summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* update tpm2-tools_3.2.1 -> tpm2-tools_4.1.1.bb, tpm2-abrmd_2.0.3 -> ↵richard2020-06-2717-516/+83
| | | | tpm2-abrmd_2.3.0, tpm2-tss_2.2.3.bb -> tpm2-tss_2.3.2.bb
* key-store: fix rdepends with multilibKai Kang2020-06-121-1/+2
| | | | | | | | | | | It shows qa issue when multilib is enabled: | ERROR: lib32-key-store-0.1-r0 do_package: QA Issue: lib32-key-store package lib32-key-store-rpm-pubkey - suspicious values 'rpm' in RDEPENDS [multilib] Prepend MLPREFIX to runtime dependency 'rpm' to fix the issue. Signed-off-by: Kai Kang <kai.kang@windriver.com>
* conf/layer.conf: Add dunfell to LAYERSERIES_COMPATChristophe Priouzeau2020-05-279-9/+9
| | | | Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com>
* user-key-store.bbclass: Kill gpg agent daemon after gpg signDe Huo2020-04-271-0/+4
| | | | | | | | | The gpg-agent daemon will be triggered to run in function boot_sign, This daemon will not exit even after building project. So kill the gpg-agent daemon after gpg signing process at the end of function boot_sign. Signed-off-by: De Huo <De.Huo@windriver.com>
* create-user-key-store.sh: Fix defect about invalid option ↵De Huo2020-04-161-2/+8
| | | | | | | | | | | | | | "--pinentry-mode=loopback" The option --pinentry-mode is not supported in gpg 2.0.22 code. so when the host gpg version is 2.0.22 the option will be removed. Start gpg-agent daemon when gpg-connect-agent reload agent failed. Otherwise there will be below failure message reported. gpg: can't connect to the agent - trying fall back gpg: can't connect to the agent: IPC connect call failed gpg: problem with the agent: No agent running Signed-off-by: De Huo <De.Huo@windriver.com>
* Revert "Removed unneeded patch to fix compilation error in efi-tool's console.c"Hongxu Jia2020-04-164-0/+80
| | | | | | | | | | | | | | | | | | | The patch to fix compilation error in efi-tool's console.c is required This reverts commit a6c3d9fcd2da0d20f2916d36557a73ad8790fd1c. In <=gnu-efi-3.0.9 variable is named EFI_WARN_UNKOWN_GLYPH, and in gnu-efi-3.0.11 is renamed in EFI_WARN_UNKNOWN_GLYPH. The patch is only for users with installed >=gnu-efi-3.0.11 because is in this version that variable has changed name from EFI_WARN_UNKOWN_GLYPH to EFI_WARN_UNKNOWN_GLYPH. [1] In oe-core master branch, the gnu-efi is 3.0.11, we need to add the fix back [1] https://bugs.gentoo.org/701152 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* ovmf_%.bbappend: tweak do_sign task order to avoid racing issueHongxu Jia2020-04-101-1/+1
| | | | | | | | | | | | If ovmf's do_deploy is run before do_sign, there is a failure ... |install: cannot stat 'tmp-glibc/work/corei7-64-wrs-linux/ovmf/ edk2-stable201911-r0/ovmf/Pkcs7VerifyDxe.efi.signed': No such file or directory ... Add do_sign before do_deploy Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* Removed unneeded patch to fix compilation error in efi-tool's console.cAbdelrahman Ibrahem2020-04-084-80/+0
|
* cryptfs-tpm2: convert the script to python3Yi Zhao2020-03-192-0/+33
| | | | | | | | | | | Convert the script to python3 to fix the do_compile failure. Fixes: /buildarea/poky/build/tmp/work/core2-64-poky-linux/cryptfs-tpm2/0.7.0+gitAUTOINC+888c46c827-r0/git/scripts/encrypt_secret.py -i "H31i05" > "primary_key.secret" || exit 1 /usr/bin/env: ‘python’: No such file or directory Makefile:64: recipe for target 'primary_key.secret' failed Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-tpm2: add dependency on meta-python2Yi Zhao2020-03-191-1/+1
| | | | | | | | | Fixes: ERROR: ParseError at /buildarea/poky/meta-secure-core/meta-tpm2/recipes-devtools/python/python-beautifulsoup4_4.4.1.bb:19: Could not inherit file classes/setuptools.bbclass Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-tools: only support python3 in test scriptsYi Zhao2020-03-132-0/+142
| | | | | | | | | | | The python2 is removed from oe-core and there is no python symblic link by default which will cause an error when running test scripts: $ ./test_tpm2_activecredential.sh: line 66: python: command not found So drop python2 support and only keep python3. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-tools: fix yaml.load warning in test scriptsYi Zhao2020-03-132-0/+93
