This is the result of automated script conversion:
poky/scripts/contrib/convert-variable-renames.py meta-secure-core
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Update SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
The patch to fix compilation error in efi-tool's console.c is required
This reverts commit a6c3d9fcd2.
In <=gnu-efi-3.0.9 variable is named EFI_WARN_UNKOWN_GLYPH, and
in gnu-efi-3.0.11 is renamed in EFI_WARN_UNKNOWN_GLYPH. The patch is
only for users with installed >=gnu-efi-3.0.11 because is in this
version that variable has changed name from EFI_WARN_UNKOWN_GLYPH
to EFI_WARN_UNKNOWN_GLYPH. [1]
In oe-core master branch, the gnu-efi is 3.0.11, we need to add
the fix back
[1] https://bugs.gentoo.org/701152
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
If GRUB_SIGN_VERIFY is not enabled, do_sign will fail in which GPG_PATH
is not set (--homedir None)
...
|DEBUG: Executing python function do_sign
|NOTE: Running: echo "SecureCore" | tmp-glibc/hosttools/gpg --pinentry-mode
loopback --batch --homedir None -u "SecureBootCore" --detach-sign
--passphrase-fd 0 "tmp-glibc/work/core2-32-wrs-linux/efitools/
1.9.2+gitAUTOINC+392836a46c-r0/image/boot/efi/EFI/BOOT/LockDown.efi"
|ERROR: Failed to sign: tmp-glibc/work/core2-32-wrs-linux/efitools/
1.9.2+gitAUTOINC+392836a46c-r0/image/boot/efi/EFI/BOOT/LockDown.efi
...
Since GPG_PATH is set in do_sign's prefunc check_boot_public_key if
GRUB_SIGN_VERIFY is enabled, add the same condition to do_sign
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Since commit [382ffa1 efitools: Fix compilation problem with
latest /usr/include/efi], we should apply the fix to native also.
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
This commit makes the SELoader entire optional and allows it to be
removed, with the intended replacement being to use grub's built in
gpg key verification.
It will be possible in a template or local.conf:
UEFI_SELOADER = "0"
GRUB_SIGN_VERIFY = "1"
[ Issue: LINUXEXEC-2450 ]
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Versions of the UEFI core from 2018 on will not work properly with
LockDown.efi's key install. It will report that the PK key cannot be
installed due to the handling of the signature header with the PKCS7
data. There are several other minor bug fixes, with the short log
shown below.
====
James Bottomley (13):
cert-to-efi-hash-list: fix for openssl 1.1
Version: 1.8.0
Fix Fedora build
Version: 1.8.1
factor out variable signing code
support engine based keys
use SignedData instead of PKCS7 for variable updates
Version: 1.9.0
Makefile: Reverse the order of lib.a and -lcrypto
Version: 1.9.1
sign-efi-sig-list: add man page entry for engine option
sha256: do not align raw section sizes
Version: 1.9.2
pai-yi.huang (1):
efi-updatevar: remove all authenticated attributes from signature
Make.rules | 6 ++---
Makefile | 12 +++++-----
cert-to-efi-hash-list.c | 6 ++++-
efi-updatevar.c | 28 +++++++++++------------
include/openssl_sign.h | 10 ++++++++
include/version.h | 2 +-
lib/Makefile | 2 +-
lib/openssl_sign.c | 156 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
lib/sha256.c | 8 ++++---
sign-efi-sig-list.c | 59 +++++++++++------------------------------------
10 files changed, 213 insertions(+), 76 deletions(-)
create mode 100644 include/openssl_sign.h
create mode 100644 lib/openssl_sign.c
[ Issue: LINUXEXEC-2450 ]
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
The oe-core commit 05f6042a40bb772f7ce8d6819c5b2937d8c9808d removed
DEPLOY_DIR_IMAGE from SSTATE_DUPWHITELIST which caused a do_depoy error
when enable multilib:
$ bitbake efitools lib32-efitools
ERROR: lib32-efitools-1.7.0+gitAUTOINC+0649468475-r0 do_deploy: The
recipe lib32-efitools is trying to install files into a shared area when
those files already exist. Those files and their manifest location are:
/buildarea/build/tmp-glibc/deploy/images/qemux86-64/LockDown.efi
(matched in manifest-qemux86_64-efitools.deploy)
Please verify which recipe should provide the above files.
Add the deployed artifacts to SSTATE_DUPWHITELIST to fix this issue.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
- In all cases, when building Linux apps (and thus linking with gcc) we
need to pass in the normal set of LDFLAGS for both rpath and link hash
type.
- Rework Fix-for-the-cross-compilation.patch a bit. When linking EFI
apps (and thus linking with ld) we don't need to pass in other special
flags. When linking the "openssl" apps we do not need to spell out
the crtN files as gcc handles that for us, they are normal Linux apps.
Ensure that all Linux apps get our EXTRA_LDFLAGS passed in.
With all of these changes we are now able to reuse sstate cache between
build directories.
Signed-off-by: Tom Rini <trini@konsulko.com>
oe_filter_out has been removed from oe-core so use the
replacement function oe.utils.str_filter_out.
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Currently, OPENSSL_LIB is only used for locating openssl.cnf in order
to work around openssl-1.1.x.
Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
Yi Zhao
Hongxu Jia
Abdelrahman Ibrahem
Jason Wessel
Tom Rini
Jackie Huang
Jia Zhang
Lans Zhang