summaryrefslogtreecommitdiffstats
path: root/meta-efi-secure-boot/recipes-bsp
Commit message (Collapse)AuthorAgeFilesLines
* grub-efi: split grub serure builtin option from GRUB_BUILDINHEADmasterHongxu Jia2022-03-151-2/+3
| | | | | | | | | Use variable GRUB_SECURE_BUILDIN to split grub secure builtin option from GRUB_BUILDIN, then GRUB_BUILDIN will not contain secure option for others grub-mkimage to create no secure grub even though secure boot is enabled Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* recipes: update SRC_URI branch and protocolsYi Zhao2021-11-153-3/+3
| | | | | | | Update SRC_URIs using git to include branch=master if no branch is set and also to use protocol=https for github urls. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: Remove $cmdpath from configuration for for grub-mkimagePeter Hatina2021-10-291-1/+1
| | | | Signed-off-by: Peter Hatina <peter@hatina.eu>
* efitools: fix openssl.cnf path for openssl 3.0Yi Zhao2021-10-212-14/+19
| | | | | | | Fix openssl.cnf path for openssl 3.0 to make sure openssl command can find it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-secure-core: Convert to new override syntaxYi Zhao2021-08-096-35/+35
| | | | | | Converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* shim_git: fix the do_fetch warningMingli Yu2021-07-291-1/+1
| | | | | | | Fixes: WARNING: shim-12+gitAUTOINC+5202f80c32-r0 do_fetch: Failed to fetch URL git://github.com/rhboot/shim.git, attempting MIRRORS if available Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
* prevent contamining the cache with embeded cfgjbouchard2021-05-011-0/+2
|
* grub: disable inside lockdown and shim_lock verifiersYi Zhao2021-04-212-0/+48
| | | | | | | | | | | | | | | The lockdown support[1] and secure boot detection[2] have been added to grub 2.06. These verifiers are registered when UEFI Secure Boot is enabled. Unfortunately, they conflict with the current MOK2 Verify mechanism. So disable them. Fixes grub error: error: failed to verify kernel /bzImage [1] http://git.savannah.gnu.org/cgit/grub.git/commit/?id=578c95298bcc46e0296f4c786db64c2ff26ce2cc [2] http://git.savannah.gnu.org/cgit/grub.git/commit/?id=d7e54b2e5feee95d2f83058ed30d883c450d1473 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: enable secure-boot support only for target buildsOvidiu Panait2021-04-041-4/+5
| | | | | | | | | grub-efi-native does not benefit from the extra code/modules that get built for secure-boot support, it just increases the build time of the package. Therefore, mark all secure-boot related procedures in the recipe for class-target only. Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
* grub: Drop useless insmod verify from cfgAlexandru Avadanii2021-03-291-6/+2
| | | | | | | | | | - the 'verify' grub module has been renamed to 'pgp' in grub 2.04; - the 'pgp' grub module is already built-in if GRUB_SIGN_VERIFY is set, so there's no need to call insmod; While at it, remove some unnecessary code duplication. Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
* grub-efi: refresh patches for grub 2.06Yi Zhao2021-03-245-84/+52
| | | | | | | | | | | | Rebase patch: 0001-grub-verify-Add-strict_security-variable.patch Grub-get-and-set-efi-variables.patch mok2verify-support-to-verify-non-PE-file-with-PKCS-7.patch Drop 0001-fs-ext2-fix-the-file-not-found-error-when-symlink-fi.patch since it has been merged upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: update the bbapepnd file nameChen Qi2021-03-241-0/+0
| | | | | | | oe-core now uses the git version for grub-efi, so we'd better to use the '%' wildcard for the bbappend file name. Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
* shim: update github address in SRC_URICorey Cothrum2021-03-031-2/+2
|
* Grub: Verify buffiles, e.g. fonts and imagesJussi Keranen2021-02-022-1/+33
|
* Grub: Parameterize prefix dirJussi Keranen2021-01-221-5/+6
|
* grub: fix the file not found error when sysmlink filesize is 60Yi Zhao2021-01-192-0/+41
| | | | | | | | | | | | | | | | We encountered a file not found error when the symlink filesize is 60: $ ls -l initrd lrwxrwxrwx 1 root root 60 Jan 6 16:37 initrd -> secure-core-image-initramfs-5.10.2-yoctodev-standard.cpio.gz When booting, we got the following error in grub: error: file `/initrd' not found The root cause is although the size of diro->inode.symlink is 60, it includes the trailing '\0'. So if the symlink filesize is exactly 60, it is also stored in a separate block rather than in the inode. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: refresh patchYi Zhao2020-11-101-32/+57