| | | | | | | | | | | | The yaml.load(f) is deprecated since pyyaml 5.1. Use yaml.load(f, Loader=yaml.BaseLoader) instead of it. See https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation Fixes warning: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2simulator-native: update to latest git revisionYi Zhao2020-03-101-1/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-tools: upgrade 3.2.0 -> 3.2.1Yi Zhao2020-03-101-2/+2
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* fixup! sign_rpm_ext: Use socket redirection to avoid GPG_PATH length limitationOvidiu Panait2020-03-031-6/+9
| | | | | | | | | | | | | | | | If GPG_PATH is already created by signing-keys do_get_public_keys task, subsequent executions of do_package_write_rpm will fail with "Filename too long" errors (this only affects builds using GPG paths larger than 80 characters). Fix this race condition by making sure that the redirection files are always present in the gpg homedir even if the directory already exists when the first package_write_rpm task executes. Also, make sure this new approach does not affect GPG_PATHs smaller than 80 chars. Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
* modified grub-efi-efi-secure-boot.inc to install also the grub configuration ↵richard2020-03-011-0/+13
| | | | files in the DEPLOYDIR
* Add additional *_KEYS_DIR to keys.confDrew Moseley2020-03-011-0/+2
| | | | Signed-off-by: Drew Moseley <drew.moseley@northern.tech>
* sign_rpm_ext: Use socket redirection to avoid GPG_PATH length limitationOvidiu Panait2020-03-012-5/+11
| | | | | | | | | | | | | | | Currently, an error will be thrown when trying to use a GPG homedir whose path length exceeds 80 characters. This limitation can be worked around by providing libassuan socket redirection files for "S.gpg-agent.yocto-native", "S.gpg-agent.ssh", "S.gpg-agent.browser" and "S.gpg-agent.extra" sockets. The redirection files will point to the real sockets in /tmp directory. The sockets will be automatically cleaned up by gpg agent. References: [1] https://dev.gnupg.org/T1752 [2] https://gnupg.org/documentation/manuals/assuan.pdf Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
* initramfs: adjust task order to aviod initrd symlink unavailableLiwei Song2020-02-271-1/+1
| | | | | | | adjust task order to make sure initrd symlink is ready before do package. Signed-off-by: Liwei Song <liwei.song@windriver.com>
* tpm-tools: inherit perlnative.bbclassKai Kang2020-02-131-1/+1
| | | | | | | | | | | | | | | tpm-tools calls pod2man to produce manual files. But pod2man has been removed from hosttools in oe-core. So it fails occasionally when in some certain condition .pod file is newer than corresponding man page files that man files need to be reproduced: | make[3]: Entering directory 'TOPDIR/tmp-glibc/work/ppc7400-wrs-linux/tpm-tools/1.3.9.1+gitAUTOINC+bdf9f1bc8f-r0/git/man/man8' | /bin/bash: pod2man: command not found | make[3]: *** [Makefile:575: tpm_nvwrite.8] Error 127 Inherit perlnative to fix such issue. Signed-off-by: Kai Kang <kai.kang@windriver.com>
* ima-inspect: upgrade 0.11 -> 0.13Yi Zhao2020-01-192-15/+1
| | | | | | | | | Fixes: * Use glibc header instead of libattr header because the attr/xattr.h has been removed from attr package. * fix configure check for newer libimaevm versions. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* linux-yocto: remove unused FILESEXTRAPATHS_prependSandra Tobajas2020-01-161-1/+0
| | | | Signed-off-by: Sandra Tobajas <sandra.tobajas@savoirfairelinux.com>
* grub-efi-efi-secure-boot.inc: append do_deploy instead overriding itSandra Tobajas2020-01-161-2/+2
| | | | | | Append do_deploy function instead of overriding it. Signed-off-by: Sandra Tobajas <sandra.tobajas@savoirfairelinux.com>
* user-key-store.bbclass: let MOK_SB be overridedSandra Tobajas2020-01-161-1/+1
| | | | | | | | | | If efi-secure-boot distro feature is enabled, let the possibility to enable only the UEFI SecureBoot (through UEFI_SB Bitbake variable) without MOK_SB variable. Allow explicitly overriding the MOK_SB Bitbake variable. Signed-off-by: Sandra Tobajas <sandra.tobajas@savoirfairelinux.com>
