mirrors/meta-secure-core
1
0 Fork 0
mirror of https://github.com/jiazhang0/meta-secure-core.git synced 2026-10-23 21:58:28 +00:00
Code Issues Projects Releases Wiki Activity
187 Commits 6 Branches 0 Tags
ffe79fe91ed8d10391de976fe615932eeaffab70
Commit Graph
50 Commits
Author SHA1 Message Date
Jia Zhang ffe79fe91e shim: drop fallback 
shim will uninstall MOK Verify Protocol when launching fallack,
implying it is impossible to get the instance of MOK Verify Protocol
for SELoader. This behavior violates the original intention of
introducing fallback.

Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
 2017-10-27 21:57:43 +08:00
Wenzong Fan a852a68227 shim: disable OVERRIDE_SECURITY_POLICY for 32bit target (#25) 
Fix 32bit assembler errors:
  | /tmp/ccJyZFtJ.s: Assembler messages:
  | /tmp/ccJyZFtJ.s:268: Error: bad register name `%rsp)'
  | /tmp/ccJyZFtJ.s:269: Error: bad register name `%rdi'
  ...
  | make[1]: *** [<builtin>: security_policy.o] Error 1

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
 2017-09-30 03:50:25 -04:00
Wenzong Fan 5080ec0fac grub-efi: fix build error with qemux86 (#24) 
Fix the error:
  mok2verify.c:169:53: error: \
  format '%lx' expects argument of type 'long unsigned int', \
  but argument 3 has type 'grub_efi_status_t {aka int}' \
  [-Werror=format=]

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
 2017-09-29 23:00:39 -04:00
Jia Zhang b69537380c meta-secure-core: clean up ${COREBASE}/LICENSE and ${COREBASE}/meta/COPYING.MIT 
${COREBASE}/LICENSE is not a valid license file. So it is recommended
to use '${COMMON_LICENSE_DIR}/MIT' for a MIT License file in
LIC_FILES_CHKSUM. This will become an error in the future.

Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
 2017-09-02 11:11:44 +08:00
Jia Zhang 0e6d3a3e1c meta-efi-secure-boot/README.md: document shim_cert as unused 
Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
 2017-08-26 17:11:50 +08:00
Jia Zhang bfd800fe02 shim: sync up with upstream 
Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
 2017-08-23 05:16:38 +08:00
Jia Zhang b1e14f4e88 encrypted-storage: use luks as the feature name for current implementation 
encrypted-storage layer will include more security features about encrypted
storage so the term "encrypted-storage" won't be used to specify a dedicated
technology term such as "LUKS".

Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
 2017-08-20 15:31:11 +08:00
Jia Zhang 60588ac929 grub-efi: remove the unused patch 
Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
 2017-08-18 13:24:21 +08:00
Jia Zhang e11a0bd8de efitools: fix searching openssl.cnf for target build 
Currently, OPENSSL_LIB is only used for locating openssl.cnf in order
to work around openssl-1.1.x.

Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
 2017-08-17 20:39:48 +08:00
Lans Zhang d5a4de8f09 efitools: support to build with openssl-1.1.x 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-08-16 23:01:13 +08:00
Lans Zhang 4b41056970 sbsigntool: fix build failure with openssl-1.0.x 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-08-16 10:12:21 +08:00
Lans Zhang c912483e87 sbsigntool: update to support openssl-1.1.0 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-08-15 13:12:38 +08:00
Lans Zhang 104a01a25d shim: refresh fallback patchset 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-08-11 14:14:39 +08:00
Lans Zhang 03a5d21586 shim: sync up with upstream 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-08-09 10:25:25 +08:00
Lans Zhang 1078adea02 shim: sync up with upstream 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-08-03 09:56:12 +08:00
Lans Zhang a3e1038d71 shim: don't set CSV boot entry as the first boot option 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-08-01 13:13:06 +08:00
Lans Zhang 45748a09ef README.md: simplify the commits for boot flow 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-31 19:28:24 +08:00
Lans Zhang f77e53d627 meta-secure-core: code style fixup 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-28 10:09:02 +08:00
Lans Zhang afea92abb3 grub-efi: remove the depreciated replacement for initrd= parameter 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-28 10:01:20 +08:00
Lans Zhang afdac6c3ca grub/boot-menu.inc: use linux and initrd commands instead of chainloader to boot kernel 
Since bzImage is not signed during the build.

Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-27 16:19:40 +08:00
Lans Zhang 567e817691 meta-efi-secure-boot/README: update to reflect using fallback to chainloader SELoader 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-25 09:33:16 +08:00
Lans Zhang 008b18270f shim: use fallback loading SELoader 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-24 17:14:51 +08:00
Lans Zhang 9b96939178 sbsigntool: code style fixup 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-24 12:21:44 +08:00
Lans Zhang c929a3e3fc efivar: clean up 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-24 12:21:29 +08:00
Lans Zhang 2531d04180 meta-efi-secure-boot: depend on meta-perl 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-24 11:51:31 +08:00
Lans Zhang 189b6e56ab shim: update to the latest 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-24 09:32:55 +08:00
Lans Zhang e874405319 meta-secure-core: define the oe index name 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-20 14:17:27 +08:00
Lans Zhang a50e927a87 seloader: sync up with upstream 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-13 15:54:12 +08:00
Lans Zhang e203bcf9a1 meta-efi-secure-boot/README.md: update 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-13 15:28:43 +08:00
Lans Zhang a93ddfe82d libfile-slurp: code style fixup 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-13 13:18:10 +08:00
Lans Zhang 9de8b3cf78 seloader,libsign: fix homepage URLs 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-13 13:14:47 +08:00
Lans Zhang 8dbce3e3a0 efitools: code style fixup 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-13 13:09:41 +08:00
Lans Zhang 6d7f0155e3 seloader, libsign, cryptfs-tpm2: code style fixup 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-13 10:27:45 +08:00
Lans Zhang 3af3588ab2 grub-efi: carry forward mok2verify to grub-2.02 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-13 10:26:43 +08:00
Lans Zhang c071ce2d07 packagegroup-efi-secure-boot: make sure grub never be installed 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-12 15:37:09 +08:00
Lans Zhang 480f1f03a0 grub-efi: rebased to 2.02 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-12 15:36:46 +08:00
Lans Zhang 676968891f Fix the occurrence of checking the existence of signing keys 
packagegroups are not the end consumers of using user-key-store.

Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-12 11:22:40 +08:00
Lans Zhang a91fbd1776 packagegroup-efi-secure-boot/packagegroup-ima: depend on check_deploy_keys 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-11 14:15:00 +08:00
Lans Zhang 7c7f7f94a1 mokutil: code style fixup 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-11 13:54:36 +08:00
Lans Zhang 24712cbb02 mokutil: add the COMPATIBLE_HOST 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-11 13:51:41 +08:00
Lans Zhang 02ae233112 shim: enable http boot support 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-11 13:49:22 +08:00
Lans Zhang 1ec1fed661 seloader: sync up with upstream 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-03 15:53:47 +08:00
Lans Zhang 81553a81fb Rename .pem to .crt 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-03 15:47:53 +08:00
Lans Zhang 5135786fa3 kernel-initramfs: define this package to include the initramfs image for kernel boot 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-07-03 09:21:44 +08:00
Lans Zhang 5233d3cf5e shim: fix OVMF crash 
- httpboot.o cannot be built if ".PRECIOUS: " is placed ahead
  of "<tab>CFLAGS +=".
- uri pointer should not be freed if NULL.

Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-06-30 17:07:20 +08:00
Lans Zhang dcfd67c60b shim: clean up the code style 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-06-30 13:41:37 +08:00
Lans Zhang e664a331d5 code style fixup 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-06-29 10:52:06 +08:00
Lans Zhang e280094b5b shim: enable http boot support 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-06-26 11:43:10 +08:00
Lans Zhang dcc933df6e linux-yocto-efi-secure-boot: don't use sccs to define the included kernel cfg 
The variable sccs is used internally and thus it will be corrupted by the external
definition.

Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-06-26 11:25:31 +08:00
Lans Zhang 1b3e594449 meta-secure-core: initial commit 
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
 2017-06-22 15:24:04 +08:00