| | | | | | | Refresh mok2verify-support-to-verify-non-PE-file-with-PKCS-7.patch to adapt the recent CVEs fixing. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi-efi-secure-boot.inc: Adapt to potential psuedo changesHongxu Jia2020-10-141-1/+1
| | | | | | | | | | | | | | | | If we do adopt path filtering for pseudo, we may filter out ${DEPLOY_DIR} as not needing to be tracked for "root" permissions. but we do track the data in ${D} though, when we copy file from ${D} to ${DEPLOY_DIR}, pseudo report a failure ... |cp: failed to preserve ownership for 'tmp-glibc/work/corei7-64-wrs-linux/ grub-efi/2.04-r0/deploy-grub-efi/efi-unsigned/x86_64-efi/fdt.lst' : Operation not permitted ... Disable pseudo for the copy operation Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* Revert "Removed unneeded patch to fix compilation error in efi-tool's console.c"Hongxu Jia2020-04-164-0/+80
| | | | | | | | | | | | | | | | | | | The patch to fix compilation error in efi-tool's console.c is required This reverts commit a6c3d9fcd2da0d20f2916d36557a73ad8790fd1c. In <=gnu-efi-3.0.9 variable is named EFI_WARN_UNKOWN_GLYPH, and in gnu-efi-3.0.11 is renamed in EFI_WARN_UNKNOWN_GLYPH. The patch is only for users with installed >=gnu-efi-3.0.11 because is in this version that variable has changed name from EFI_WARN_UNKOWN_GLYPH to EFI_WARN_UNKNOWN_GLYPH. [1] In oe-core master branch, the gnu-efi is 3.0.11, we need to add the fix back [1] https://bugs.gentoo.org/701152 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* Removed unneeded patch to fix compilation error in efi-tool's console.cAbdelrahman Ibrahem2020-04-084-80/+0
|
* modified grub-efi-efi-secure-boot.inc to install also the grub configuration ↵richard2020-03-011-0/+13
| | | | files in the DEPLOYDIR
* grub-efi-efi-secure-boot.inc: append do_deploy instead overriding itSandra Tobajas2020-01-161-2/+2
| | | | | | Append do_deploy function instead of overriding it. Signed-off-by: Sandra Tobajas <sandra.tobajas@savoirfairelinux.com>
* grub-efi-efi-secure-boot.inc: let EFI_BOOT_PATH be overridedSandra Tobajas2020-01-161-2/+2
| | | | | | Let the EFI_BOOT_PATH Bitbake variable be overrided if needed. Signed-off-by: Sandra Tobajas <sandra.tobajas@savoirfairelinux.com>
* grub-efi-efi-secure-boot.inc: use task_prepend instead of prefuncs for do_signYi Zhao2019-12-131-2/+6
| | | | | | | | | | The grub-efi-native build doesn't need to run do_sign task but there are two prefuncs for do_sign still run in native build. This will cause a build error when there is no gpg command on the host. Move the functions to do_sign_prepend_class-target to make sure they only run in target build. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* efitools: do not do_sign if GRUB_SIGN_VERIFY not enabledHongxu Jia2019-11-191-0/+3
| | | | | | | | | | | | | | | | | | | If GRUB_SIGN_VERIFY is not enabled, do_sign will fail in which GPG_PATH is not set (--homedir None) ... |DEBUG: Executing python function do_sign |NOTE: Running: echo "SecureCore" | tmp-glibc/hosttools/gpg --pinentry-mode loopback --batch --homedir None -u "SecureBootCore" --detach-sign --passphrase-fd 0 "tmp-glibc/work/core2-32-wrs-linux/efitools/ 1.9.2+gitAUTOINC+392836a46c-r0/image/boot/efi/EFI/BOOT/LockDown.efi" |ERROR: Failed to sign: tmp-glibc/work/core2-32-wrs-linux/efitools/ 1.9.2+gitAUTOINC+392836a46c-r0/image/boot/efi/EFI/BOOT/LockDown.efi ... Since GPG_PATH is set in do_sign's prefunc check_boot_public_key if GRUB_SIGN_VERIFY is enabled, add the same condition to do_sign Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* efitools-native: Fix compilation problem with latest /usr/include/efiHongxu Jia2019-11-192-1/+1
| | | | | | | Since commit [382ffa1 efitools: Fix compilation problem with latest /usr/include/efi], we should apply the fix to native also. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* secure boot: Make SELoader optional and copy sig files when GRUB_SIGN_VERIFY=1Jason Wessel2019-11-083-1/+17
| | | | | | | | | | | | | | | This commit makes the SELoader entire optional and allows it to be removed, with the intended replacement being to use grub's built in gpg key verification. It will be possible in a template or local.conf: UEFI_SELOADER = "0" GRUB_SIGN_VERIFY = "1" [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* grub: Make SELoader optional and add gpg verify supportJason Wessel2019-11-084-74/+247
