mirrors/meta-secure-core
1
0
Fork 0
mirror of https://github.com/jiazhang0/meta-secure-core.git synced 2026-07-16 12:47:00 +00:00
Code Issues Projects Releases Wiki Activity

check for signature before copy

Browse Source
This commit is contained in:
jbouchard
2021-05-04 07:55:45 -04:00
committed by Jia Zhang
parent 65915f2d82
commit d29aead19e
1 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-efi-secure-boot/recipes-kernel/linux/linux-yocto-efi-secure-boot.inc
+14 -3
View File
@@ -18,6 +18,10 @@ fakeroot python do_sign() {
if d.expand('${UEFI_SB}') != '1':
return
if d.expand('${UEFI_SELOADER}') == '0' and d.expand('${GRUB_SIGN_VERIFY}') == '0':
bb.debug(1, "Skipping signature, no bootloader need it")
return
import shutil
for type in d.expand('${KERNEL_IMAGETYPES}').split():
@@ -30,6 +34,8 @@ fakeroot python do_sign() {
# disallowing chainloader to kernel efi-stub.
uks_bl_sign(kernel, d)
#if d.getVar('GRUB_SIGN_VERIFY', True) == "1":
shutil.copyfile(kernel, d.expand('${D}/boot/') + type + d.expand('-${KERNEL_RELEASE}'))
ext = d.expand('${SB_FILE_EXT}')
shutil.copyfile(kernel + ext, d.expand('${D}/boot/') + type + d.expand('-${KERNEL_RELEASE}' + ext))
@@ -54,6 +60,10 @@ fakeroot python do_sign_bundled_kernel() {
if (d.expand('${INITRAMFS_IMAGE}') == '') or (d.expand('${INITRAMFS_IMAGE_BUNDLE}') != '1'):
return
if d.expand('${UEFI_SELOADER}') == '0' and d.expand('${GRUB_SIGN_VERIFY}') == '0':
bb.debug(1, "Skipping signature, no bootloader need it")
return
import shutil
for type in d.expand('${KERNEL_IMAGETYPES}').split():
@@ -66,9 +76,10 @@ fakeroot python do_sign_bundled_kernel() {
# disallowing chainloader to kernel efi-stub.
uks_bl_sign(kernel, d)
shutil.copyfile(kernel, d.expand('${D}/boot/') + type + d.expand('-initramfs-${MACHINE}.bin'))
ext = d.expand('${SB_FILE_EXT}')
shutil.copyfile(kernel + ext, d.expand('${D}/boot/') + type + d.expand('-initramfs-${MACHINE}.bin' + ext))
if d.getVar('GRUB_SIGN_VERIFY', True) == "1":
shutil.copyfile(kernel, d.expand('${D}/boot/') + type + d.expand('-initramfs-${MACHINE}.bin'))
ext = d.expand('${SB_FILE_EXT}')
shutil.copyfile(kernel + ext, d.expand('${D}/boot/') + type + d.expand('-initramfs-${MACHINE}.bin' + ext))
}
addtask sign_bundled_kernel after do_bundle_initramfs before do_deploy