* grub-efi-efi-secure-boot.inc: let EFI_BOOT_PATH be overridedSandra Tobajas2020-01-161-2/+2
| | | | | | Let the EFI_BOOT_PATH Bitbake variable be overrided if needed. Signed-off-by: Sandra Tobajas <sandra.tobajas@savoirfairelinux.com>
* mokutil: fix typoChangqing Li2019-12-302-0/+31
| | | | Signed-off-by: Changqing Li <changqing.li@windriver.com>
* grub-efi-efi-secure-boot.inc: use task_prepend instead of prefuncs for do_signYi Zhao2019-12-131-2/+6
| | | | | | | | | | The grub-efi-native build doesn't need to run do_sign task but there are two prefuncs for do_sign still run in native build. This will cause a build error when there is no gpg command on the host. Move the functions to do_sign_prepend_class-target to make sure they only run in target build. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* user-key-store.bbclass: Depend on gnupg-native to always use provided gpgJason Wessel2019-12-131-1/+1
| | | | | | | | | | | | | | | | | | | | On some host configuration such as ubuntu 16.04 the gnupg in /usr/bin is the 1.x version. This can cause problems between the import and signing process if the gpg version is different. The commands in the user-key-store class assume gnupg is at least version 2.2 or newer. To avoid the signing phase failing for the efitools and the kernel, the user-key-store class should depend on the gnupg-native binaries. It avoids this specific error: ERROR: efitools-1.9.2+gitAUTOINC+392836a46c-r0 do_sign: Failed to sign: /opt/tmp-glibc/work/corei7-64-wrs-linux/efitools/1.9.2+gitAUTOINC+392836a46c-r0/image/boot/efi/EFI/BOOT/LockDown.efi ERROR: Logfile of failure stored in: /opt/tmp-glibc/work/corei7-64-wrs-linux/efitools/1.9.2+gitAUTOINC+392836a46c-r0/temp/log.do_sign.22969 NOTE: recipe efitools-1.9.2+gitAUTOINC+392836a46c-r0: task do_sign: Failed [ Issue: LIN1019-3757 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* rpm-integrity: Use _append for PACKAGECONFIGOvidiu Panait2019-12-131-1/+3
| | | | | | | | | | Currently, the PACKAGECONFIG assignment in rpm-integrity might overwrite the previous contents of the variable. Similar to systemd_%.bbappend and ovmf_%.bbappend, use _append to add "imaevm" to PACKAGECONFIG when distro feature ima is enabled. Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
* sign_rpm_ext.bbclass: check the length of GPG_PATHLiwei Song2019-12-051-0/+4
| | | | | | | connect to gpg agent may failed due to the GPG_PATH is too long, check and raise an error if the length is greater than 80. Signed-off-by: Liwei Song <liwei.song@windriver.com>
* sign_rpm_ext.bbclass: remove prefuncs for do_package_write_rpm andChangqing Li2019-11-291-3/+0
| | | | | | | | | do_rootfs in commit 393b80fa, prefuncs of do_package_write_rpm/do_rootfs have been replace by (task)_prepend in this bbclass, so remove it. Signed-off-by: Changqing Li <changqing.li@windriver.com>
* efitools: do not do_sign if GRUB_SIGN_VERIFY not enabledHongxu Jia2019-11-191-0/+3
| | | | | | | | | | | | | | | | | | | If GRUB_SIGN_VERIFY is not enabled, do_sign will fail in which GPG_PATH is not set (--homedir None) ... |DEBUG: Executing python function do_sign |NOTE: Running: echo "SecureCore" | tmp-glibc/hosttools/gpg --pinentry-mode loopback --batch --homedir None -u "SecureBootCore" --detach-sign --passphrase-fd 0 "tmp-glibc/work/core2-32-wrs-linux/efitools/ 1.9.2+gitAUTOINC+392836a46c-r0/image/boot/efi/EFI/BOOT/LockDown.efi" |ERROR: Failed to sign: tmp-glibc/work/core2-32-wrs-linux/efitools/ 1.9.2+gitAUTOINC+392836a46c-r0/image/boot/efi/EFI/BOOT/LockDown.efi ... Since GPG_PATH is set in do_sign's prefunc check_boot_public_key if GRUB_SIGN_VERIFY is enabled, add the same condition to do_sign Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* efitools-native: Fix compilation problem with latest /usr/include/efiHongxu Jia2019-11-192-1/+1
| | | | | | | Since commit [382ffa1 efitools: Fix compilation problem with latest /usr/include/efi], we should apply the fix to native also. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* sbsigntool-native: specify TMPDIRJoe Slater2019-11-141-1/+1