| | | | | | | | | | | | | | | | | | | | Allow SELoader to be an optional component for secure boot verification. The GPG_SIGN_VERIFY variable was added to control the ability to have grub perform all of the verification of the loaded files using a public key which gets built into grub at the time that mkimage is run. It is not intended that GPG_SIGN_VERIFY and UEFI_SELOADER would both be set to "1". While this configuration could work, it makes very little sense to use the system that way. Also enabled is the tftp feature for grub as a builtin. This allows grub to start from the network when the UEFI is configured to boot off the network with tftp. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* efitools: Fix compilation problem with latest /usr/include/efiJason Wessel2019-11-082-0/+40
| | | | | | | | | | | | gcc -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/git/include/ -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include/efi -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include/efi/x86_64 -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -fno-stack-protector -ffreestanding -fno-stack-check -DGNU_EFI_USE_MS_ABI -DEFI_FUNCTION_WRAPPER -mno-red-zone -DCONFIG_x86_64 -fno-toplevel-reorder -DBUILD_EFI -c console.c -o console.efi.o | console.c:360:5: error: ‘EFI_WARN_UNKOWN_GLYPH’ undeclared here (not in a function); did you mean ‘EFI_WARN_UNKNOWN_GLYPH’? | { EFI_WARN_UNKOWN_GLYPH, L"Warning Unknown Glyph"}, | ^~~~~~~~~~~~~~~~~~~~~ | EFI_WARN_UNKNOWN_GLYPH | ../Make.rules:113: recipe for target 'console.efi.o' failed Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* shim: Fix compilation problem with latest /usr/include/efiJason Wessel2019-11-082-0/+40
| | | | | | | | | | | | | | | | | x86_64-poky-linux-gcc -ggdb -O0 -fno-stack-protector -fno-strict-aliasing -fpic -fshort-wchar -Wall -Wsign-compare -Werror -fno-builtin -Werror=sign-compare -ffreestanding -std=gnu89 -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../lib/x86_64-poky-linux/gcc/x86_64-poky-linux/9.2.0/include -DDEFAULT_LOADER=L"\SELoaderx64.efi" -DDEFAULT_LOADER_CHAR="\SELoaderx64.efi" -nostdinc -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/Cryptlib -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/Cryptlib/Include -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot/usr/include/efi -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot/usr/include/efi/x86_64 -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot/usr/include/efi/protocol -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/include -iquote /opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git -iquote /opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git -DOVERRIDE_SECURITY_POLICY -DENABLE_HTTPBOOT -mno-mmx -mno-sse -mno-red-zone -nostdinc -maccumulate-outgoing-args -DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI -DNO_BUILTIN_VA_FUNCS -DMDE_CPU_X64 -DPAGE_SIZE=4096 -DEFI_ARCH=L"x64" -DDEBUGDIR=L"/usr/lib/debug/usr/share/shim/x64-12-_poky_3.0/" -DVENDOR_CERT_FILE="/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/vendor_cert.cer" -c -o console.o console.c | console.c:363:5: error: 'EFI_WARN_UNKOWN_GLYPH' undeclared here (not in a function); did you mean 'EFI_WARN_UNKNOWN_GLYPH'? | 363 | { EFI_WARN_UNKOWN_GLYPH, L"Warning Unknown Glyph"}, | | ^~~~~~~~~~~~~~~~~~~~~ | | EFI_WARN_UNKNOWN_GLYPH | <builtin>: recipe for target 'console.o' failed | make[1]: *** [console.o] Error 1 | make[1]: Leaving directory '/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/lib' | Makefile:223: recipe for target 'lib/lib.a' failed | make: *** [lib/lib.a] Error 2 | WARNING: exit code 1 from a shell command. Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* efitools: Uprev to fix LockDown.efi for UEFI built after 2018Jason Wessel2019-11-084-80/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Versions of the UEFI core from 2018 on will not work properly with LockDown.efi's key install. It will report that the PK key cannot be installed due to the handling of the signature header with the PKCS7 data. There are several other minor bug fixes, with the short log shown below. ==== James Bottomley (13): cert-to-efi-hash-list: fix for openssl 1.1 Version: 1.8.0 Fix Fedora build Version: 1.8.1 factor out variable signing code support engine based keys use SignedData instead of PKCS7 for variable updates Version: 1.9.0 Makefile: Reverse the order of lib.a and -lcrypto Version: 1.9.1 sign-efi-sig-list: add man page entry for engine option sha256: do not align raw section sizes Version: 1.9.2 