summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* meta-tpm2/conf/layer.conf: remove meta-python2 from LAYERDEPENDSYi Zhao2021-03-031-1/+1
| | | | | | Get rid of meta-python2 dependency because python2 is EOL. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* python-beautifulsoup4: remove recipeYi Zhao2021-03-031-29/+0
| | | | | | Remove the recipe because no one depends on it anymore. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2simulator-native: remove recipeYi Zhao2021-03-031-36/+0
| | | | | | | Remove the recipe because it is unmaintained and its dependency python2 is EOL. Users can use ibmswtpm2 in meta-security as a replacement. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* shim: update github address in SRC_URICorey Cothrum2021-03-031-2/+2
|
* sbsigntool: Update to latest and change reposIlias Apalodimas2021-03-031-30/+7
| | | | | | | | The current sbsigntool repo is ancient and doesn't support native arm binaries. Let's switch to the current upstream and adjust the recipe accordingly, allowing the package to be used in native arm machines Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
* mtree: compat glibc 2.33Hongxu Jia2021-02-092-0/+37
| | | | | | | | | The glibc 2.33 remove macro _STAT_VER_LINUX [1], do not use it to represent linux system [1] https://sourceware.org/git/?p=glibc.git;a=blobdiff;f=sysdeps/unix/sysv/linux/bits/stat.h;h=b5426232088df446f502e6aea76a6cf03e71e1c4;hp=240628a6f4c9028a774c26a04a145c24110f669b;hb=8ed005daf0ab03e142500324a34087ce179ae78e;hpb=428985c436f442e91e27173bccaf28f547233586 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* tpm2simulator-native: fix native inheritance orderYi Zhao2021-02-041-1/+1
| | | | | | | | | | | | | Classes native/nativesdk must be inherited last to prevent unexpected behaviour. Fixes QA warning: QA Issue: tpm2simulator-native: native/nativesdk class is not inherited last, this can result in unexpected behaviour. Classes inherited after native/nativesdk: cmake.bbclass lib_package.bbclass python-dir.bbclass pythonnative.bbclass [native-last] Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libsign: fix dependency loop errorChangqing Li2021-02-041-1/+1
| | | | | | | | | | | | fix below error caused by: openssl->libsign-native->openssl DEBUG: Dependency loop #1 found: Dependency loop #1 found: ... oe-core commits "bitbake.conf/python: Drop setting RDEPENDS/RPROVIDES default" and "native: Stop clearing PACKAGES" refactor usage of RDEPENDS Signed-off-by: Changqing Li <changqing.li@windriver.com>
* Grub: Verify buffiles, e.g. fonts and imagesJussi Keranen2021-02-022-1/+33
|
* Grub: Parameterize prefix dirJussi Keranen2021-01-221-5/+6
|
* meta-efi-secure-boot/systemd: switch to meson buildYi Zhao2021-01-192-9/+6
| | | | | | | | The systemd switched to meson build long time ago. Somehow this bbappend didn't update. Switch to meson build otherwise these options do not work at all. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub: fix the file not found error when sysmlink filesize is 60Yi Zhao2021-01-192-0/+41
| | | | | | | | | | | | | | | | We encountered a file not found error when the symlink filesize is 60: $ ls -l initrd lrwxrwxrwx 1 root root 60 Jan 6 16:37 initrd -> secure-core-image-initramfs-5.10.2-yoctodev-standard.cpio.gz When booting, we got the following error in grub: error: file `/initrd' not found The root cause is although the size of diro->inode.symlink is 60, it includes the trailing '\0'. So if the symlink filesize is exactly 60, it is also stored in a separate block rather than in the inode. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* Typo fix: Don't enforce to use RPMjussike2021-01-141-1/+1
|
* conf/layer.conf: Add gatesgarth to LAYERSERIES_COMPATBartłomiej Burdukiewicz2020-12-099-9/+9
| | | | Signed-off-by: Bartłomiej Burdukiewicz <bartlomiej.burdukiewicz@gmail.com>
* user-key-store.bbclass: exclude ${GPG_PATH} from pseudo databaseYi Zhao2020-12-091-0/+1
| | | | | | | | | | Adapt to recent psuedo changes. Fixes: ERROR: grub-efi-2.04-r0 do_sign: Failed to import gpg key gpg: key 9E3086F96EEECC34/9E3086F96EEECC34: error sending to agent: End of file Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* create-user-key-store.sh: allow user to specify openssl x509 'days' paramCorey Cothrum2020-12-091-2/+8
