mirror of
https://git.yoctoproject.org/meta-security
synced 2026-07-16 03:47:21 +00:00
Wurm, Stephan
a94674c5bc
Using <DM_VERITY_IMAGE_TYPE> in the depends variable does not work for compressed image types like squashfs-zst, as the resulting task dependency still contains the incompatible dash. Replacing the dash by an underscore resolves this issue. Signed-off-by: Stephan Wurm <stephan.wurm@a-eberle.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
42 lines
1.1 KiB
BlitzBasic
42 lines
1.1 KiB
BlitzBasic
DESCRIPTION = "Simple initramfs image for mounting the rootfs over the verity device mapper."
|
|
|
|
inherit core-image
|
|
|
|
PACKAGE_INSTALL = " \
|
|
base-files \
|
|
base-passwd \
|
|
busybox \
|
|
cryptsetup \
|
|
initramfs-module-dmverity \
|
|
initramfs-module-udev \
|
|
lvm2-udevrules \
|
|
udev \
|
|
util-linux-mount \
|
|
"
|
|
|
|
# We want a clean, minimal image.
|
|
IMAGE_FEATURES = ""
|
|
IMAGE_LINGUAS = ""
|
|
|
|
# Can we somehow inspect reverse dependencies to avoid these variables?
|
|
python __anonymous() {
|
|
verity_image = d.getVar('DM_VERITY_IMAGE')
|
|
verity_type = d.getVar('DM_VERITY_IMAGE_TYPE')
|
|
|
|
if verity_image and verity_type:
|
|
dep = ' %s:do_image_%s' % (verity_image, verity_type.replace('-', '_'))
|
|
d.appendVarFlag('do_image', 'depends', dep)
|
|
}
|
|
|
|
# Ensure dm-verity.env is updated also when rebuilding DM_VERITY_IMAGE
|
|
do_image[nostamp] = "1"
|
|
|
|
IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
|
|
|
|
deploy_verity_hash() {
|
|
install -D -m 0644 \
|
|
${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env \
|
|
${IMAGE_ROOTFS}${datadir}/misc/dm-verity.env
|
|
}
|
|
IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;"
|