mirror of
git://git.yoctoproject.org/meta-intel.git
synced 2025-07-19 12:59:03 +02:00
recipes: remove secureboot selftest and images
This no longer works and is not maintained and tested. Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
This commit is contained in:
Anuj Mittal
parent
b47467609d
commit
f222ac31c5
|
|
@ -1,151 +0,0 @@
|
||||||
# This class brings a more generic version of the UEFI combo app from refkit to meta-intel.
|
|
||||||
# It uses a combo file, containing kernel, initramfs and
|
|
||||||
# command line, presented to the BIOS as UEFI application, by prepending
|
|
||||||
# it with the efi stub obtained from systemd-boot.
|
|
||||||
|
|
||||||
# Don't add syslinux or build an ISO
|
|
||||||
PCBIOS:forcevariable = "0"
|
|
||||||
NOISO:forcevariable = "1"
|
|
||||||
|
|
||||||
# image-live.bbclass will default INITRD_LIVE to the image INITRD_IMAGE creates.
|
|
||||||
# We want behavior to be consistent whether or not "live" is in IMAGE_FSTYPES, so
|
|
||||||
# we default INITRD_LIVE to the INITRD_IMAGE as well.
|
|
||||||
INITRD_IMAGE ?= "core-image-minimal-initramfs"
|
|
||||||
INITRD_LIVE ?= " ${@ ('${DEPLOY_DIR_IMAGE}/' + d.getVar('INITRD_IMAGE', expand=True) + '-${MACHINE}.cpio.gz') if d.getVar('INITRD_IMAGE', True) else ''}"
|
|
||||||
|
|
||||||
do_uefiapp[depends] += " \
|
|
||||||
intel-microcode:do_deploy \
|
|
||||||
systemd-boot:do_deploy \
|
|
||||||
virtual/kernel:do_deploy \
|
|
||||||
"
|
|
||||||
|
|
||||||
# INITRD_IMAGE is added to INITRD_LIVE, which we use to create our initrd, so depend on it if it is set
|
|
||||||
do_uefiapp[depends] += "${@ '${INITRD_IMAGE}:do_image_complete' if d.getVar('INITRD_IMAGE') else ''}"
|
|
||||||
|
|
||||||
# The image does without traditional bootloader.
|
|
||||||
# In its place, instead, it uses a single UEFI executable binary, which is
|
|
||||||
# composed by:
|
|
||||||
# - an UEFI stub
|
|
||||||
# The linux kernel can generate a UEFI stub, however the one from systemd-boot can fetch
|
|
||||||
# the command line from a separate section of the EFI application, avoiding the need to
|
|
||||||
# rebuild the kernel.
|
|
||||||
# - the kernel
|
|
||||||
# - an initramfs (optional)
|
|
||||||
|
|
||||||
def create_uefiapp(d, uuid=None, app_suffix=''):
|
|
||||||
import glob, re
|
|
||||||
from subprocess import check_call
|
|
||||||
|
|
||||||
build_dir = d.getVar('B')
|
|
||||||
deploy_dir_image = d.getVar('DEPLOY_DIR_IMAGE')
|
|
||||||
image_link_name = d.getVar('IMAGE_LINK_NAME')
|
|
||||||
|
|
||||||
cmdline = '%s/cmdline.txt' % build_dir
|
|
||||||
linux = '%s/%s' % (deploy_dir_image, d.getVar('KERNEL_IMAGETYPE'))
|
|
||||||
initrd = '%s/initrd' % build_dir
|
|
||||||
|
|
||||||
stub_path = '%s/linux*.efi.stub' % deploy_dir_image
|
|
||||||
stub = glob.glob(stub_path)[0]
|
|
||||||
m = re.match(r"\S*(ia32|x64)(.efi)\S*", os.path.basename(stub))
|
|
||||||
app = "boot%s%s%s" % (m.group(1), app_suffix, m.group(2))
|
|
||||||
executable = '%s/%s.%s' % (deploy_dir_image, image_link_name, app)
|
|
||||||
|
|
||||||
if d.getVar('INITRD_LIVE'):
|
|
||||||
with open(initrd, 'wb') as dst:
|
|
||||||
for cpio in d.getVar('INITRD_LIVE').split():
|
|
||||||
with open(cpio, 'rb') as src:
|
|
||||||
dst.write(src.read())
|
|
||||||
initrd_cmd = "--add-section .initrd=%s --change-section-vma .initrd=0x3000000 " % initrd
|
|
||||||
else:
|
|
||||||
initrd_cmd = ""
|
|
||||||
|
|
||||||
root = 'root=PARTUUID=%s' % uuid if uuid else ''
|
|
||||||
|
|
||||||
with open(cmdline, 'w') as f:
|
|
||||||
f.write('%s %s' % (d.getVar('APPEND'), root))
|
|
||||||
|
|
||||||
objcopy_cmd = ("objcopy "
|
|
||||||
"--add-section .cmdline=%s --change-section-vma .cmdline=0x30000 "
|
|
||||||
"--add-section .linux=%s --change-section-vma .linux=0x40000 "
|
|
||||||
"%s %s %s") % \
|
|
||||||
(cmdline, linux, initrd_cmd, stub, executable)
|
|
||||||
|
|
||||||
check_call(objcopy_cmd, shell=True)
|
|
||||||
|
|
||||||
python create_uefiapps () {
|
|
||||||
# We must clean up anything that matches the expected output pattern, to ensure that
|
|
||||||
# the next steps do not accidentally use old files.
|
|
||||||
import glob
|
|
||||||
pattern = d.expand('${DEPLOY_DIR_IMAGE}/${IMAGE_LINK_NAME}.boot*.efi')
|
|
||||||
for old_efi in glob.glob(pattern):
|
|
||||||
os.unlink(old_efi)
|
|
||||||
uuid = d.getVar('DISK_SIGNATURE_UUID')
|
|
||||||
create_uefiapp(d, uuid=uuid)