| | | | | | | | | | | | | Issue: LIN1018-450 Under extremely rare circumstances, access can be denied to /tmp, so we specify a local TMPDIR. This is a cherry-pick of 886c44b from WRL 10.17. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* cryptsetup_%.bbappend: Fix for nativeRobert Yang2019-11-141-1/+1
| | | | | | | | | | | | | Issue: LIN1019-2347 Fixed: $ bitbake cryptsetup-native [snip] Nothing RPROVIDES 'lvm2-udevrules-native' [snip] Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* kernel-initramfs-efi-secure-boot.inc: Copy .sig files and .p7bJason Wessel2019-11-141-5/+3
| | | | | | | | | | | While refactoring the code to eliminate the overlap in the copy of the .sig and .p7b files the UEFI_SELOADER test was not removed. This results in the .sig files not getting copied to the deploy directory when using the GRUB_SIGN_VERIFY = "1". All that is needed is to remove the UEFI_SELOADER test statement. Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* lvm2: Fix hanging dmcrypt volumes on bootJason Wessel2019-11-082-0/+45
| | | | | | | | | | | | The initrd takes care of starting the luks volumes and activing the dmcrypt udev rules. The udev rule required a modification to deal with volumes that had already been started, else the cold plug event that runs at user space startup puts the dmcrypt device into a state that systemd cannot manage it. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* layer.conf gpg boot key sample: Add the gpg boot key sample filesJason Wessel2019-11-085-0/+95
| | | | | | | | | | | Sample keys are required in order for the signing to succeed when using grub boot verification. The keys are only used when GRUB_SIGN_VERIFY = "1", and it is intended that and user would generate new keys with the create-user-key-store.sh. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* secure boot: Make SELoader optional and copy sig files when GRUB_SIGN_VERIFY=1Jason Wessel2019-11-087-30/+62
| | | | | | | | | | | | | | | This commit makes the SELoader entire optional and allows it to be removed, with the intended replacement being to use grub's built in gpg key verification. It will be possible in a template or local.conf: UEFI_SELOADER = "0" GRUB_SIGN_VERIFY = "1" [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* packagegroup-luks.inc: Addlvm2-udevrulesJason Wessel2019-11-081-0/+1
| | | | | | | | | The lvm2-udevrules is required else udev will never perform the device notification when an encrypted volume is initially created. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* create-user-key-store.sh: Update for OSTree and ease of useJason Wessel2019-11-081-71/+306
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The create-user-key-store.sh was changed in a number ways to improve the usability with other layers that will consume the key services provided by meta-secure-core. New features: * A safety check was added that keys can only be written to a fresh empty directory. * The script can be run non-iteractively or interactively for the ease of use. * gpg 1.x support and gpg 2.x support work with the passphrases * A keys.conf is generated to allow a single line to be written into the local.conf with all the keys. An interactive session looks like: ================================== ./create-user-key-store.sh -d /tmp/test KEYS_DIR: /tmp/test Enter RPM/OSTree GPG keyname (use dashes instead of spaces) [default: PKG-SecureCore]: PKG-Sample-Man Enter RPM/OSTree GPG e-mail address [default: SecureCore@foo.com]: sample.man@sample.com Enter RPM/OSTREE GPG comment [default: Signing Key]: Sample Signing Key Using boot loader gpg name: BOOT-Sample-Man Using boot loader gpg email: sample.man@sample.com Using boot loader gpg comment: Sample Signing Key Press control-c now if and use -bn -bm -bc arguments if you want different values other than listed above Enter RPM/OSTREE passphrase: abc1234 Enter IMA passphrase: 1234pass Enter boot loader GPG passphrase: bootup Enter boot loader locked configuration password(e.g. grub pw): root MASTER_KEYS_DIR = "/tmp/test" IMA_KEYS_DIR = "${MASTER_KEYS_DIR}/ima_keys" IMA_EVM_KEY_DIR = "${MASTER_KEYS_DIR}/ima_keys" RPM_KEYS_DIR = "${MASTER_KEYS_DIR}/rpm_keys" BOOT_KEYS_DIR = "${MASTER_KEYS_DIR}/boot_keys" MOK_SB_KEYS_DIR = "${MASTER_KEYS_DIR}/mok_sb_keys" SYSTEM_TRUSTED_KEYS_DIR = "${MASTER_KEYS_DIR}/system_trusted_keys" UEFI_SB_KEYS_DIR = "${MASTER_KEYS_DIR}/uefi_sb_keys" GRUB_PUB_KEY = "${MASTER_KEYS_DIR}/boot_keys/boot_pub_key" GRUB_PW_FILE = "${MASTER_KEYS_DIR}/boot_keys/boot_cfg_pw" OSTREE_GPGDIR = "${MASTER_KEYS_DIR}/rpm_keys" RPM_GPG_NAME = "PKG-Sample-Man" RPM_GPG_PASSPHRASE = "abc1234" RPM_FSK_PASSWORD = "1234pass" BOOT_GPG_NAME = "BOOT-Sample-Man" BOOT_GPG_PASSPHRASE = "bootup" OSTREE_GPGID = "PKG-Sample-Man" OSTREE_GPG_PASSPHRASE = "abc1234" OSTREE_GRUB_PW_FILE = "${GRUB_PW_FILE}" [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* grub: Make SELoader optional and add gpg verify supportJason Wessel2019-11-085-74/+253
| | | | | | | | | | | | | | | | | | | | Allow SELoader to be an optional component for secure boot verification. The GPG_SIGN_VERIFY variable was added to control the ability to have grub perform all of the verification of the loaded files using a public key which gets built into grub at the time that mkimage is run. It is not intended that GPG_SIGN_VERIFY and UEFI_SELOADER would both be set to "1". While this configuration could work, it makes very little sense to use the system that way. Also enabled is the tftp feature for grub as a builtin. This allows grub to start from the network when the UEFI is configured to boot off the network with tftp. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* cryptfs-tpm2: Add support for QEMU swtpm tpm2Jason Wessel2019-11-082-0/+34
| | | | | | | | | | The device nodes are in a different place when using the swtpm + ovfm + qemu. The luks-setup.sh needs to look in an additional location to properly support qemu. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* sign_rpm_ext.bbclass, user-key-store.bbclass: Add boot loader signingJason Wessel2019-11-082-24/+69
| | | | | | | | | | | | | | | | | | | | | This changes the rpm signing setup to use a generic routine check_gpg_key(), in order that the boot loader gpg signing can use the same infrastructure. For now the boot loader gpg signing will only support grub and introduces the variable: GRUB_SIGN_VERIFY = "1" This variable is a control point to activate the code in grub-efi to perform file verification of any file it loads against a gpg key which is linked into the boot loader with grub-mkimage. It will also cause all the other files such as the kernel, initramfs and LockDown.efi to be signed such that grub will verify the files. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* secure-core-image: Remove packagegroup-core-lsbJason Wessel2019-11-081-1/+1
| | | | | | | | oe-core commit fb064356af615d67d85b65942103bf943d84d290 removed the packagegroup-core-lsb, so it must be removed from any other image recipes which refernce the packagegroup-core-lsb. Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* efitools: Fix compilation problem with latest /usr/include/efiJason Wessel2019-11-082-0/+40
| | | | | | | | | | | | gcc -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/git/include/ -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include/efi -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include/efi/x86_64 -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -fno-stack-protector -ffreestanding -fno-stack-check -DGNU_EFI_USE_MS_ABI -DEFI_FUNCTION_WRAPPER -mno-red-zone -DCONFIG_x86_64 -fno-toplevel-reorder -DBUILD_EFI -c console.c -o console.efi.o | console.c:360:5: error: ‘EFI_WARN_UNKOWN_GLYPH’ undeclared here (not in a function); did you mean ‘EFI_WARN_UNKNOWN_GLYPH’? | { EFI_WARN_UNKOWN_GLYPH, L"Warning Unknown Glyph"}, | ^~~~~~~~~~~~~~~~~~~~~ | EFI_WARN_UNKNOWN_GLYPH | ../Make.rules:113: recipe for target 'console.efi.o' failed Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* shim: Fix compilation problem with latest /usr/include/efiJason Wessel2019-11-082-0/+40
