summaryrefslogtreecommitdiffstats
path: root/meta-signing-key
Commit message (Collapse)AuthorAgeFilesLines
* user-key-store.bbclass: Depend on gnupg-native to always use provided gpgJason Wessel2019-12-131-1/+1
| | | | | | | | | | | | | | | | | | | | On some host configuration such as ubuntu 16.04 the gnupg in /usr/bin is the 1.x version. This can cause problems between the import and signing process if the gpg version is different. The commands in the user-key-store class assume gnupg is at least version 2.2 or newer. To avoid the signing phase failing for the efitools and the kernel, the user-key-store class should depend on the gnupg-native binaries. It avoids this specific error: ERROR: efitools-1.9.2+gitAUTOINC+392836a46c-r0 do_sign: Failed to sign: /opt/tmp-glibc/work/corei7-64-wrs-linux/efitools/1.9.2+gitAUTOINC+392836a46c-r0/image/boot/efi/EFI/BOOT/LockDown.efi ERROR: Logfile of failure stored in: /opt/tmp-glibc/work/corei7-64-wrs-linux/efitools/1.9.2+gitAUTOINC+392836a46c-r0/temp/log.do_sign.22969 NOTE: recipe efitools-1.9.2+gitAUTOINC+392836a46c-r0: task do_sign: Failed [ Issue: LIN1019-3757 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* sbsigntool-native: specify TMPDIRJoe Slater2019-11-141-1/+1
| | | | | | | | | | | | | Issue: LIN1018-450 Under extremely rare circumstances, access can be denied to /tmp, so we specify a local TMPDIR. This is a cherry-pick of 886c44b from WRL 10.17. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* layer.conf gpg boot key sample: Add the gpg boot key sample filesJason Wessel2019-11-085-0/+95
| | | | | | | | | | | Sample keys are required in order for the signing to succeed when using grub boot verification. The keys are only used when GRUB_SIGN_VERIFY = "1", and it is intended that and user would generate new keys with the create-user-key-store.sh. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* secure boot: Make SELoader optional and copy sig files when GRUB_SIGN_VERIFY=1Jason Wessel2019-11-081-0/+8
| | | | | | | | | | | | | | | This commit makes the SELoader entire optional and allows it to be removed, with the intended replacement being to use grub's built in gpg key verification. It will be possible in a template or local.conf: UEFI_SELOADER = "0" GRUB_SIGN_VERIFY = "1" [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* create-user-key-store.sh: Update for OSTree and ease of useJason Wessel2019-11-081-71/+306
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The create-user-key-store.sh was changed in a number ways to improve the usability with other layers that will consume the key services provided by meta-secure-core. New features: * A safety check was added that keys can only be written to a fresh empty directory. * The script can be run non-iteractively or interactively for the ease of use. * gpg 1.x support and gpg 2.x support work with the passphrases * A keys.conf is generated to allow a single line to be written into the local.conf with all the keys. An interactive session looks like: ================================== ./create-user-key-store.sh -d /tmp/test KEYS_DIR: /tmp/test Enter RPM/OSTree GPG keyname (use dashes instead of spaces) [default: PKG-SecureCore]: PKG-Sample-Man Enter RPM/OSTree GPG e-mail address [default: SecureCore@foo.com]: sample.man@sample.com Enter RPM/OSTREE GPG comment [default: Signing Key]: Sample Signing Key Using boot loader gpg name: BOOT-Sample-Man Using boot loader gpg email: sample.man@sample.com Using boot loader gpg comment: Sample Signing Key Press control-c now if and use -bn -bm -bc arguments if you want different values other than listed above Enter RPM/OSTREE passphrase: abc1234 Enter IMA passphrase: 1234pass Enter boot loader GPG passphrase: bootup Enter boot loader locked configuration password(e.g. grub pw): root MASTER_KEYS_DIR = "/tmp/test" IMA_KEYS_DIR = "${MASTER_KEYS_DIR}/ima_keys" IMA_EVM_KEY_DIR = "${MASTER_KEYS_DIR}/ima_keys" RPM_KEYS_DIR = "${MASTER_KEYS_DIR}/rpm_keys" BOOT_KEYS_DIR = "${MASTER_KEYS_DIR}/boot_keys" MOK_SB_KEYS_DIR = "${MASTER_KEYS_DIR}/mok_sb_keys" SYSTEM_TRUSTED_KEYS_DIR = "${MASTER_KEYS_DIR}/system_trusted_keys" UEFI_SB_KEYS_DIR = "${MASTER_KEYS_DIR}/uefi_sb_keys" GRUB_PUB_KEY = "${MASTER_KEYS_DIR}/boot_keys/boot_pub_key" GRUB_PW_FILE = "${MASTER_KEYS_DIR}/boot_keys/boot_cfg_pw" OSTREE_GPGDIR = "${MASTER_KEYS_DIR}/rpm_keys" RPM_GPG_NAME = "PKG-Sample-Man" RPM_GPG_PASSPHRASE = "abc1234" RPM_FSK_PASSWORD = "1234pass" BOOT_GPG_NAME = "BOOT-Sample-Man" BOOT_GPG_PASSPHRASE = "bootup" OSTREE_GPGID = "PKG-Sample-Man" OSTREE_GPG_PASSPHRASE = "abc1234" OSTREE_GRUB_PW_FILE = "${GRUB_PW_FILE}" [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* grub: Make SELoader optional and add gpg verify supportJason Wessel2019-11-081-0/+6