pai-yi.huang (1): efi-updatevar: remove all authenticated attributes from signature Make.rules | 6 ++--- Makefile | 12 +++++----- cert-to-efi-hash-list.c | 6 ++++- efi-updatevar.c | 28 +++++++++++------------ include/openssl_sign.h | 10 ++++++++ include/version.h | 2 +- lib/Makefile | 2 +- lib/openssl_sign.c | 156 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ lib/sha256.c | 8 ++++--- sign-efi-sig-list.c | 59 +++++++++++------------------------------------ 10 files changed, 213 insertions(+), 76 deletions(-) create mode 100644 include/openssl_sign.h create mode 100644 lib/openssl_sign.c [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* grub-efi/boot-menu.inc: remove invalid menuentry (#122)Zhao Yi2019-11-011-5/+0
| | | | | | Currently the recovery menuentry is not available because we don't provide bzImage_backup and initrd_backup. Remove this entry. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* seloader: use pkcs7 drivers from OVMFDmitry Eremin-Solenikov2019-09-041-13/+6
| | | | | | | Rather than using pre-compiled EFI drivers, use freshly compiled drivers from OVMF source tree. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* grub-efi: support mok2 verify in multiboot2 protocolDmitry Eremin-Solenikov2019-09-042-0/+55
| | | | | | | Add support for verifying PKCS#7 signatures via MOK2 protocol to multiboot2 command enabling one to load multiboot-capable kernels. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* grub-efi: fix uid contamination by host QA warningLiwei Song2019-08-261-0/+10
| | | | | | | | | Fix the following QA issue: WARNING: grub-efi-2.04-r0 do_package_qa: QA Issue: grub-efi: /boot/efi/EFI/BOOT/grub.cfg.p7b is owned by uid 19183 chown to root for p7b file to fix uid contamination by host. Signed-off-by: Liwei Song <liwei.song@windriver.com>
* meta-efi-secure-boot: only apply if efi-secure-boot distro flag setMark Hatle2019-08-132-148/+149
| | | | | | | | Only apply grub-efi and linux-yocto bbappend if feature efi-secure-boot set Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: update bbappend and refresh patchesYi Zhao2019-08-132-22/+28
| | | | | | | The grub-efi has been upgraded to 2.04 in oe-core. Update the bbappend and refresh patches to adapt it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* shim: fix build failure with gcc9Yi Zhao2019-06-052-0/+76
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Backport patch to fix build error with gcc9 for option "-Werror=address-of-packed-member" MokManager.c: In function 'write_back_mok_list': MokManager.c:1125:19: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] 1125 | if (CompareGuid(&(list[i].Type), &CertType) == 0) | ^~~~~~~~~~~~~~~ MokManager.c:1147:19: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] 1147 | if (CompareGuid(&(list[i].Type), &CertType) == 0) { | ^~~~~~~~~~~~~~~ MokManager.c: In function 'delete_cert': MokManager.c:1188:19: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] 1188 | if (CompareGuid(&(mok[i].Type), &CertType) != 0) | ^~~~~~~~~~~~~~ MokManager.c: In function 'delete_hash_in_list': MokManager.c:1239:20: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] 1239 | if ((CompareGuid(&(mok[i].Type), &Type) != 0) || | ^~~~~~~~~~~~~~ MokManager.c: In function 'delete_keys': MokManager.c:1410:19: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] 1410 | if (CompareGuid(&(del_key[i].Type), &CertType) == 0) { | ^~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors <builtin>: recipe for target 'MokManager.o' failed Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: fix the potential uninitialized error for variable 'err'Wenzong Fan2018-12-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the build errors with DEBUG_BUILD enabled: grub-core/loader/linux.c: In function 'grub_initrd_load': grub-core/loader/linux.c:326:10: error: 'err' may be used \ uninitialized in this function [-Werror=maybe-uninitialized] In function grub_initrd_load: grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, char *argv[], void *target) { [snip] grub_err_t err; [snip] #ifdef GRUB_MACHINE_EFI [snip] err = grub_verify_file (argv[i]); [snip] #endif [snip] fail: [snip] return err; } If the GRUB_MACHINE_EFI is not defined, the function would return an uninitialized value for 'err'. We should initialize it when this variable is assigned. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-efi-secure-boot: Ensure openssl-native exists when we need itTom Rini2018-11-072-2/+3