| | | | | | | | | | | | | | | | | x86_64-poky-linux-gcc -ggdb -O0 -fno-stack-protector -fno-strict-aliasing -fpic -fshort-wchar -Wall -Wsign-compare -Werror -fno-builtin -Werror=sign-compare -ffreestanding -std=gnu89 -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../lib/x86_64-poky-linux/gcc/x86_64-poky-linux/9.2.0/include -DDEFAULT_LOADER=L"\SELoaderx64.efi" -DDEFAULT_LOADER_CHAR="\SELoaderx64.efi" -nostdinc -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/Cryptlib -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/Cryptlib/Include -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot/usr/include/efi -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot/usr/include/efi/x86_64 -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot/usr/include/efi/protocol -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/include -iquote /opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git -iquote /opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git -DOVERRIDE_SECURITY_POLICY -DENABLE_HTTPBOOT -mno-mmx -mno-sse -mno-red-zone -nostdinc -maccumulate-outgoing-args -DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI -DNO_BUILTIN_VA_FUNCS -DMDE_CPU_X64 -DPAGE_SIZE=4096 -DEFI_ARCH=L"x64" -DDEBUGDIR=L"/usr/lib/debug/usr/share/shim/x64-12-_poky_3.0/" -DVENDOR_CERT_FILE="/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/vendor_cert.cer" -c -o console.o console.c | console.c:363:5: error: 'EFI_WARN_UNKOWN_GLYPH' undeclared here (not in a function); did you mean 'EFI_WARN_UNKNOWN_GLYPH'? | 363 | { EFI_WARN_UNKOWN_GLYPH, L"Warning Unknown Glyph"}, | | ^~~~~~~~~~~~~~~~~~~~~ | | EFI_WARN_UNKNOWN_GLYPH | <builtin>: recipe for target 'console.o' failed | make[1]: *** [console.o] Error 1 | make[1]: Leaving directory '/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/lib' | Makefile:223: recipe for target 'lib/lib.a' failed | make: *** [lib/lib.a] Error 2 | WARNING: exit code 1 from a shell command. Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* efitools: Uprev to fix LockDown.efi for UEFI built after 2018Jason Wessel2019-11-084-80/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Versions of the UEFI core from 2018 on will not work properly with LockDown.efi's key install. It will report that the PK key cannot be installed due to the handling of the signature header with the PKCS7 data. There are several other minor bug fixes, with the short log shown below. ==== James Bottomley (13): cert-to-efi-hash-list: fix for openssl 1.1 Version: 1.8.0 Fix Fedora build Version: 1.8.1 factor out variable signing code support engine based keys use SignedData instead of PKCS7 for variable updates Version: 1.9.0 Makefile: Reverse the order of lib.a and -lcrypto Version: 1.9.1 sign-efi-sig-list: add man page entry for engine option sha256: do not align raw section sizes Version: 1.9.2 pai-yi.huang (1): efi-updatevar: remove all authenticated attributes from signature Make.rules | 6 ++--- Makefile | 12 +++++----- cert-to-efi-hash-list.c | 6 ++++- efi-updatevar.c | 28 +++++++++++------------ include/openssl_sign.h | 10 ++++++++ include/version.h | 2 +- lib/Makefile | 2 +- lib/openssl_sign.c | 156 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ lib/sha256.c | 8 ++++--- sign-efi-sig-list.c | 59 +++++++++++------------------------------------ 10 files changed, 213 insertions(+), 76 deletions(-) create mode 100644 include/openssl_sign.h create mode 100644 lib/openssl_sign.c [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* sign_rpm_ext.bbclass: fix check_rpm_public_key failed while host not install ↵Sandy2019-11-071-4/+11
| | | | | | | | | | gpg (#124) Due to the following reasons, need to add the dependency to task who needs to run check_rpm_public_key: * packagegroup recipe don't have task prepare_recipe_sysroot * varflags depends don't work for prefuncs Signed-off-by: Changqing Li <changqing.li@windriver.com>
* sign_rpm_ext.bbclass: fix compile fail since missing gpg (#123)Sandy2019-11-061-0/+3
| | | | | | | | | | | | | | there is a scenario that this bbclass is enabled globally, all targets will inherit sign_rpm_ext. but this bbclass need gpg to work, on some new distro like ubuntun 19.04, gpg is not installed, so compile will failed. fail cmd: cmd = '%s --batch --homedir %s --passphrase %s --import %s' % \ (gpg_bin, gpg_path, d.getVar('RPM_GPG_PASSPHRASE', True), gpg_key) error: base-files-3.0.14-r89 do_package_write_rpm: Failed to import gpg key (): /bin/sh: 1: --batch: not found Signed-off-by: Changqing Li <changqing.li@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-21 11:15:48 +0000