| | | | | | allow openssl x509 '--days' parameter to be specified via command line argument Signed-off-by: Corey Cothrum <contact@coreycothrum.com>
* rpm: apply signatures to config filesYi Zhao2020-12-082-0/+10
| | | | | | | | | Since rpm 4.15, the users can control over the installation of signatures on config files through a variable named %_ima_sign_config_files. But this is disabled by default. Add a macro configuration file to enable it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-encrypted-storage: set CONFIG_HW_RANDOM_TPM to "y"Yongxin Liu2020-11-111-1/+1
| | | | | | | CONFIG_HW_RANDOM_TPM is bool, not tristate, and thus it cannot be set to "m" Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
* grub-efi: refresh patchYi Zhao2020-11-101-32/+57
| | | | | | | Refresh mok2verify-support-to-verify-non-PE-file-with-PKCS-7.patch to adapt the recent CVEs fixing. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* check_gpg_key: Fix gpg-agent.conf creation race conditionOvidiu Panait2020-10-191-1/+4
| | | | | | | | | | | | | | | | | | | | If GPG_PATH is already created by signing-keys do_get_public_keys task, subsequent executions of do_package_write_rpm will not create the gpg-agent.conf file anymore. Therefore, the spawned gpg-agent will miss important features such as auto-expand-secmem, leading to the following intermittent build errors: .... Subprocess output: gpg: signing failed: Cannot allocate memory gpg: signing failed: Cannot allocate memory error: gpg exec failed (2) gpg: signing failed: Cannot allocate memory gpg: signing failed: Cannot allocate memory error: gpg exec failed (2) ... Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
* grub-efi-efi-secure-boot.inc: Adapt to potential psuedo changesHongxu Jia2020-10-141-1/+1
| | | | | | | | | | | | | | | | If we do adopt path filtering for pseudo, we may filter out ${DEPLOY_DIR} as not needing to be tracked for "root" permissions. but we do track the data in ${D} though, when we copy file from ${D} to ${DEPLOY_DIR}, pseudo report a failure ... |cp: failed to preserve ownership for 'tmp-glibc/work/corei7-64-wrs-linux/ grub-efi/2.04-r0/deploy-grub-efi/efi-unsigned/x86_64-efi/fdt.lst' : Operation not permitted ... Disable pseudo for the copy operation Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* ima: Fix badly formatted CONFIG_IMA_NG_TEMPLATEYongxin Liu2020-10-121-1/+1
| | | | | | | | | | Fix the following warning: [INFO]: the following symbols were not found in the active configuration: - CONFIG_IMA_NG_TEMPLATE=y Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
* trousers: fix build failure for gcc-10Chen Qi2020-09-231-0/+3
| | | | | | | gcc-10 uses '-fno-common' by default, causing build error of multiple definition. Use '-fcommon' to fix this problem. Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
* tpm2-abrmd: Remove obsolete setting regarding the Standard OutputMingli Yu2020-09-232-0/+40
| | | | | | | | | | | The Standard output type "syslog" is obsolete, causing a warning since systemd version 246 [1]. Please consider using "journal" or "journal+console" [1] https://github.com/systemd/systemd/blob/master/NEWS#L202 Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
* create-user-key-store.sh: replace weak des3 encryption with aes256David Dunlap2020-09-151-2/+2
| | | | | | | | Replace weak des3 encryption with more secure algorithm aes256 to generate ima key in script create-user-key-store.sh. Signed-off-by: David Dunlap <david.dunlap@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com>
* trousers: update to latest git revYi Zhao2020-09-011-1/+1
| | | | | | | | | | | | | | | | | | Security fixes: CVE-2020-24332 If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks CVE-2020-24330 If the tcsd daemon is started with root privileges, it fails to drop the root gid after it is no longer needed CVE-2020-24331 If the tcsd daemon is started with root privileges, the tss user has read and write access to the /etc/tcsd.conf file Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-tools: upgrade 4.1.1 -> 4.1.3Yi Zhao2020-07-223-17/+122
