mirrors/meta-secure-core
1
0
Fork 0
mirror of https://github.com/jiazhang0/meta-secure-core.git synced 2026-07-16 20:56:58 +00:00
Code Issues Projects Releases Wiki Activity

check for signature before copy

Browse Source
This commit is contained in:
jbouchard
2021-05-04 07:55:45 -04:00
committed by Jia Zhang
parent 65915f2d82
commit d29aead19e
1 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-efi-secure-boot/recipes-kernel/linux/linux-yocto-efi-secure-boot.inc
+14 -3
View File
@@ -18,6 +18,10 @@ fakeroot python do_sign() {
if d.expand('${UEFI_SB}') != '1': if d.expand('${UEFI_SB}') != '1':
return return
if d.expand('${UEFI_SELOADER}') == '0' and d.expand('${GRUB_SIGN_VERIFY}') == '0':
bb.debug(1, "Skipping signature, no bootloader need it")
return
import shutil import shutil
for type in d.expand('${KERNEL_IMAGETYPES}').split(): for type in d.expand('${KERNEL_IMAGETYPES}').split():
@@ -30,6 +34,8 @@ fakeroot python do_sign() {
# disallowing chainloader to kernel efi-stub. # disallowing chainloader to kernel efi-stub.
uks_bl_sign(kernel, d) uks_bl_sign(kernel, d)
#if d.getVar('GRUB_SIGN_VERIFY', True) == "1":
shutil.copyfile(kernel, d.expand('${D}/boot/') + type + d.expand('-${KERNEL_RELEASE}')) shutil.copyfile(kernel, d.expand('${D}/boot/') + type + d.expand('-${KERNEL_RELEASE}'))
ext = d.expand('${SB_FILE_EXT}') ext = d.expand('${SB_FILE_EXT}')
shutil.copyfile(kernel + ext, d.expand('${D}/boot/') + type + d.expand('-${KERNEL_RELEASE}' + ext)) shutil.copyfile(kernel + ext, d.expand('${D}/boot/') + type + d.expand('-${KERNEL_RELEASE}' + ext))
@@ -54,6 +60,10 @@ fakeroot python do_sign_bundled_kernel() {
if (d.expand('${INITRAMFS_IMAGE}') == '') or (d.expand('${INITRAMFS_IMAGE_BUNDLE}') != '1'): if (d.expand('${INITRAMFS_IMAGE}') == '') or (d.expand('${INITRAMFS_IMAGE_BUNDLE}') != '1'):
return return
if d.expand('${UEFI_SELOADER}') == '0' and d.expand('${GRUB_SIGN_VERIFY}') == '0':
bb.debug(1, "Skipping signature, no bootloader need it")
return
import shutil import shutil
for type in d.expand('${KERNEL_IMAGETYPES}').split(): for type in d.expand('${KERNEL_IMAGETYPES}').split():
@@ -66,9 +76,10 @@ fakeroot python do_sign_bundled_kernel() {
# disallowing chainloader to kernel efi-stub. # disallowing chainloader to kernel efi-stub.
uks_bl_sign(kernel, d) uks_bl_sign(kernel, d)
shutil.copyfile(kernel, d.expand('${D}/boot/') + type + d.expand('-initramfs-${MACHINE}.bin')) if d.getVar('GRUB_SIGN_VERIFY', True) == "1":
ext = d.expand('${SB_FILE_EXT}') shutil.copyfile(kernel, d.expand('${D}/boot/') + type + d.expand('-initramfs-${MACHINE}.bin'))
shutil.copyfile(kernel + ext, d.expand('${D}/boot/') + type + d.expand('-initramfs-${MACHINE}.bin' + ext)) ext = d.expand('${SB_FILE_EXT}')
shutil.copyfile(kernel + ext, d.expand('${D}/boot/') + type + d.expand('-initramfs-${MACHINE}.bin' + ext))
} }
addtask sign_bundled_kernel after do_bundle_initramfs before do_deploy addtask sign_bundled_kernel after do_bundle_initramfs before do_deploy