|
|
||||||
}
|
|
||||||
|
|
||||||
# This is intentionally split into different parts. This way, derived
|
|
||||||
# classes or images can extend the individual parts. We can also use
|
|
||||||
# whatever language (shell script or Python) is more suitable.
|
|
||||||
python do_uefiapp() {
|
|
||||||
bb.build.exec_func('create_uefiapps', d)
|
|
||||||
}
|
|
||||||
|
|
||||||
do_uefiapp[vardeps] += "APPEND DISK_SIGNATURE_UUID INITRD_LIVE KERNEL_IMAGETYPE IMAGE_LINK_NAME"
|
|
||||||
|
|
||||||
uefiapp_deploy_at() {
|
|
||||||
dest=$1
|
|
||||||
for i in ${DEPLOY_DIR_IMAGE}/${IMAGE_LINK_NAME}.boot*.efi; do
|
|
||||||
target=`basename $i`
|
|
||||||
target=`echo $target | sed -e 's/${IMAGE_LINK_NAME}.//'`
|
|
||||||
cp --preserve=timestamps -r $i $dest/$target
|
|
||||||
done
|
|
||||||
}
|
|
||||||
|
|
||||||
fakeroot do_uefiapp_deploy() {
|
|
||||||
rm -rf ${IMAGE_ROOTFS}/boot/*
|
|
||||||
dest=${IMAGE_ROOTFS}/boot/EFI/BOOT
|
|
||||||
mkdir -p $dest
|
|
||||||
uefiapp_deploy_at $dest
|
|
||||||
}
|
|
||||||
|
|
||||||
do_uefiapp_deploy[depends] += "${PN}:do_uefiapp virtual/fakeroot-native:do_populate_sysroot"
|
|
||||||
|
|
||||||
|
|
||||||
# This decides when/how we add our tasks to the image
|
|
||||||
python () {
|
|
||||||
image_fstypes = d.getVar('IMAGE_FSTYPES', True)
|
|
||||||
initramfs_fstypes = d.getVar('INITRAMFS_FSTYPES', True)
|
|
||||||
|
|
||||||
# Don't add any of these tasks to initramfs images
|
|
||||||
if initramfs_fstypes not in image_fstypes:
|
|
||||||
bb.build.addtask('uefiapp', 'do_image', 'do_rootfs', d)
|
|
||||||
bb.build.addtask('uefiapp_deploy', 'do_image', 'do_rootfs', d)
|
|
||||||
}
|
|
||||||
|
|
||||||
SIGN_AFTER ?= "do_uefiapp"
|
|
||||||
SIGN_BEFORE ?= "do_uefiapp_deploy"
|
|
||||||
SIGNING_DIR ?= "${DEPLOY_DIR_IMAGE}"
|
|
||||||
SIGNING_BINARIES ?= "${IMAGE_LINK_NAME}.boot*.efi"
|
|
||||||
inherit uefi-sign
|
|
||||||
|
|
||||||
# Legacy hddimg support below this line
|
|
||||||
efi_hddimg_populate() {
|
|
||||||
uefiapp_deploy_at "$1"
|
|
||||||
}
|
|
||||||
|
|
||||||
build_efi_cfg() {
|
|
||||||
# The command line is built into the combo app, so this is a null op
|
|
||||||
:
|
|
||||||
}
|
|
||||||
|
|
||||||
populate_kernel:append() {
|
|
||||||
# The kernel and initrd are built into the app, so we don't need these
|
|
||||||
if [ -f $dest/initrd ]; then
|
|
||||||
rm $dest/initrd
|
|
||||||
fi
|
|
||||||
if [ -f $dest/vmlinuz ]; then
|
|
||||||
rm $dest/vmlinuz
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
IMAGE_FEATURES[validitems] += "secureboot"
|
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
# By default, sign all .efi binaries in ${B} after compiling and before deploying
|
|
||||||
SIGNING_DIR ?= "${B}"
|
|
||||||
SIGNING_BINARIES ?= "*.efi"
|
|
||||||
SIGN_AFTER ?= "do_compile"
|
|
||||||
SIGN_BEFORE ?= "do_deploy"
|
|
||||||
|
|
||||||
python () {
|
|
||||||
import os
|
|
||||||
import hashlib
|
|
||||||
|
|
||||||
# Ensure that if the signing key or cert change, we rerun the uefiapp process
|
|
||||||
if bb.utils.contains('IMAGE_FEATURES', 'secureboot', True, False, d):
|
|
||||||
for varname in ('SECURE_BOOT_SIGNING_CERT', 'SECURE_BOOT_SIGNING_KEY'):
|
|
||||||
filename = d.getVar(varname)
|
|
||||||
if filename is None:
|
|
||||||
bb.fatal('%s is not set.' % varname)
|
|
||||||
if not os.path.isfile(filename):
|
|
||||||
bb.fatal('%s=%s is not a file.' % (varname, filename))
|
|
||||||
with open(filename, 'rb') as f:
|
|
||||||
data = f.read()
|
|
||||||
hash = hashlib.sha256(data).hexdigest()
|
|
||||||
d.setVar('%s_HASH' % varname, hash)
|
|
||||||
|
|
||||||
# Must reparse and thus rehash on file changes.
|
|
||||||
bb.parse.mark_dependency(d, filename)
|
|
||||||
|
|
||||||
bb.build.addtask('uefi_sign', d.getVar('SIGN_BEFORE'), d.getVar('SIGN_AFTER'), d)
|
|
||||||
|
|
||||||
# Original binary needs to be regenerated if the hash changes since we overwrite it
|
|
||||||
# SIGN_AFTER isn't necessarily when it gets generated, but its our best guess
|
|
||||||
d.appendVarFlag(d.getVar('SIGN_AFTER'), 'vardeps', 'SECURE_BOOT_SIGNING_CERT_HASH SECURE_BOOT_SIGNING_KEY_HASH')
|
|
||||||
}
|
|
||||||
|
|
||||||
do_uefi_sign() {
|
|
||||||
if [ -f ${SECURE_BOOT_SIGNING_KEY} ] && [ -f ${SECURE_BOOT_SIGNING_CERT} ]; then
|
|
||||||
for i in `find ${SIGNING_DIR}/ -name '${SIGNING_BINARIES}'`; do
|
|
||||||
sbsign --key ${SECURE_BOOT_SIGNING_KEY} --cert ${SECURE_BOOT_SIGNING_CERT} $i
|
|
||||||
sbverify --cert ${SECURE_BOOT_SIGNING_CERT} $i.signed
|
|
||||||
mv $i.signed $i
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
do_uefi_sign[depends] += "sbsigntool-native:do_populate_sysroot"
|
|
||||||
|
|
||||||
do_uefi_sign[vardeps] += "SECURE_BOOT_SIGNING_CERT_HASH \
|
|
||||||
SECURE_BOOT_SIGNING_KEY_HASH \
|
|
||||||
SIGNING_BINARIES SIGNING_DIR \
|
|
||||||
SIGN_BEFORE SIGN_AFTER \
|
|
||||||
"
|
|
||||||
|
|
@ -46,10 +46,6 @@ RECIPE_MAINTAINER:pn-openvino-inference-engine = "Anuj Mittal <anuj.mittal@intel
|
||||||
RECIPE_MAINTAINER:pn-openvino-model-optimizer = "Anuj Mittal <anuj.mittal@intel.com>"
|
RECIPE_MAINTAINER:pn-openvino-model-optimizer = "Anuj Mittal <anuj.mittal@intel.com>"
|
||||||
RECIPE_MAINTAINER:pn-openvkl = "Naveen Saini <naveen.kumar.saini@intel.com>"
|
RECIPE_MAINTAINER:pn-openvkl = "Naveen Saini <naveen.kumar.saini@intel.com>"
|
||||||
RECIPE_MAINTAINER:pn-ospray = "Naveen Saini <naveen.kumar.saini@intel.com>"
|
RECIPE_MAINTAINER:pn-ospray = "Naveen Saini <naveen.kumar.saini@intel.com>"
|
||||||
RECIPE_MAINTAINER:pn-ovmf-shell-image-enrollkeys = "Naveen Saini <naveen.kumar.saini@intel.com>"
|
|
||||||
RECIPE_MAINTAINER:pn-rkcommon = "Naveen Saini <naveen.kumar.saini@intel.com>"
|
RECIPE_MAINTAINER:pn-rkcommon = "Naveen Saini <naveen.kumar.saini@intel.com>"
|
||||||
RECIPE_MAINTAINER:pn-sbsigntool-native = "Anuj Mittal <anuj.mittal@intel.com>"
|
|
||||||
RECIPE_MAINTAINER:pn-secureboot-selftest-image-signed = "Anuj Mittal <anuj.mittal@intel.com>"
|
|
||||||
RECIPE_MAINTAINER:pn-secureboot-selftest-image-unsigned = "Anuj Mittal <anuj.mittal@intel.com>"
|
|
||||||
RECIPE_MAINTAINER:pn-thermald = "Anuj Mittal <anuj.mittal@intel.com>"
|
RECIPE_MAINTAINER:pn-thermald = "Anuj Mittal <anuj.mittal@intel.com>"
|
||||||
RECIPE_MAINTAINER:pn-xf86-video-ast = "Anuj Mittal <anuj.mittal@intel.com>"
|
RECIPE_MAINTAINER:pn-xf86-video-ast = "Anuj Mittal <anuj.mittal@intel.com>"
|
||||||
|
|
|
||||||
|
|
@ -1,176 +0,0 @@
|
||||||
#!/usr/bin/env python
|
|
||||||
# ex:ts=4:sw=4:sts=4:et
|
|
||||||
# -*- tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*-
|
|
||||||
#
|
|
||||||
# Copyright (c) 2017, Intel Corporation.
|
|
||||||
# All rights reserved.
|
|
||||||
#
|
|
||||||
# This program is free software; you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License version 2 as
|
|
||||||
# published by the Free Software Foundation.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License along
|
|
||||||
# with this program; if not, write to the Free Software Foundation, Inc.,
|
|
||||||
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
||||||
#
|
|
||||||
# AUTHORS
|
|
||||||
# Mikko Ylinen <mikko.ylinen@linux.intel.com>
|
|
||||||
#
|
|
||||||
# Based on meta/lib/oeqa/selftest/* and meta-refkit/lib/oeqa/selftest/*
|
|
||||||
|
|
||||||
"""Test cases for secure boot with QEMU running OVMF."""