| | | | | | | | | | | In order to deploy our secure boot keys in DER format we need to use openssl. This must be listed in our DEPENDS line in order for the sysroot to be populated correctly when we run do_sign. Also drop the explicit fakeroot on our empty grub-efi do_sign as we may not have globally populated virtual/fakeroot-native at that point in time. Fixes: 92316d4b402b ("meta-signing-key: When deploying keys UEFI keys, deploy DER format") Signed-off-by: Tom Rini <trini@konsulko.com>
* Clean up the stuffs for stable branchesJia Zhang2018-09-201-2/+0
| | | | | | | | | | | The following commits are reverted by the way: - seloader: Fix building for rocko (bc6bbe2) - meta-integrity: rpm: Add back in required patches for rocko (5fa9c85) Because they are only applicable to rocko. Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* efitools: refresh patch to fix QA warningYi Zhao2018-09-061-6/+3
| | | | | | Refresh patch Build-DBX-by-default.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* efitools: add the deployed artifacts to SSTATE_DUPWHITELISTYi Zhao2018-09-061-0/+2
| | | | | | | | | | | | | | | | | | | The oe-core commit 05f6042a40bb772f7ce8d6819c5b2937d8c9808d removed DEPLOY_DIR_IMAGE from SSTATE_DUPWHITELIST which caused a do_depoy error when enable multilib: $ bitbake efitools lib32-efitools ERROR: lib32-efitools-1.7.0+gitAUTOINC+0649468475-r0 do_deploy: The recipe lib32-efitools is trying to install files into a shared area when those files already exist. Those files and their manifest location are: /buildarea/build/tmp-glibc/deploy/images/qemux86-64/LockDown.efi (matched in manifest-qemux86_64-efitools.deploy) Please verify which recipe should provide the above files. Add the deployed artifacts to SSTATE_DUPWHITELIST to fix this issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* seloader: add the deployed artifacts to SSTATE_DUPWHITELISTYi Zhao2018-09-061-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | The oe-core commit 05f6042a40bb772f7ce8d6819c5b2937d8c9808d removed DEPLOY_DIR_IMAGE from SSTATE_DUPWHITELIST which caused a do_depoy error when enable multilib: $ bitbake seloader lib32-seloader ERROR: lib32-seloader-0.4.6+gitAUTOINC+8b90f76a8d-r0 do_deploy: The recipe lib32-seloader is trying to install files into a shared area when those files already exist. Those files and their manifest location are: /buildarea/build/tmp-glibc/deploy/images/qemux86-64/Pkcs7VerifyDxe.efi (matched in manifest-qemux86_64-seloader.deploy) /buildarea/build/tmp-glibc/deploy/images/qemux86-64/Hash2DxeCrypto.efi (matched in manifest-qemux86_64-seloader.deploy) /buildarea/build/tmp-glibc/deploy/images/qemux86-64/efi-unsigned/Pkcs7VerifyDxe.efi (matched in manifest-qemux86_64-seloader.deploy) /buildarea/build/tmp-glibc/deploy/images/qemux86-64/efi-unsigned/Hash2DxeCrypto.efi (matched in manifest-qemux86_64-seloader.deploy) Please verify which recipe should provide the above files. Add the deployed artifacts to SSTATE_DUPWHITELIST to fix this issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* sbsigntool: Enable nativesdk supportTom Rini2018-08-251-0/+1
| | | | | | | | There are times were we might want to include sbsigntool into an SDK so rename the recipe and extend to include nativesdk. We also need gnu-efi to support nativesdk so include that in a bbappend. Signed-off-by: Tom Rini <trini@konsulko.com>
* seloader: Fix building for rockoTom Rini2018-07-311-0/+2
| | | | | | | | | When building on rocko we have gnu-efi version 3.0.6 around and seloader needs to be told this for certain string functions to be provided by itself rather than gnu-efi. Add in conditional logic to pass this only for rocko. Signed-off-by: Tom Rini <trini@konsulko.com>
* seloader: Update to 0.4.6Jia Zhang2018-07-171-2/+2
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* Add root parameter configuration in boot command line.Jinliang Li2018-06-261-0/+6
| | | | | | | It is helpful when secure boot is enabled, because you can not modify boot command line after boot-menu.inc is signed before deploying. Signed-off-by: Jinliang Li <jinliang.li@linux.alibaba.com>
* seloader: sync up with the latestJia Zhang2018-05-201-1/+1
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* grub-efi: remove aarch64 from COMPATIBLE_HOSTKai Kang2018-05-161-0/+3
| | | | | | | Functions efi_call_foo and efi_shim_exit are not implemented for arm64 yet, so remove 'aarch64' from COMPATIBLE_HOST for now. Signed-off-by: Kai Kang <kai.kang@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-03 00:28:18 +0000