| | | | | | | * License-Update: BSD -> BSD-3-Clause * Add a patch to switch to python3 in test scripts Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-tss: upgrade 2.3.2 -> 2.3.3Yi Zhao2020-07-221-7/+2
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-abrmd: upgrade 2.3.0 -> 2.3.2Yi Zhao2020-07-221-1/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* libsign: update to latest git revisionYi Zhao2020-07-201-1/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* cyrptfs-tpm2: set correct soname for libcryptfs-tpm2Yi Zhao2020-07-183-0/+49
| | | | | | | | | | | | | | | | | | | The current soname of libcryptfs-tpm2 is libcryptfs-tpm2.so: $ readelf -d libcryptfs-tpm2.so.0.7.0 | grep SONAME 0x000000000000000e (SONAME) Library soname: [libcryptfs-tpm2.so] The libcryptfs-tpm2.so is a symbolic link of libcryptfs-tmp2.so.0.7.0 and it is not installed by default because it is packaged to dev package. Then we will encounter an error when run command cryptfs-tpm2: $ cryptfs-tpm2 cryptfs-tpm2: error while loading shared libraries: libcryptfs-tpm2.so: cannot open shared object file: No such file or directory $ ldd cryptfs-tpm2 | grep libcryptfs-tpm2 libcryptfs-tpm2.so => not found Set the soname to libcryptfs-tpm2.so.$(MAJOR_VERSION) to fix the issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-abrmd: rdepends on libtss2-tcti-device and libtss2-tcti-mssimYi Zhao2020-07-151-1/+1
| | | | | | | | | | | | | | | | | The tpm2-abrmd daemon needs TCTI library for TPM2 device or simulator. But the libtss2-tcti-device and libtss2-tcti-mssim packages are not installed by default which causes the tpm2-abrmd daemon startup failure: systemd[1]: Starting TPM2 Access Broker and Resource Management Daemon... tpm2-abrmd[459]: tcti_conf before: "device:/dev/tpm0" tpm2-abrmd[459]: tcti_conf after: "device:/dev/tpm0" tpm2-abrmd[459]: ERROR:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr.c:418:Tss2_TctiLdr_Initialize_Ex() Failed to instantiate TCTI tpm2-abrmd[459]: init_thread_func: failed to create TCTI with conf "device:/dev/tpm0" tpm2-abrmd[459]: g_bus_unown_name: assertion 'owner_id > 0' failed Add libtss2-tcti-device and libtss2-tcti-mssim to runtime dependencies. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-tss: support usrmergeChangqing Li2020-07-021-2/+2
| | | | | | | fix do_package_qa error: ERROR: QA Issue: tpm2-tss package is not obeying usrmerge distro feature. /lib should be relocated to /usr. [usrmerge] Signed-off-by: Changqing Li <changqing.li@windriver.com>
* update tpm2-tools_3.2.1 -> tpm2-tools_4.1.1.bb, tpm2-abrmd_2.0.3 -> ↵richard2020-06-2717-516/+83
| | | | tpm2-abrmd_2.3.0, tpm2-tss_2.2.3.bb -> tpm2-tss_2.3.2.bb
* key-store: fix rdepends with multilibKai Kang2020-06-121-1/+2
| | | | | | | | | | | It shows qa issue when multilib is enabled: | ERROR: lib32-key-store-0.1-r0 do_package: QA Issue: lib32-key-store package lib32-key-store-rpm-pubkey - suspicious values 'rpm' in RDEPENDS [multilib] Prepend MLPREFIX to runtime dependency 'rpm' to fix the issue. Signed-off-by: Kai Kang <kai.kang@windriver.com>
* conf/layer.conf: Add dunfell to LAYERSERIES_COMPATChristophe Priouzeau2020-05-279-9/+9
| | | | Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com>
* user-key-store.bbclass: Kill gpg agent daemon after gpg signDe Huo2020-04-271-0/+4
| | | | | | | | | The gpg-agent daemon will be triggered to run in function boot_sign, This daemon will not exit even after building project. So kill the gpg-agent daemon after gpg signing process at the end of function boot_sign. Signed-off-by: De Huo <De.Huo@windriver.com>
* create-user-key-store.sh: Fix defect about invalid option ↵De Huo2020-04-161-2/+8
| | | | | | | | | | | | | | "--pinentry-mode=loopback" The option --pinentry-mode is not supported in gpg 2.0.22 code. so when the host gpg version is 2.0.22 the option will be removed. Start gpg-agent daemon when gpg-connect-agent reload agent failed. Otherwise there will be below failure message reported. gpg: can't connect to the agent - trying fall back gpg: can't connect to the agent: IPC connect call failed gpg: problem with the agent: No agent running Signed-off-by: De Huo <De.Huo@windriver.com>