|
|
||||||
|
|
||||||
import os
|
|
||||||
import unittest
|
|
||||||
import re
|
|
||||||
import glob
|
|
||||||
from shutil import rmtree, copy
|
|
||||||
|
|
||||||
from oeqa.core.decorator.depends import OETestDepends
|
|
||||||
from oeqa.selftest.case import OESelftestTestCase
|
|
||||||
from oeqa.utils.commands import runCmd, bitbake, get_bb_var, get_bb_vars, runqemu
|
|
||||||
|
|
||||||
class SecureBootTests(OESelftestTestCase):
|
|
||||||
"""Secure Boot test class."""
|
|
||||||
|
|
||||||
ovmf_keys_enrolled = False
|
|
||||||
ovmf_qemuparams = ''
|
|
||||||
ovmf_dir = ''
|
|
||||||
test_image_unsigned = 'secureboot-selftest-image-unsigned'
|
|
||||||
test_image_signed = 'secureboot-selftest-image-signed'
|
|
||||||
correct_key = 'refkit-db'
|
|
||||||
incorrect_key = 'incorrect'
|
|
||||||
|
|
||||||
@classmethod
|
|
||||||
def setUpLocal(self):
|
|
||||||
|
|
||||||
if not SecureBootTests.ovmf_keys_enrolled:
|
|
||||||
bitbake('ovmf ovmf-shell-image-enrollkeys', output_log=self.logger)
|
|
||||||
|
|
||||||
bb_vars = get_bb_vars(['TMPDIR', 'DEPLOY_DIR_IMAGE'])
|
|
||||||
|
|
||||||
SecureBootTests.ovmf_dir = os.path.join(bb_vars['TMPDIR'], 'oeselftest', 'secureboot', 'ovmf')
|
|
||||||
bb.utils.mkdirhier(SecureBootTests.ovmf_dir)
|
|
||||||
|
|
||||||
# Copy (all) OVMF in a temporary location
|
|
||||||
for src in glob.glob('%s/ovmf.*' % bb_vars['DEPLOY_DIR_IMAGE']):
|
|
||||||
copy(src, SecureBootTests.ovmf_dir)
|
|
||||||
|
|
||||||
SecureBootTests.ovmf_qemuparams = '-drive if=pflash,format=qcow2,file=%s/ovmf.secboot.qcow2' % SecureBootTests.ovmf_dir
|
|
||||||
|
|
||||||
cmd = ("runqemu "
|
|
||||||
"qemuparams='%s' "
|
|
||||||
"ovmf-shell-image-enrollkeys wic intel-corei7-64 "
|
|
||||||
"nographic slirp") % SecureBootTests.ovmf_qemuparams
|
|
||||||
print('Running "%s"' % cmd)
|
|
||||||
status = runCmd(cmd)
|
|
||||||
|
|
||||||
if not re.search('info: success', status.output, re.M):
|
|
||||||
self.fail('Failed to enroll keys. EFI shell log:\n%s' % status.output)
|
|
||||||
else:
|
|
||||||
# keys enrolled in ovmf.secboot.vars
|
|
||||||
SecureBootTests.ovmf_keys_enrolled = True
|
|
||||||
|
|
||||||
@classmethod
|
|
||||||
def tearDownLocal(self):
|
|
||||||
# Seems this is mandatory between the tests (a signed image is booted
|
|
||||||
# when running test_boot_unsigned_image after test_boot_signed_image).
|
|
||||||
# bitbake('-c clean %s' % test_image, output_log=self.logger)
|
|
||||||
#
|
|
||||||
# Whatever the problem was, it no longer seems to be necessary, so
|
|
||||||
# we can skip the time-consuming clean + full rebuild (5:04 min instead
|
|
||||||
# of 6:55min here).
|
|
||||||
pass
|
|
||||||
|
|
||||||
@classmethod
|
|
||||||
def tearDownClass(self):
|
|
||||||
bitbake('ovmf-shell-image-enrollkeys:do_cleanall', output_log=self.logger)
|
|
||||||
rmtree(self.ovmf_dir, ignore_errors=True)
|
|
||||||
|
|
||||||
def secureboot_with_image(self, boot_timeout=300, signing_key=None):
|
|
||||||
"""Boot the image with UEFI SecureBoot enabled and see the result. """
|
|
||||||
|
|
||||||
config = ""
|
|
||||||
|
|
||||||
if signing_key:
|
|
||||||
test_image = self.test_image_signed
|
|
||||||
config += 'SECURE_BOOT_SIGNING_KEY = "${THISDIR}/files/%s.key"\n' % signing_key
|
|
||||||
config += 'SECURE_BOOT_SIGNING_CERT = "${THISDIR}/files/%s.crt"\n' % signing_key
|
|
||||||
else:
|
|
||||||
test_image = self.test_image_unsigned
|
|
||||||
|
|
||||||
self.write_config(config)
|
|
||||||
bitbake(test_image, output_log=self.logger)
|
|
||||||
self.remove_config(config)
|
|
||||||
|
|
||||||
# Some of the cases depend on the timeout to expire. Allow overrides
|
|
||||||
# so that we don't have to wait 1000s which is the default.
|
|
||||||
overrides = {
|
|
||||||
'TEST_QEMUBOOT_TIMEOUT': boot_timeout,
|
|
||||||
}
|
|
||||||
|
|
||||||
print('Booting %s' % test_image)
|
|
||||||
|
|
||||||
try:
|
|
||||||
with runqemu(test_image, ssh=False,
|
|
||||||
runqemuparams='nographic slirp',
|
|
||||||
qemuparams=self.ovmf_qemuparams,
|
|
||||||
overrides=overrides,
|
|
||||||
image_fstype='wic') as qemu:
|
|
||||||
|
|
||||||
cmd = 'uname -a'
|
|
||||||
|
|
||||||
status, output = qemu.run_serial(cmd)
|
|
||||||
|
|
||||||
self.assertTrue(status, 'Could not run \'uname -a\' (status=%s):\n%s' % (status, output))
|
|
||||||
|
|
||||||
# if we got this far without a correctly signed image, something went wrong
|
|
||||||
if signing_key != self.correct_key:
|
|
||||||
self.fail('The image not give a Security violation when expected. Boot log:\n%s' % output)
|
|
||||||
|
|
||||||
|
|
||||||
except Exception:
|
|
||||||
|
|
||||||
# Currently runqemu() fails if 'login:' prompt is not seen and it's
|
|
||||||
# not possible to login as 'root'. Those conditions aren't met when
|
|
||||||
# booting to EFI shell (See [YOCTO #11438]). We catch the failure
|
|
||||||
# and parse the boot log to determine the success. Note: the
|
|
||||||
# timeout triggers verbose bb.error() but that's normal with some
|
|
||||||
# of the test cases.
|
|
||||||
|
|
||||||
workdir = get_bb_var('WORKDIR', test_image)
|
|
||||||
bootlog = "%s/testimage/qemu_boot_log" % workdir
|
|
||||||
|
|
||||||
with open(bootlog, "r") as log:
|
|
||||||
|
|
||||||
# This isn't right but all we can do at this point. The right
|
|
||||||
# approach would run commands in the EFI shell to determine
|
|
||||||
# the BIOS rejects unsigned and/or images signed with keys in
|
|
||||||
# dbx key store but that needs changes in oeqa framework.
|
|
||||||
|
|
||||||
output = log.read()
|
|
||||||
|
|
||||||
# PASS if we see a security violation on unsigned or incorrectly signed images, otherwise fail
|
|
||||||
if signing_key == self.correct_key:
|
|
||||||
self.fail('Correctly signed image failed to boot. Boot log:\n%s' % output)
|
|
||||||
elif not re.search('Security Violation', output):
|
|
||||||
self.fail('The image not give a Security violation when expected. Boot log:\n%s' % output)
|
|
||||||
|
|
||||||
def test_boot_unsigned_image(self):
|
|
||||||
""" Boot unsigned image with secureboot enabled in UEFI."""
|
|
||||||
self.secureboot_with_image(boot_timeout=120, signing_key=None)
|
|
||||||
|
|
||||||
@OETestDepends(['secureboot.SecureBootTests.test_boot_unsigned_image'])
|
|
||||||
def test_boot_incorrectly_signed_image(self):
|
|
||||||
""" Boot (correctly) signed image with secureboot enabled in UEFI."""
