Now that oe-core moved to OpenSSL 4.0, the engine API is gone.
As a result uboot-mkimage's -N/--engine no longer work:
Failed to sign 'signature-1' signature node in 'conf-imx6dl-riotboard.dtb' conf node
uboot-mkimage Can't add hashes to FIT blob: -1
Error: Bad parameters for FIT image type
Usage: uboot-mkimage [-T type] -l image
-l ==> list image header information
-T ==> parse image file as 'type'
-q ==> quiet
A previous patch documented how provider-based PKCS#11 signing works.
Now make an engine option in FITIMAGE_MKIMAGE_EXTRA_ARGS a fatal error. It
has no effect anymore, so a recipe still setting it has not been
migrated; failing with a clear message beats mkimage's generic error
messages above.
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Now that oe-core moved to OpenSSL 4.0, the engine API is gone.
As a result uboot-mkimage's -N/--engine no longer work:
Failed to sign 'signature-1' signature node in 'conf-imx6dl-riotboard.dtb' conf node
uboot-mkimage Can't add hashes to FIT blob: -1
Error: Bad parameters for FIT image type
Usage: uboot-mkimage [-T type] -l image
-l ==> list image header information
-T ==> parse image file as 'type'
-q ==> quiet
Document the provider-based setup instead: signing_create_uri_pem() wraps
the role's PKCS#11 URI in a PEM file that OpenSSL loads like a key file and
resolves through the PKCS#11 provider configured by signing_prepare().
mkimage looks for a key in
${FITIMAGE_SIGN_KEYDIR}/${FITIMAGE_SIGN_KEYNAME}.key, so store it there.
This way the existing mkimage invocations do not need to be touched.
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Following the example in the comment as-is will lead to an error at
do_fitimage time:
The key ID is not a valid PKCS#11 URI
The PKCS#11 URI format is defined by RFC7512
The key ID is not a valid PKCS#11 URI
The PKCS#11 URI format is defined by RFC7512
PKCS11_get_private_key returned NULL
Failure loading private key from engine: error:40000064:pkcs11 engine::invalid id
uboot-mkimage Can't add hashes to FIT blob: -1
Strip the pkcs11: prefix to resolve this and save future users the
hassle.
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
FITIMAGE_CONFIG_PREFIX is only used for configurations that contain a
kernel image, but not for mere overlay configurations.
This is inconsistent with the original kernel-fitimage.bbclass.
As the name may be hardcoded in the bootloader, add a new
FITIMAGE_CONFIG_FDTO_PREFIX to be able to customize the prefix for
device tree overlay configuration nodes as well.
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Please see
https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265
for what changes are needed, and sed commands that can be used to make them en masse.
I've verified that bitbake -c patch world works with these, but did not run a world
build; the majority of recipes shouldn't need further fixups, but if there are
some that still fall out, they can be fixed in followups.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
If the kernel build type uses compression, the bootloader needs to take
care of decompression. This must be configured in the FIT image via
FITIMAGE_IMAGE_myimage[comp]. So warn if the FIT image kernel compression
is not specified in such a case.
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Similar to e152f01d, this fixes another occurence of the config section
name to contain the 'conf_prefix'.
Luckily, this one is only debug output.
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
A given image type should be valid. Thus fail early here instead of
randomly failing later during mkimage call.
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
When no type is set, we simply pick 'kernel' as the default since it
is still the most common to be used for FIT images.
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
The 'image' name should be printed rather than the (unset) 'recipe'.
Also use f-strings for better readability.
Since a missing recipe configuration is fatal to a proper generation,
abort the parsing with bb.fatal instead of continuing with a broken
configuration.
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
The functions related to signing the fitimage had missing quotations and
newlines. Without this punctuation, the signing class would fail to
generate a signed fitimage.
To test this change just create a fitImage using this class and set
FITIMAGE_SIGN to 1. The resulting fitImage its file should have one
property per line with quotes around the property values.
Signed-off-by: John Ripple <john.ripple@keysight.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
getVar() now defaults to expanding by default, thus remove the True
option from getVar() calls with a regex search and replace.
Signed-off-by: Akash Hadke <akash.hadke27@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The FIT image support in OE is quite limited:
1) No support to build an arbitrary number of FIT images since the FIT
image generation is tightly coupled to the kernel image.
2) A lot of U_BOOT-specific variables which may not be necessary for
other bootloaders.
3) No usage of the meta-oe signing.bbclass for signed FIT images.
This alternative class is added to solve the above-mentioned problems:
1) The class can be inherited by an arbitrary number of
<fit-image-name>.bb recipes to generate FIT images
2) No U_BOOT-specific variables are used
3) <fit-image-name>.bb recipes can prepend the do_fitimage() to
provide the key using the signing.bbclass e.g.:
do_fitimage:prepend() {
signing_prepare
signing_use_role "${FITIMAGE_SIGNING_KEY_ROLE}"
}
Then enable and configure signing as follows:
FITIMAGE_SIGN = "1"
FITIMAGE_MKIMAGE_EXTRA_ARGS = "--engine pkcs11"
FITIMAGE_SIGN_KEYDIR = "${PKCS11_URI}
This class is inspired by the meta-phytec fitimage.bbclass [1].
[1] https://git.phytec.de/meta-phytec/tree/classes/fitimage.bbclass
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Bastian Krause
Ahmad Fatoum
Thomas Bonnefille
Alexander Kanavin
Enrico Jörns
John Ripple
Akash Hadke
Ulrich Ölmann
Marco Felsch