* Revert "Removed unneeded patch to fix compilation error in efi-tool's console.c"Hongxu Jia2020-04-164-0/+80
| | | | | | | | | | | | | | | | | | | The patch to fix compilation error in efi-tool's console.c is required This reverts commit a6c3d9fcd2da0d20f2916d36557a73ad8790fd1c. In <=gnu-efi-3.0.9 variable is named EFI_WARN_UNKOWN_GLYPH, and in gnu-efi-3.0.11 is renamed in EFI_WARN_UNKNOWN_GLYPH. The patch is only for users with installed >=gnu-efi-3.0.11 because is in this version that variable has changed name from EFI_WARN_UNKOWN_GLYPH to EFI_WARN_UNKNOWN_GLYPH. [1] In oe-core master branch, the gnu-efi is 3.0.11, we need to add the fix back [1] https://bugs.gentoo.org/701152 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* ovmf_%.bbappend: tweak do_sign task order to avoid racing issueHongxu Jia2020-04-101-1/+1
| | | | | | | | | | | | If ovmf's do_deploy is run before do_sign, there is a failure ... |install: cannot stat 'tmp-glibc/work/corei7-64-wrs-linux/ovmf/ edk2-stable201911-r0/ovmf/Pkcs7VerifyDxe.efi.signed': No such file or directory ... Add do_sign before do_deploy Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* Removed unneeded patch to fix compilation error in efi-tool's console.cAbdelrahman Ibrahem2020-04-084-80/+0
|
* cryptfs-tpm2: convert the script to python3Yi Zhao2020-03-192-0/+33
| | | | | | | | | | | Convert the script to python3 to fix the do_compile failure. Fixes: /buildarea/poky/build/tmp/work/core2-64-poky-linux/cryptfs-tpm2/0.7.0+gitAUTOINC+888c46c827-r0/git/scripts/encrypt_secret.py -i "H31i05" > "primary_key.secret" || exit 1 /usr/bin/env: ‘python’: No such file or directory Makefile:64: recipe for target 'primary_key.secret' failed Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-tpm2: add dependency on meta-python2Yi Zhao2020-03-191-1/+1
| | | | | | | | | Fixes: ERROR: ParseError at /buildarea/poky/meta-secure-core/meta-tpm2/recipes-devtools/python/python-beautifulsoup4_4.4.1.bb:19: Could not inherit file classes/setuptools.bbclass Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-tools: only support python3 in test scriptsYi Zhao2020-03-132-0/+142
| | | | | | | | | | | The python2 is removed from oe-core and there is no python symblic link by default which will cause an error when running test scripts: $ ./test_tpm2_activecredential.sh: line 66: python: command not found So drop python2 support and only keep python3. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-tools: fix yaml.load warning in test scriptsYi Zhao2020-03-132-0/+93
| | | | | | | | | | | | The yaml.load(f) is deprecated since pyyaml 5.1. Use yaml.load(f, Loader=yaml.BaseLoader) instead of it. See https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation Fixes warning: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2simulator-native: update to latest git revisionYi Zhao2020-03-101-1/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* tpm2-tools: upgrade 3.2.0 -> 3.2.1Yi Zhao2020-03-101-2/+2
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* fixup! sign_rpm_ext: Use socket redirection to avoid GPG_PATH length limitationOvidiu Panait2020-03-031-6/+9
| | | | | | | | | | | | | | | | If GPG_PATH is already created by signing-keys do_get_public_keys task, subsequent executions of do_package_write_rpm will fail with "Filename too long" errors (this only affects builds using GPG paths larger than 80 characters). Fix this race condition by making sure that the redirection files are always present in the gpg homedir even if the directory already exists when the first package_write_rpm task executes. Also, make sure this new approach does not affect GPG_PATHs smaller than 80 chars. Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
* modified grub-efi-efi-secure-boot.inc to install also the grub configuration ↵richard2020-03-011-0/+13
| | | | files in the DEPLOYDIR
* Add additional *_KEYS_DIR to keys.confDrew Moseley2020-03-011-0/+2
| | | | Signed-off-by: Drew Moseley <drew.moseley@northern.tech>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-05-13 08:09:17 +0000