|
|
||||||
self.secureboot_with_image(boot_timeout=120, signing_key=self.incorrect_key)
|
|
||||||
|
|
||||||
@OETestDepends(['secureboot.SecureBootTests.test_boot_incorrectly_signed_image'])
|
|
||||||
def test_boot_correctly_signed_image(self):
|
|
||||||
""" Boot (correctly) signed image with secureboot enabled in UEFI."""
|
|
||||||
self.secureboot_with_image(boot_timeout=150, signing_key=self.correct_key)
|
|
||||||
|
|
@ -1,129 +0,0 @@
|
||||||
From b2099e7184d48a6d05c8713b6fd5dac0e2e70963 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Mikko Ylinen <mikko.ylinen@linux.intel.com>
|
|
||||||
Date: Wed, 2 Mar 2022 10:55:35 +0800
|
|
||||||
Subject: [PATCH] ovmf: RefkitTestCA: TEST UEFI SecureBoot
|
|
||||||
|
|
||||||
This patch adds refkit-db.cer (via xxd -i) in OVMF's db
|
|
||||||
signature database when used with EnrollDefaultKeys EFI
|
|
||||||
application. It's used for testing purposes only.
|
|
||||||
|
|
||||||
Images signed with refkit-db keys are allowed to boot.
|
|
||||||
|
|
||||||
Upstream-Status: Inappropriate
|
|
||||||
|
|
||||||
Signed-off-by: Mikko Ylinen <mikko.ylinen@linux.intel.com>
|
|
||||||
Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
|
|
||||||
---
|
|
||||||
OvmfPkg/EnrollDefaultKeys/AuthData.c | 69 +++++++++++++++++++
|
|
||||||
OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 3 +
|
|
||||||
OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h | 2 +
|
|
||||||
3 files changed, 74 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/EnrollDefaultKeys/AuthData.c b/OvmfPkg/EnrollDefaultKeys/AuthData.c
|
|
||||||
index 53ee7f7003..127131cd05 100644
|
|
||||||
--- a/OvmfPkg/EnrollDefaultKeys/AuthData.c
|
|
||||||
+++ b/OvmfPkg/EnrollDefaultKeys/AuthData.c
|
|
||||||
@@ -395,6 +395,75 @@ CONST UINT8 mMicrosoftUefiCa[] = {
|
|
||||||
|
|
||||||
CONST UINTN mSizeOfMicrosoftUefiCa = sizeof mMicrosoftUefiCa;
|
|
||||||
|
|
||||||
+CONST UINT8 mRefkitTestCA[] = {
|
|
||||||
+ 0x30, 0x82, 0x02, 0xfb, 0x30, 0x82, 0x01, 0xe3, 0xa0, 0x03, 0x02, 0x01,
|
|
||||||
+ 0x02, 0x02, 0x09, 0x00, 0xd4, 0xf6, 0x48, 0xc2, 0x68, 0x19, 0x91, 0xac,
|
|
||||||
+ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
|
|
||||||
+ 0x0b, 0x05, 0x00, 0x30, 0x14, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55,
|
|
||||||
+ 0x04, 0x03, 0x0c, 0x09, 0x72, 0x65, 0x66, 0x6b, 0x69, 0x74, 0x2d, 0x64,
|
|
||||||
+ 0x62, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x37, 0x30, 0x34, 0x32, 0x30, 0x31,
|
|
||||||
+ 0x32, 0x30, 0x36, 0x33, 0x32, 0x5a, 0x17, 0x0d, 0x31, 0x38, 0x30, 0x34,
|
|
||||||
+ 0x32, 0x30, 0x31, 0x32, 0x30, 0x36, 0x33, 0x32, 0x5a, 0x30, 0x14, 0x31,
|
|
||||||
+ 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x09, 0x72, 0x65,
|
|
||||||
+ 0x66, 0x6b, 0x69, 0x74, 0x2d, 0x64, 0x62, 0x30, 0x82, 0x01, 0x22, 0x30,
|
|
||||||
+ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
|
|
||||||
+ 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02,
|
|
||||||
+ 0x82, 0x01, 0x01, 0x00, 0xb4, 0x1c, 0x22, 0xa6, 0x22, 0x01, 0x57, 0xcd,
|
|
||||||
+ 0xf1, 0x4f, 0xaf, 0x72, 0xe3, 0xd9, 0x01, 0x80, 0x50, 0x55, 0xef, 0x02,
|
|
||||||
+ 0x5e, 0xeb, 0x99, 0x35, 0xcb, 0x7f, 0x2a, 0x79, 0xff, 0xb5, 0x3e, 0xec,
|
|
||||||
+ 0x5d, 0x92, 0x06, 0x30, 0x20, 0xe7, 0x95, 0xad, 0xa4, 0x84, 0x2e, 0x3f,
|
|
||||||
+ 0xfa, 0xd7, 0x46, 0xdd, 0x49, 0xa8, 0xe8, 0xe3, 0x79, 0x49, 0xf6, 0x8f,
|
|
||||||
+ 0x0b, 0x1d, 0xfe, 0x63, 0xa8, 0xd1, 0x63, 0xa3, 0xd6, 0x0d, 0x4e, 0x6c,
|
|
||||||
+ 0x66, 0x5c, 0xd6, 0x66, 0x26, 0xd1, 0x26, 0x98, 0xd4, 0x4f, 0x76, 0xc9,
|
|
||||||
+ 0x65, 0x48, 0x58, 0x13, 0x08, 0x31, 0xbc, 0xe5, 0x47, 0x25, 0x65, 0x95,
|
|
||||||
+ 0x39, 0x89, 0x5f, 0x02, 0xf1, 0xc5, 0x06, 0x17, 0x58, 0xca, 0x09, 0xfd,
|
|
||||||
+ 0xf6, 0x1e, 0xc5, 0x97, 0xda, 0xa3, 0x4e, 0x1a, 0x48, 0xbe, 0xcf, 0x96,
|
|
||||||
+ 0x27, 0x04, 0x4b, 0xb7, 0x6d, 0x67, 0xb6, 0x50, 0x18, 0x04, 0x73, 0x51,
|
|
||||||
+ 0xd2, 0x6a, 0x2d, 0xdf, 0x3b, 0xab, 0xf2, 0x2d, 0x95, 0xd7, 0xa8, 0xb8,
|
|
||||||
+ 0xa8, 0x30, 0xa1, 0xab, 0x8b, 0x92, 0x2b, 0x60, 0x3e, 0x3a, 0xe5, 0x86,
|
|
||||||
+ 0x40, 0x71, 0xc1, 0x3f, 0x2d, 0x2e, 0x90, 0xe7, 0xd6, 0xec, 0xcc, 0xc2,
|
|
||||||
+ 0x0b, 0x79, 0x83, 0x71, 0x6d, 0xf6, 0xa3, 0xa9, 0x4c, 0xcd, 0x46, 0x81,
|
|
||||||
+ 0xdc, 0xef, 0xec, 0x51, 0xbe, 0x81, 0x2a, 0xf1, 0x78, 0x73, 0x41, 0xdb,
|
|
||||||
+ 0x54, 0xce, 0x7c, 0xce, 0xa2, 0xe3, 0x90, 0x4f, 0x45, 0x1a, 0xf9, 0x3d,
