mirror of
https://git.yoctoproject.org/meta-arm
synced 2026-01-11 15:00:39 +00:00
682fb426ee
Unified Kernel Image includes kernel and initrd which both are signed with UEFI secure boot. This brings secure boot closer to userspace. Use core-image-initramfs-boot to find the real rootfs and boot systemd init there. No need to hard code rootfs via qemuboot/runqemu variables. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Jon Mason <jon.mason@arm.com>
52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
# yaml-language-server: $schema=https://raw.githubusercontent.com/siemens/kas/master/kas/schema-kas.json
|
|
|
|
# UEFI Secure Boot: A mechanism to ensure that only trusted software is executed
|
|
# during the boot process.
|
|
|
|
header:
|
|
version: 14
|
|
includes:
|
|
- ci/meta-openembedded.yml
|
|
- ci/meta-secure-core.yml
|
|
|
|
local_conf_header:
|
|
uefi_secureboot: |
|
|
SBSIGN_KEYS_DIR = "${TOPDIR}/sbkeys"
|
|
BB_ENV_PASSTHROUGH_ADDITIONS = "SBSIGN_KEYS_DIR"
|
|
|
|
# Detected by passing kernel parameter
|
|
QB_KERNEL_ROOT = ""
|
|
|
|
# kernel is in the image, should not be loaded separately
|
|
QB_DEFAULT_KERNEL = "none"
|
|
|
|
WKS_FILE = "efi-disk.wks.in"
|
|
KERNEL_IMAGETYPE = "Image"
|
|
|
|
MACHINE_FEATURES:append = " efi uefi-secureboot uefi-http-boot uefi-capsule-updates"
|
|
|
|
EFI_PROVIDER = "systemd-boot"
|
|
|
|
# Use systemd as the init system
|
|
INIT_MANAGER = "systemd"
|
|
|
|
IMAGE_INSTALL:append = " systemd systemd-boot util-linux coreutils"
|
|
|
|
TEST_SUITES:append = " uefi_secureboot uki"
|
|
|
|
IMAGE_CLASSES += "uki"
|
|
|
|
IMAGE_CLASSES += "sbsign"
|
|
UKI_SB_KEY = "${SBSIGN_KEY}"
|
|
UKI_SB_CERT = "${SBSIGN_CERT}"
|
|
QB_KERNEL_ROOT = ""
|
|
IMAGE_BOOT_FILES:remove = "Image"
|
|
|
|
INITRAMFS_IMAGE = "core-image-initramfs-boot"
|
|
# not for initramfs image recipe
|
|
IMAGE_CLASSES:remove:pn-core-image-initramfs-boot = "uki"
|
|
IMAGE_CLASSES:remove:pn-core-image-initramfs-boot = "sbsign"
|
|
IMAGE_CLASSES:remove:pn-core-image-initramfs-boot = "testimage"
|
|
IMAGE_FEATURES:remove:pn-core-image-initramfs-boot = "ssh-server-dropbear"
|
|
CORE_IMAGE_EXTRA_INSTALL:remove:pn-core-image-initramfs-boot = "ssh-pregen-hostkeys"
|