meta-integrity: implement the system trusted cert and IMA trusted cert

Signed-off-by: Lans Zhang <jia.zhang@windriver.com>

meta-integrity/recipes-kernel/linux/linux-yocto-integrity.inc

@@ -7,14 +7,15 @@ DEPENDS += "${@'key-store openssl-native' if d.getVar('IMA_ENABLED', True) == '1
 # in initramfs only. So we don't add it to RDEPENDS_${PN} here.
 
 SRC_URI += "\
-    ${@'file://ima.scc file://ima.cfg file://integrity.scc file://integrity.cfg' if d.getVar('IMA_ENABLED', True) == '1' else ''} \
+    ${@'file://ima.scc file://ima.cfg file://integrity.scc file://integrity.cfg' \
+       if d.getVar('IMA_ENABLED', True) == '1' else ''} \
 "
 
-do_configure_append() {
-    cert="${STAGING_DIR_TARGET}${sysconfdir}/keys/system_trusted_key.der"
+do_configure_prepend() {
+    cert="${STAGING_DIR_TARGET}${sysconfdir}/keys/system_trusted_key.crt"
 
     if [ -f "$cert" ]; then
-        install -m 0644 "$cert" "${B}/system_trusted_cert.x509"
+        install -m 0644 "$cert" "${B}"
     else
         true
     fi

meta-integrity/recipes-kernel/linux/linux-yocto/integrity.cfg

@@ -5,3 +5,7 @@ CONFIG_INTEGRITY_AUDIT=y
 CONFIG_INTEGRITY_SIGNATURE=y
 CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
 CONFIG_SYSTEM_TRUSTED_KEYRING=y
+CONFIG_SYSTEM_TRUSTED_KEYS="system_trusted_key.crt"
+CONFIG_SYSTEM_EXTRA_CERTIFICATE=y
+CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE=4096
+CONFIG_SECONDARY_TRUSTED_KEYRING=y