|
|
||||||
+ 0x88, 0xfc, 0x0e, 0xed, 0xd3, 0x69, 0x22, 0x4c, 0xfa, 0x0a, 0x69, 0xd1,
|
|
||||||
+ 0x48, 0xc0, 0xaa, 0xa9, 0x3a, 0xb3, 0x8f, 0x10, 0x3a, 0x76, 0xa8, 0x0c,
|
|
||||||
+ 0x7a, 0x3d, 0xd8, 0x79, 0xce, 0x1c, 0x96, 0x62, 0xf4, 0x06, 0xee, 0x47,
|
|
||||||
+ 0xe8, 0xe0, 0x69, 0x91, 0xae, 0xea, 0x34, 0xcf, 0xda, 0xa8, 0xb4, 0x39,
|
|
||||||
+ 0x5e, 0xf3, 0x7a, 0xd0, 0x88, 0x48, 0x47, 0x69, 0x02, 0x03, 0x01, 0x00,
|
|
||||||
+ 0x01, 0xa3, 0x50, 0x30, 0x4e, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
|
|
||||||
+ 0x04, 0x16, 0x04, 0x14, 0x68, 0x60, 0x11, 0x25, 0x85, 0x14, 0x78, 0x1b,
|
|
||||||
+ 0x1a, 0x9f, 0x46, 0x12, 0xe6, 0x21, 0xe4, 0xef, 0xfb, 0x3b, 0xaa, 0xdd,
|
|
||||||
+ 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80,
|
|
||||||
+ 0x14, 0x68, 0x60, 0x11, 0x25, 0x85, 0x14, 0x78, 0x1b, 0x1a, 0x9f, 0x46,
|
|
||||||
+ 0x12, 0xe6, 0x21, 0xe4, 0xef, 0xfb, 0x3b, 0xaa, 0xdd, 0x30, 0x0c, 0x06,
|
|
||||||
+ 0x03, 0x55, 0x1d, 0x13, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30,
|
|
||||||
+ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
|
|
||||||
+ 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x8f, 0xd2, 0x84, 0x7c, 0x43,
|
|
||||||
+ 0x47, 0xca, 0x6b, 0xfd, 0x87, 0x83, 0xd0, 0xef, 0x75, 0xd3, 0x20, 0x52,
|
|
||||||
+ 0x73, 0x18, 0xaa, 0x32, 0x71, 0xfb, 0xa5, 0xf4, 0xc9, 0x11, 0xa3, 0x68,
|
|
||||||
+ 0x4d, 0xb7, 0x9d, 0xe6, 0xd9, 0x46, 0x24, 0xdc, 0xc7, 0xc2, 0x3b, 0xf9,
|
|
||||||
+ 0xb0, 0x98, 0xfc, 0xee, 0x34, 0x6e, 0x10, 0x9b, 0x3d, 0x44, 0x6e, 0x33,
|
|
||||||
+ 0x09, 0x11, 0xb8, 0x29, 0xd6, 0x2d, 0x06, 0xcf, 0x67, 0x8f, 0x96, 0x85,
|
|
||||||
+ 0x9d, 0x63, 0x72, 0xbf, 0x64, 0x5f, 0x0d, 0xe3, 0xc9, 0x63, 0x19, 0x71,
|
|
||||||
+ 0xd4, 0x7d, 0x4c, 0x9c, 0x77, 0x46, 0xda, 0x20, 0x97, 0x6d, 0xbc, 0xdd,
|
|
||||||
+ 0xc2, 0x1f, 0xf3, 0x40, 0x38, 0x1e, 0xe7, 0xcc, 0x55, 0x05, 0x72, 0xba,
|
|
||||||
+ 0x24, 0x4f, 0xb3, 0x8a, 0x93, 0x0c, 0x30, 0x60, 0xda, 0x9f, 0x6f, 0x35,
|
|
||||||
+ 0xf6, 0xfb, 0xb0, 0x1f, 0xb3, 0x00, 0xdd, 0xc4, 0xa6, 0xbc, 0xe2, 0x37,
|
|
||||||
+ 0xc1, 0xa3, 0xef, 0xd9, 0xa1, 0x86, 0xf9, 0xeb, 0xa4, 0xa5, 0x45, 0x38,
|
|
||||||
+ 0xff, 0x4e, 0x87, 0x4a, 0x41, 0xcf, 0x6e, 0x69, 0x7e, 0x97, 0xbe, 0x2d,
|
|
||||||
+ 0x22, 0xbc, 0x8d, 0xa0, 0x1a, 0x21, 0x8f, 0x4b, 0x72, 0x90, 0x01, 0x5c,
|
|
||||||
+ 0xba, 0xa5, 0x9c, 0x2d, 0xd7, 0x25, 0x24, 0xfc, 0xff, 0x5c, 0x58, 0x14,
|
|
||||||
+ 0x46, 0x30, 0x09, 0x7c, 0x55, 0x64, 0x83, 0x0b, 0xb9, 0xdf, 0xcf, 0x25,
|
|
||||||
+ 0xee, 0xec, 0xf7, 0xcb, 0xdb, 0xd1, 0x5b, 0x93, 0x93, 0xc8, 0x8a, 0x10,
|
|
||||||
+ 0x46, 0xb8, 0xb0, 0x35, 0x1c, 0x6c, 0x0d, 0x8f, 0x03, 0x6a, 0x8f, 0x1b,
|
|
||||||
+ 0x36, 0x68, 0xf3, 0x53, 0x89, 0x36, 0x5b, 0x21, 0x80, 0xde, 0xe3, 0x92,
|
|
||||||
+ 0x52, 0x94, 0x97, 0x9d, 0x49, 0x89, 0x7d, 0x3e, 0xde, 0x29, 0x51, 0xba,
|
|
||||||
+ 0x11, 0xf7, 0xba, 0x01, 0xf7, 0xab, 0xea, 0xc1, 0xa7, 0x2e, 0xa3, 0x4d,
|
|
||||||
+ 0x65, 0xfd, 0x40, 0x71, 0xf1, 0xe2, 0x3f, 0x6c, 0x28, 0xcb, 0xd3
|
|
||||||
+};
|
|
||||||
+
|
|
||||||
+CONST UINTN mSizeOfRefkitTestCA = sizeof mRefkitTestCA;
|
|
||||||
+
|
|
||||||
//
|
|
||||||
// The Microsoft.UefiSecureBootLogo.Tests.OutOfBoxConfirmDBXisPresent test case
|
|
||||||
// of the Secure Boot Logo Test in the Microsoft Hardware Certification Kit
|
|
||||||
diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
|
|
||||||
index 094e4c821b..0a7eef54dc 100644
|
|
||||||
--- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
|
|
||||||
+++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
|
|
||||||
@@ -702,6 +702,9 @@ ShellAppMain (
|
|
||||||
mMicrosoftUefiCa,
|
|
||||||
mSizeOfMicrosoftUefiCa,
|
|
||||||
&gMicrosoftVendorGuid,
|
|
||||||
+ mRefkitTestCA,
|
|
||||||
+ mSizeOfRefkitTestCA,
|
|
||||||
+ &gEfiCallerIdGuid,
|
|
||||||
NULL
|
|
||||||
);
|
|
||||||
}
|
|
||||||
diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h
|
|
||||||
index 56da9c71d6..8de1dfe4e0 100644
|
|
||||||
--- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h
|
|
||||||
+++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h
|
|
||||||
@@ -133,4 +133,6 @@ extern CONST UINTN mSizeOfMicrosoftUefiCa;
|
|
||||||
extern CONST UINT8 mSha256OfDevNull[];
|
|
||||||
extern CONST UINTN mSizeOfSha256OfDevNull;
|
|
||||||
|
|
||||||
+extern CONST UINT8 mRefkitTestCA[];
|
|
||||||
+extern CONST UINTN mSizeOfRefkitTestCA;