| | | | | | | | | | | | | | | | | | | | Allow SELoader to be an optional component for secure boot verification. The GPG_SIGN_VERIFY variable was added to control the ability to have grub perform all of the verification of the loaded files using a public key which gets built into grub at the time that mkimage is run. It is not intended that GPG_SIGN_VERIFY and UEFI_SELOADER would both be set to "1". While this configuration could work, it makes very little sense to use the system that way. Also enabled is the tftp feature for grub as a builtin. This allows grub to start from the network when the UEFI is configured to boot off the network with tftp. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* sign_rpm_ext.bbclass, user-key-store.bbclass: Add boot loader signingJason Wessel2019-11-081-0/+63
| | | | | | | | | | | | | | | | | | | | | This changes the rpm signing setup to use a generic routine check_gpg_key(), in order that the boot loader gpg signing can use the same infrastructure. For now the boot loader gpg signing will only support grub and introduces the variable: GRUB_SIGN_VERIFY = "1" This variable is a control point to activate the code in grub-efi to perform file verification of any file it loads against a gpg key which is linked into the boot loader with grub-mkimage. It will also cause all the other files such as the kernel, initramfs and LockDown.efi to be signed such that grub will verify the files. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* conf/layer.conf: Add zeus to LAYERSERIES_COMPAT (#121)muvarov2019-11-011-1/+1
| | | Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
* key-store: drop private keys packagesDmitry Eremin-Solenikov2019-09-161-54/+0
| | | | | | | Having a private key package might allow one to pull it into rootfs which is really, really bad. So drop all private key packages. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* Merge pull request #112 from yizhao1/fix2Jia Zhang2019-08-191-2/+2
|\ | | | | meta-signing-key/conf/layer.conf: use weak assignment for RPM_GPG_NAM…
| * meta-signing-key/conf/layer.conf: use weak assignment for RPM_GPG_NAME and ↵Yi Zhao2019-08-191-2/+2
| | | | | | | | | | | | | | | | | | RPM_GPG_PASSPHRASE Use weak assignment for RPM_GPG_NAME and RPM_GPG_PASSPHRASE so these values could be overridden in other conf files. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* | fixup! meta-secure-core: use bb.fatal instead of bb.build.FuncFailedYi Zhao2019-08-191-1/+1
|/
* meta-secure-core: use bb.fatal instead of bb.build.FuncFailedYi Zhao2019-08-191-4/+4
| | | | | | | The bb.build.FuncFailed had been removed in bitbake with commit cfeffb602dd5319f071cd6bcf84139ec77f2d170. Use bb.fatal instead of it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* conf/layer.conf: Add warrior to LAYERSERIES_COMPATYi Zhao2019-04-231-1/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* key-store: rename ima private key and certificate on targetYunguo Wei2018-11-071-2/+2
| | | | | | | | | If sample keys are selected, key-store service will deploy IMA private key during first boot, but beople may be confused if we deploy a sample private key like "xxx.crt", so this commit is making sure key/cert on target are consistent with key files on build system. Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
* meta-signing-key: When deploying keys UEFI keys, deploy DER formatTom Rini2018-10-251-0/+4
| | | | | | | | | Generally speaking, for firmware to import PK/KEK/DB keys they need to be in the binary "DER" format and typically have the "cer" file extension. When deploying our keys, convert what we have to that format and deploy as well for ease of use. Signed-off-by: Tom Rini <trini@konsulko.com>
* libsign: Fix build failure with GCC 8.xYunguo Wei2018-10-081-1/+1
| | | | Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
* layer.conf: update LAYERSERIES_COMPAT `sumo' -> `thud'Hongxu Jia2018-10-081-1/+1
| | | | | | | | Since `9ec5a8a layer.conf: Drop sumo from LAYERSERIES_CORENAMES' and `9867924 layer.conf: Add thud to LAYERSERIES_CORENAMES' applied in oe-core, update LAYERSERIES_COMPAT `sumo' -> `thud' Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* Clean up the stuffs for stable branchesJia Zhang2018-09-201-1/+1
| | | | | | | | | | | The following commits are reverted by the way: - seloader: Fix building for rocko (bc6bbe2) - meta-integrity: rpm: Add back in required patches for rocko (5fa9c85) Because they are only applicable to rocko. Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* libsign: Fix build faiure due to -fstack-protector-strongJia Zhang2018-09-171-0/+1
