('SIGN_AFTER'), d)
# Original binary needs to be regenerated if the hash changes since we overwrite it
# SIGN_AFTER isn't necessarily when it gets generated, but its our best guess
d.appendVarFlag(d.getVar('SIGN_AFTER'), 'vardeps', 'SECURE_BOOT_SIGNING_CERT_HASH SECURE_BOOT_SIGNING_KEY_HASH')
}
do_uefi_sign() {
if [ -f ${SECURE_BOOT_SIGNING_KEY} ] && [ -f ${SECURE_BOOT_SIGNING_CERT} ]; then
for i in `find ${SIGNING_DIR}/ -name '${SIGNING_BINARIES}'`; do
sbsign --key ${SECURE_BOOT_SIGNING_KEY} --cert ${SECURE_BOOT_SIGNING_CERT} $i
sbverify --cert ${SECURE_BOOT_SIGNING_CERT} $i.signed
mv $i.signed $i
done
fi
}
do_uefi_sign[depends] += "sbsigntool-native:do_populate_sysroot"
do_uefi_sign[vardeps] += "SECURE_BOOT_SIGNING_CERT_HASH \
SECURE_BOOT_SIGNING_KEY_HASH \
SIGNING_BINARIES SIGNING_DIR \
SIGN_BEFORE SIGN_AFTER \
"