|
|
||||||
#endif /* ENROLL_DEFAULT_KEYS_H_ */
|
|
||||||
--
|
|
||||||
2.17.1
|
|
||||||
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
require recipes-core/ovmf/ovmf-shell-image.bb
|
|
||||||
|
|
||||||
WKS_SEARCH_PATH:append = ":${COREBASE}/meta/recipes-core/ovmf"
|
|
||||||
|
|
||||||
QB_DRIVE_TYPE = "/dev/vd"
|
|
||||||
|
|
||||||
do_image:append() {
|
|
||||||
cat > ${IMAGE_ROOTFS}/startup.nsh << EOF
|
|
||||||
EnrollDefaultKeys
|
|
||||||
reset
|
|
||||||
EOF
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
FILESEXTRAPATHS:prepend:intel-x86-common := "${THISDIR}/files:"
|
|
||||||
|
|
||||||
SRC_URI:append:intel-x86-common = " \
|
|
||||||
file://0001-ovmf-RefkitTestCA-TEST-UEFI-SecureBoot.patch \
|
|
||||||
"
|
|
||||||
PACKAGECONFIG:append:intel-x86-common = " secureboot"
|
|
||||||
|
|
@ -1,19 +0,0 @@
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIDCTCCAfGgAwIBAgIJAIYXAHv3cQNjMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV
|
|
||||||
BAMMEFRlc3QgWW9jdG8gdGhpbmcwHhcNMTcwMTI1MjI1MjI3WhcNMTgwMTI1MjI1
|
|
||||||
MjI3WjAbMRkwFwYDVQQDDBBUZXN0IFlvY3RvIHRoaW5nMIIBIjANBgkqhkiG9w0B
|
|
||||||
AQEFAAOCAQ8AMIIBCgKCAQEAukI2ioMeL8qaXxMtryonAT51w+Zre0wB8bDBPuXD
|
|
||||||
SwDVXNWfiKKTfCVEkLEUnsUEd7jiKswCT5orTwCD7aQK0mTrkAWEi8hEI3MkNoeh
|
|
||||||
T51gkuTfv7A/HgPkhhlU4UQqipI6XoLf7o7PUV33ZfB43//iKY2kLBdsFvs4ALWE
|
|
||||||
31hLOkCFb+nqMnfZxq7DgvBwIdxJdLQvaskpDMfkna+zE3QWqkH5v55atW8Bunwk
|
|
||||||
/6q5kqNhyrjZb4i0BqJ5AHFUEQzlDcjpyFVUtR14r0IxjBFMHZXrx4uLe7KvGf/4
|
|
||||||
GqpqeFOPqxMsfC5ILJJ7nvwFViqftGgtWg/12bKMTB5saQIDAQABo1AwTjAdBgNV
|
|
||||||
HQ4EFgQURA8KbgpiGfS2+7MT0H5AvpxeYLowHwYDVR0jBBgwFoAURA8KbgpiGfS2
|
|
||||||
+7MT0H5AvpxeYLowDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAK9n+
|
|
||||||
9T+hlM2kEpsUgtyihEJbGHzbw+Pj11b0ICntCVuPKewtBMveYp8lejrQwMFNGRMt
|
|
||||||
ZQe1LFb9HcLeM3MLUz9Lm4BJIjkey3Jfq1AskROYk/bJnFIJIx6P3U9gBa20P46X
|
|
||||||
LH3g6yub1HR7KZC9nfBsak3FPoJR/SYTJs0HsMeL4878+2IbETA4BL0kbKW48FFW
|
|
||||||
jF4f6don0eiaF8b4KkfbWKrCaEm+LMxbyBEQ6fIb1cmGY8A9A5houjmgi6YWSkoi
|
|
||||||
SLpOC9TZ2R51fO9rRsv7XwLK0V9o9YaEYPBg6V/TeJl5nxAZBeVTKVTQbBGZY+l2
|
|
||||||
nzN0pKsl7RXLf3SRYA==
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
|
|
@ -1,27 +0,0 @@
|
||||||
-----BEGIN RSA PRIVATE KEY-----
|
|
||||||
MIIEowIBAAKCAQEAukI2ioMeL8qaXxMtryonAT51w+Zre0wB8bDBPuXDSwDVXNWf
|
|
||||||
iKKTfCVEkLEUnsUEd7jiKswCT5orTwCD7aQK0mTrkAWEi8hEI3MkNoehT51gkuTf
|
|
||||||
v7A/HgPkhhlU4UQqipI6XoLf7o7PUV33ZfB43//iKY2kLBdsFvs4ALWE31hLOkCF
|
|
||||||
b+nqMnfZxq7DgvBwIdxJdLQvaskpDMfkna+zE3QWqkH5v55atW8Bunwk/6q5kqNh
|
|
||||||
yrjZb4i0BqJ5AHFUEQzlDcjpyFVUtR14r0IxjBFMHZXrx4uLe7KvGf/4GqpqeFOP
|
|
||||||
qxMsfC5ILJJ7nvwFViqftGgtWg/12bKMTB5saQIDAQABAoIBAQCEtAox86s9N6d2
|
|
||||||
164z3998Zmj3UyL+7K9x6JI2YvMabBSYGOeaLOLRj6fjQxdC63H8brBM958p4di7
|
|
||||||
Z82XMco4Dok6yoOeJ+hMLYv+gfGvTJxy7DhyVXsSwok99axg9vUsV3TYw3wSdpNF
|
|
||||||
EKLkcUldpu0W2ADBHUr4sLI85xctHH3Kt0sNDzhgADFa5rDYACXTKHtFOhEqBIwN
|
|
||||||
FmbuRQirnErUkI3Pczgl2Xy1MlaozH9CB+bLAb5q2FYu4DKgjl4UorC+w2HV41KH
|
|
||||||
XoL7L36XXqLRHBfEAwOWb8yro+TK8T7gW7aagTI1wgsbbQkjQmOHxclmJACdMOiJ
|
|
||||||
DjPeR0GBAoGBAO7i2eaEoKa9QlKokN+93uOJD/F6DBi6jF0vGOqWlF8AVTj3kGL3
|
|
||||||
X8fY/avrSlg7hKZWdei+Q5PyZViKxqmHjq781ZisKck52Tqz4s7ylqRXSgStinZr
|
|
||||||
UqrkShCqZ3g1W91gIeVPQz0/b+gBskoHzQ5WQHfV5v9S1PaxjzcYtCrRAoGBAMea
|
|
||||||
LcA2jjuEjqxa5v5fh8ygcHasJMRKJxW1OCKiQ94DjjzPsdVqZ1sJZChLW/N3nxe7
|
|
||||||
wHlNJmsGbJ2w1zD5+qkkPjLq5Q4B5KAd62NNrWaEHFdEc/PPkn4xP7Zkfuu5K+m2
|
|
||||||
7z/MF4ibvVh9PvD3HY8FWKEtkqB4rfD8AoUOVd4ZAoGAXxXAsfa8k2Hl0kzyTXyg
|
|
||||||
CWV3CSERS46FbFngyw9gw2e4hFJWEG5ym3ONlS60iuY16JelmxyQfYUQPewPI0+n
|
|
||||||
xZMx2fE9OLFj+++6KbF5sLRl6/K/mF8jqo3vxS5uvPRQOo+XLlUcaHalrm1ub/Um
|
|
||||||
87v1MT3dEmgACKmoXb/hhuECgYAZluiapePiOYJZEmZe4jx0vXTtofAswhz0qYEC
|
|
||||||
3663vdj0buQrqjKJ91BB4jdtpT5eOpHYe02blv1B0jQkcUfze1QGDxtCineXF37g
|
|
||||||
Aktiwzkm7v22mjv7tbCnX4buDZVVp0BQ+4dg2iaSO6xgFC5T8amFMGSF8jLKnGRu
|
|
||||||
ToIvsQKBgADBTse2vnI85NRsYq48ztQuIU2zlGXIAcoPSvGb8Vhty/joc0jWcI5P
|
|
||||||
raGXBARbuVlcEapK3mDRfO0CQjDaTPK4EYYJwGp8k33Hkkcbgs4kfm308jRsclMr
|
|
||||||
YeMwQsYyOv45x4iPCwrqZEhpPDvACBi7DB6QvZ0++vJbobTt1jyi
|
|
||||||
-----END RSA PRIVATE KEY-----
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIC+zCCAeOgAwIBAgIJANT2SMJoGZGsMA0GCSqGSIb3DQEBCwUAMBQxEjAQBgNV
|
|
||||||
