mirror of
https://github.com/jiazhang0/meta-secure-core.git
synced 2026-07-16 20:56:58 +00:00
Hongxu Jia
69117bef3a
Since commit [b41010c linux-yocto-integrity: fix modsign key path] applied,
if MODSIGN_ENABLED is "0", bbclass user-key-store will not be inherited
which causing 'uks_modsign_keys_dir' is not defined
Unconditionally inherit user-key-store, but conditionally invoke
uks_modsign_keys_dir
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
42 lines
1.3 KiB
PHP
42 lines
1.3 KiB
PHP
FILESEXTRAPATHS_prepend := "${THISDIR}/linux-yocto:"
|
|
|
|
IMA_ENABLED = "${@bb.utils.contains('DISTRO_FEATURES', 'ima', '1', '0', d)}"
|
|
MODSIGN_ENABLED = "${@bb.utils.contains('DISTRO_FEATURES', 'modsign', '1', '0', d)}"
|
|
|
|
DEPENDS += "${@'key-store openssl-native' \
|
|
if d.getVar('IMA_ENABLED', True) == '1' or \
|
|
d.getVar('MODSIGN_ENABLED', True) == '1' \
|
|
else ''}"
|
|
|
|
SRC_URI += "\
|
|
${@'file://ima.scc file://ima.cfg' \
|
|
if d.getVar('IMA_ENABLED', True) == '1' else ''} \
|
|
${@'file://modsign.scc file://modsign.cfg' \
|
|
if d.getVar('MODSIGN_ENABLED', True) == '1' else ''} \
|
|
"
|
|
|
|
INHIBIT_PACKAGE_STRIP = "${@'1' if d.getVar('MODSIGN_ENABLED', True) == '1' else '0'}"
|
|
|
|
inherit user-key-store
|
|
|
|
do_configure_prepend() {
|
|
sys_cert="${STAGING_DIR_TARGET}${sysconfdir}/keys/system_trusted_key.crt"
|
|
if [ ${MODSIGN_ENABLED} = "1" ]; then
|
|
modsign_key="${@uks_modsign_keys_dir(d)}/modsign_key.key"
|
|
else
|
|
modsign_key="${STAGING_DIR_TARGET}${sysconfdir}/keys/modsign_key.key"
|
|
fi
|
|
modsign_cert="${STAGING_DIR_TARGET}${sysconfdir}/keys/modsign_key.crt"
|
|
|
|
if [ -f "$sys_cert" ]; then
|
|
install -m 0644 "$sys_cert" "${B}"
|
|
fi
|
|
|
|
if [ -f "$modsign_key" -a -f "$modsign_cert" ]; then
|
|
cat "$modsign_key" "$modsign_cert" \
|
|
> "${B}/modsign_key.pem"
|
|
else
|
|
true
|
|
fi
|
|
}
|