BAMMCXJlZmtpdC1kYjAeFw0xNzA0MjAxMjA2MzJaFw0xODA0MjAxMjA2MzJaMBQx
|
|
||||||
EjAQBgNVBAMMCXJlZmtpdC1kYjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
|
|
||||||
ggEBALQcIqYiAVfN8U+vcuPZAYBQVe8CXuuZNct/Knn/tT7sXZIGMCDnla2khC4/
|
|
||||||
+tdG3Umo6ON5SfaPCx3+Y6jRY6PWDU5sZlzWZibRJpjUT3bJZUhYEwgxvOVHJWWV
|
|
||||||
OYlfAvHFBhdYygn99h7Fl9qjThpIvs+WJwRLt21ntlAYBHNR0mot3zur8i2V16i4
|
|
||||||
qDChq4uSK2A+OuWGQHHBPy0ukOfW7MzCC3mDcW32o6lMzUaB3O/sUb6BKvF4c0Hb
|
|
||||||
VM58zqLjkE9FGvk9iPwO7dNpIkz6CmnRSMCqqTqzjxA6dqgMej3Yec4clmL0Bu5H
|
|
||||||
6OBpka7qNM/aqLQ5XvN60IhIR2kCAwEAAaNQME4wHQYDVR0OBBYEFGhgESWFFHgb
|
|
||||||
Gp9GEuYh5O/7O6rdMB8GA1UdIwQYMBaAFGhgESWFFHgbGp9GEuYh5O/7O6rdMAwG
|
|
||||||
A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAI/ShHxDR8pr/YeD0O910yBS
|
|
||||||
cxiqMnH7pfTJEaNoTbed5tlGJNzHwjv5sJj87jRuEJs9RG4zCRG4KdYtBs9nj5aF
|
|
||||||
nWNyv2RfDePJYxlx1H1MnHdG2iCXbbzdwh/zQDge58xVBXK6JE+zipMMMGDan281
|
|
||||||
9vuwH7MA3cSmvOI3waPv2aGG+eukpUU4/06HSkHPbml+l74tIryNoBohj0tykAFc
|
|
||||||
uqWcLdclJPz/XFgURjAJfFVkgwu5388l7uz3y9vRW5OTyIoQRriwNRxsDY8Dao8b
|
|
||||||
NmjzU4k2WyGA3uOSUpSXnUmJfT7eKVG6Efe6Afer6sGnLqNNZf1AcfHiP2woy9M=
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
-----BEGIN PRIVATE KEY-----
|
|
||||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC0HCKmIgFXzfFP
|
|
||||||
r3Lj2QGAUFXvAl7rmTXLfyp5/7U+7F2SBjAg55WtpIQuP/rXRt1JqOjjeUn2jwsd
|
|
||||||
/mOo0WOj1g1ObGZc1mYm0SaY1E92yWVIWBMIMbzlRyVllTmJXwLxxQYXWMoJ/fYe
|
|
||||||
xZfao04aSL7PlicES7dtZ7ZQGARzUdJqLd87q/ItldeouKgwoauLkitgPjrlhkBx
|
|
||||||
wT8tLpDn1uzMwgt5g3Ft9qOpTM1Ggdzv7FG+gSrxeHNB21TOfM6i45BPRRr5PYj8
|
|
||||||
Du3TaSJM+gpp0UjAqqk6s48QOnaoDHo92HnOHJZi9AbuR+jgaZGu6jTP2qi0OV7z
|
|
||||||
etCISEdpAgMBAAECggEAbtXplKbUgL4hQ9JKN2Cxhc7qMv0YgI92BVaqQw1S8ffu
|
|
||||||
1Q+tynH5MDRPi06gBJ59SvkA6AsZsvrv8nM7zQWd9ZKh+aLHk1X04upOgDoW9JiX
|
|
||||||
FV/txlslTUrs/ohIMfsgCrweNXvUSTXZobIi8s8QHyipE4HpXMFjjZYHIV7GTlgA
|
|
||||||
PRgGu3NygbWfR8hcx5JtzVz/jka7FFFSbk/pMr0TeJHXP55VfqWLeeSBQmWwooj2
|
|
||||||
QcRfqMXgLKgu6uEggaP5HMcfTuWgWNhbke/596CgsUtQ5Gg64Q6v7cKcPy0/lgn1
|
|
||||||
PnvfT9uhgEFDLNFkSBxV3ImrNYo73Nqmbp3w5tK9SQKBgQDs/HW7pNnB0LD51qok
|
|
||||||
pkX0SBvyKxDT1QuU4z0FY9GT7OKOg8Xa0ZGyErt+ZbyFiyUGF5Axc3rJ3DyGslgu
|
|
||||||
5O+AqcpCQOlOyovGQ6ST9x/gEeVcRnZn1MV4vMxwaOSXtY7u0IGyaDlFn1QWHWCN
|
|
||||||
imv8OR6YuhivwBIXGzJ16oEqDwKBgQDCj3ls7tlPrLvUQIh8gfjCoInU8fRAqtAe
|
|
||||||
Ab/OximLsKQPKLDma6xd+X2Fk8Dowdb88GNT99x3VZjHqVJM9URDkiOGKAXA/rBp
|
|
||||||
jAXhnQwahT8YCzOUHqDYNMMQrXHvbiHqLodGrrO2WjYNmH69prQAk8WYAIwl+hdx
|
|
||||||
BS70LGLPBwKBgQDU9RinAkBcFjiyieBjBreeCJ50Q5bfhHbf2EOhcE2IbDo6bteB
|
|
||||||
Bwmxx3uM3cdHCf6/NrVweqFAfBQ3xlPP8BH4wJrsZoBBOWnZRDfEbzHJnMtK3FbS
|
|
||||||
fzTkhmQAL4Ibgh9rIxspQtcUZVSees+k4VqgUIPaIoDEjgizktEJfS2MqQKBgQDA
|
|
||||||
rOFtVaRz2PYyHq6LzxMRe3bEIdDn8cEk1kqjdW9TXV07feqiZmNOtXLvRAG4/63u
|
|
||||||
1Akp8L6ul2Az6qUMfaBa4nC3vQ7lr9P40qhIZATGhsqS/xTXTPWw55999qZsnL6N
|
|
||||||
cgKZpw1mOzRohmqNWnfMUotOGsywF1n7nUyAlyxLJQKBgElTaNTFYF3MbGfhl1He
|
|
||||||
fnDXlf8OCOK1i5oIzMLqverb2UN/qp6p0b3SAtcw5cUXcaPlajHrfYgacF/0Qyua
|
|
||||||
Cerey9GLEdJ7saDWhz0GyJ8yyEXy8CVs0svVaLPWI0s2B7/obzP9+gTb/WE9qZqu
|
|
||||||
bNoVEpJ/wZhk+IL4+KPmqphu
|
|
||||||
-----END PRIVATE KEY-----
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
require secureboot-selftest-image-unsigned.bb
|
|
||||||
|
|
||||||
IMAGE_FEATURES += "secureboot"
|
|
||||||
|
|
||||||
SECURE_BOOT_SIGNING_KEY ?= "${THISDIR}/files/refkit-db.key"
|
|
||||||
SECURE_BOOT_SIGNING_CERT ?= "${THISDIR}/files/refkit-db.crt"
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
require recipes-core/images/core-image-minimal.bb
|
|
||||||
|
|
||||||
DEPENDS:remove = "grub-efi"
|
|
||||||
|
|
||||||
inherit uefi-comboapp
|
|
||||||
|
|
||||||
WKS_FILE = "generic-bootdisk.wks.in"
|
|
||||||
|
|
||||||
do_uefiapp_deploy:append() {
|
|
||||||
for i in ${DEPLOY_DIR_IMAGE}/${IMAGE_LINK_NAME}.boot*.efi; do
|
|
||||||
target=`basename $i`
|
|
||||||
target=`echo $target | sed -e 's/${IMAGE_LINK_NAME}.//'`
|
|
||||||
|
|
||||||
cat > ${IMAGE_ROOTFS}/boot/startup.nsh << EOF
|
|
||||||
$target
|
|
||||||
reset
|
|
||||||
EOF
|
|
||||||
break
|
|
||||||
done
|
|
||||||
}
|
|
||||||
|
|
@ -1,83 +0,0 @@
|
||||||
DESCRIPTION = "Utility for signing and verifying files for UEFI Secure Boot"
|
|
||||||
LICENSE = "GPL-3.0-only & LGPL-2.1-only & LGPL-3.0-only & MIT"
|
|
||||||
|
|
||||||
# sbsigntool statically links to libccan.a which is built with modules
|
|
||||||
# passed to "create-ccan-tree" (and their dependencies). Therefore,
|
|
||||||
# we also keep track of all the ccan module licenses.
|
|
||||||
LIC_FILES_CHKSUM = "file://LICENSE.GPLv3;md5=9eef91148a9b14ec7f9df333daebc746 \
|
|
||||||
file://COPYING;md5=a7710ac18adec371b84a9594ed04fd20 \
|
|
||||||
file://lib/ccan.git/ccan/endian/LICENSE;md5=2d5025d4aa3495befef8f17206a5b0a1 \
|
|
||||||
file://lib/ccan.git/ccan/htable/LICENSE;md5=2d5025d4aa3495befef8f17206a5b0a1 \
|
|
||||||
file://lib/ccan.git/ccan/list/LICENSE;md5=2d5025d4aa3495befef8f17206a5b0a1 \
|
|
||||||
file://lib/ccan.git/ccan/read_write_all/LICENSE;md5=2d5025d4aa3495befef8f17206a5b0a1 \
|
|
||||||
file://lib/ccan.git/ccan/talloc/LICENSE;md5=2d5025d4aa3495befef8f17206a5b0a1 \
|
|
||||||
file://lib/ccan.git/ccan/typesafe_cb/LICENSE;md5=2d5025d4aa3495befef8f17206a5b0a1 \
|
|
||||||
file://lib/ccan.git/ccan/failtest/LICENSE;md5=6a6a8e020838b23406c81b19c1d46df6 \
|
|
||||||
file://lib/ccan.git/ccan/tlist/LICENSE;md5=6a6a8e020838b23406c81b19c1d46df6 \
|
|
||||||
file://lib/ccan.git/ccan/time/LICENSE;md5=838c366f69b72c5df05c96dff79b35f2 \
|
|
||||||
"
|
|
||||||
|
|
||||||
# The original upstream is git://kernel.ubuntu.com/jk/sbsigntool but it has
|
|
||||||
# not been maintained and many patches have been backported in this repo.
|
|
||||||
SRC_URI = "git://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git;protocol=https;name=sbsigntools;branch=master \
|
|
||||||
git://github.com/rustyrussell/ccan.git;protocol=https;destsuffix=git/lib/ccan.git;name=ccan;branch=master \
|
|
||||||
file://0001-configure-Fixup-build-dependencies-for-cross-compili.patch \
|
|
||||||
"
|
|
||||||
|
|
||||||
SRCREV_sbsigntools ?= "9cfca9fe7aa7a8e29b92fe33ce8433e212c9a8ba"
|
|
||||||
SRCREV_ccan ?= "b1f28e17227f2320d07fe052a8a48942fe17caa5"
|
|
||||||
SRCREV_FORMAT = "sbsigntools_ccan"
|
|
||||||
|
|
||||||
DEPENDS = "binutils-native gnu-efi-native help2man-native openssl-native util-linux-native"
|
|
||||||
|
|
||||||
PV = "0.9.5"
|
|
||||||
|
|
||||||
S = "${WORKDIR}/git"
|
|
||||||
|
|
||||||
inherit autotools pkgconfig
|
|
||||||
inherit native
|
|
||||||
|
|
||||||
do_configure:prepend() {
|
|
||||||
cd ${S}
|
|
||||||
|
|
||||||
sed -i s#RECIPE_SYSROOT#${RECIPE_SYSROOT_NATIVE}#g configure.ac
|
|
||||||
|
|
||||||
if [ ! -e lib/ccan ]; then
|
|
||||||
|
|
||||||
# Use empty SCOREDIR because 'make scores' is not run.
|
|
||||||
# The default setting depends on (non-whitelisted) host tools.
|
|
||||||
sed -i -e 's#^\(SCOREDIR=\).*#\1#' lib/ccan.git/Makefile
|
|
||||||
|
|
||||||
lib/ccan.git/tools/create-ccan-tree \
|
|
||||||
--build-type=automake lib/ccan \
|
|
||||||
talloc read_write_all build_assert array_size endian
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Create generatable docs from git
|
|
||||||
(
|
|
||||||
echo "Authors of sbsigntool:"
|
|
||||||
echo
|
|
||||||
git log --format='%an' | sort -u | sed 's,^,\t,'
|
|
||||||
) > AUTHORS
|
|
||||||
|
|
||||||
# Generate simple ChangeLog
|
|
||||||
git log --date=short --format='%ad %t %an <%ae>%n%n * %s%n' > ChangeLog
|
|
||||||
|
|
||||||
cd ${B}
|
|
||||||
}
|
|
||||||
|
|
||||||
def efi_arch(d):
|
|
||||||
import re
|
|
||||||
harch = d.getVar("HOST_ARCH")
|
|
||||||
if re.match("i[3456789]86", harch):
|
|
||||||
return "ia32"
|
|
||||||
return harch
|
|
||||||
|
|
||||||
EXTRA_OEMAKE = "\
|
|
||||||
INCLUDES+='-I${S}/lib/ccan.git/ \
|
|
||||||
-I${STAGING_INCDIR_NATIVE}/efi \
|
|
||||||
-I${STAGING_INCDIR_NATIVE} \
|
|
||||||
-I${STAGING_INCDIR_NATIVE}/efi/${@efi_arch(d)}' \
|
|
||||||
"
|
|
||||||
|
|
||||||
CFLAGS:append = " -Wno-error"
|
|
||||||
|
|
@ -1,54 +0,0 @@
|
||||||
From c3533b8da1e1425801d2fc0bcd231e13d593f16b Mon Sep 17 00:00:00 2001
|
|
||||||
From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
|
|
||||||
Date: Tue, 19 Feb 2019 20:07:45 +0800
|
|
||||||
Subject: [PATCH] configure: Fixup build dependencies for cross-compiling
|
|
||||||
|
|
||||||
When cross-compiling, custom header files and libraries need to be
|
|
||||||
specified. sbsign assumes that all the dependencies are located
|
|
||||||
under /usr/include and /usr/lib.
|
|
||||||
|
|
||||||
Prepend these paths with a placeholder that can be replaced with the
|
|
||||||
actual paths once they are resolved.
|
|
||||||
|
|
||||||
Upstream-Status: Inappropriate [OE specific]
|
|
||||||
|
|
||||||
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
|
|
||||||
|
|
||||||
Taken from :
|
|
||||||
https://github.com/intel/luv-yocto/tree/master/meta-luv/recipes-devtools/sbsigntool/sbsigntool
|
|
||||||
|
|
||||||
Corrected typo error and ported to version 0.9.2
|
|
||||||
|
|
||||||
Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
|
|
||||||
---
|
|
||||||
configure.ac | 7 +++++--
|
|
||||||
1 file changed, 5 insertions(+), 2 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/configure.ac b/configure.ac
|
|
||||||
index 1459e91..3e34c8d 100644
|
|
||||||
--- a/configure.ac
|
|
||||||
+++ b/configure.ac
|
|
||||||
@@ -70,7 +70,10 @@ AM_CONDITIONAL(TEST_BINARY_FORMAT, [ test "$EFI_ARCH" = "arm" -o "$EFI_ARCH" = "
|
|
||||||
##
|
|
||||||
# no consistent view of where gnu-efi should dump the efi stuff, so find it
|
|
||||||
##
|
|
||||||
-for path in /lib /lib64 /usr/lib /usr/lib64 /usr/lib32 /lib/efi /lib64/efi /usr/lib/efi /usr/lib64/efi /usr/lib/gnuefi /usr/lib64/gnuefi ; do
|
|
||||||
+for path in RECIPE_SYSROOT/lib RECIPE_SYSROOT/lib64 RECIPE_SYSROOT/usr/lib \
|
|
||||||
+ RECIPE_SYSROOT/usr/lib64 RECIPE_SYSROOT/usr/lib32 \
|
|
||||||
+ RECIPE_SYSROOT/lib/efi RECIPE_SYSROOT/lib64/efi \
|
|
||||||
+ RECIPE_SYSROOT/usr/lib/efi RECIPE_SYSROOT/usr/lib64/efi; do
|
|
||||||
if test -e $path/crt0-efi-$EFI_ARCH.o; then
|
|
||||||
CRTPATH=$path
|
|
||||||
fi
|
|
||||||
@@ -79,7 +82,7 @@ if test -z "$CRTPATH"; then
|
|
||||||
AC_MSG_ERROR([cannot find the gnu-efi crt path])
|
|
||||||
fi
|
|
||||||
|
|
||||||
-EFI_CPPFLAGS="-I/usr/include/efi -I/usr/include/efi/$EFI_ARCH \
|
|
||||||
+EFI_CPPFLAGS="-IRECIPE_SYSROOT/usr/include/efi -IRECIPE_SYSROOT/usr/include/efi/$EFI_ARCH \
|
|
||||||
-DEFI_FUNCTION_WRAPPER"
|
|
||||||
CPPFLAGS_save="$CPPFLAGS"
|
|
||||||
CPPFLAGS="$CPPFLAGS $EFI_CPPFLAGS"
|
|
||||||
--
|
|
||||||
2.7.4
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user