| | | | | | | SECURITY_LDFLAGS includes -fstack-protector-strong which cannot work with CCLD. To work around this issue, filter out it from LDFLAGS. Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* libsign: Update to the latestJia Zhang2018-09-171-1/+2
| | | | | | - Use CCLD to build executable and library. Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* key-store: fix incorrect postpone to first bootHongxu Jia2018-09-051-13/+11
| | | | | | | | | | | After postinst was executed at do_rootfs successfully, there will be no first boot to redo. Since `229f4e9 package.bbclass: add support for pkg_postinst_ontarget()' applied in oe-core, use pkg_postinst_ontarget to instead. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* libsign: Enable nativesdk supportTom Rini2018-08-251-2/+2
| | | | | | | Bump up to the current top of libsign so that we can easily get a copy of selsign that can be put into an SDK. Signed-off-by: Tom Rini <trini@konsulko.com>
* sbsigntool: Enable nativesdk supportTom Rini2018-08-251-2/+4
| | | | | | | | There are times were we might want to include sbsigntool into an SDK so rename the recipe and extend to include nativesdk. We also need gnu-efi to support nativesdk so include that in a bbappend. Signed-off-by: Tom Rini <trini@konsulko.com>
* layer.conf: Mark as compatible with rockoTom Rini2018-07-251-1/+1
| | | | | | | As we also work with the 'rocko' release list that in our LAYERSERIES_COMPAT. Signed-off-by: Tom Rini <trini@konsulko.com>
* Fix parsing bug where SYSTEM_TRUSTED and SECONDARY_TRUSTED were always ↵fraser2018-06-291-2/+2
| | | | parsed as true
* layer.conf: add LAYERSERIES_COMPATTrevor Woerner2018-05-261-0/+2
| | | | | | see https://patchwork.openembedded.org/patch/140542/ Signed-off-by: Trevor Woerner <twoerner@gmail.com>
* meta-integrity, meta-signing-key: Populate the secondary keyringTom Rini2018-05-171-2/+11
| | | | | | | | | | | | Currently we provide a secondary trusted key that is signed by the primary key. We do not however DER encode this certificate. Update the key-store recipe to also make a DER encoding of this certificate and include it in the same package as the PEM version of the certificate. In the IMA init script, if we have any secondary certificate in a DER encoding, load them into the secondary keyring before we try and load the IMA keys. Signed-off-by: Tom Rini <trini@konsulko.com>
* meta-signing-key: Rename "extra trusted" to "secondary"Tom Rini2018-05-176-39/+39
| | | | | | | | | | | | The way that the create-user-key-store.sh script creates what it has been calling "extra_system_trusted_key" is really what would be considered a "secondary" trusted key as it is signed by the primary key that we create. To make this clearer, as there are other cases for an "extra trusted system key" that are not this key, update the variables, package names, etc, to reflect "secondary" not "extra system". Requested-by: Jia Zhang <zhang.jia@linux.alibaba.com> Signed-off-by: Tom Rini <trini@konsulko.com>
* key-store: Fix typo in key-store-ima-privkey nameTom Rini2018-05-121-1/+1
| | | | | | | | We're missing a leading '-' when we combine pn and ima-privkey here, add. Signed-off-by: Michael Grigorov <michael.grigorov@konsulko.com> Signed-off-by: Tom Rini <trini@konsulko.com>
* meta-signing-key: support to build key-store with modsign and extra system ↵Jia Zhang2017-11-213-6/+120
| | | | | | trusted key support Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* scripts/create-user-key-store.sh: support to generate the user keys for ↵Jia Zhang2017-11-211-0/+26
| | | | | | modsign and extra system trusted key Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* meta-signing-key: add the sample keys for modsign and extra system trusted keyJia Zhang2017-11-214-0/+94
| | | | Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
* meta-signing-key, meta-efi-secure-boot: Rework for dependenciesTom Rini2017-11-1611-1/+550
| | | | | | | | | | | | The content of meta-signing-key depends on a few recipes within meta-efi-secure-boot. However, meta-signing-key can be used without meta-efi-secure-boot if we move libsign and sbsigntool over. Doing this will also provide a more correct set of dependencies as we cannot say that both layers depend on eachother. While doing this, within meta-signing-key only depend on content from meta-efi-secure-boot if the efi-secure-boot DISTRO_FEATURE is set. Signed-off-by: Tom Rini <trini@konsulko.com>
* user-key-store.bbclass: add deploy_rpm_keys (#20)Wenzong Fan2017-09-251-0/+10
| | | | | | Fix warning: WARNING: xxx do_sign: Function deploy_rpm_keys doesn't exist Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
* meta-secure-core: clean up ${COREBASE}/LICENSE and ${COREBASE}/meta/COPYING.MITJia Zhang2017-09-021-1/+1
| | | | | | | | ${COREBASE}/LICENSE is not a valid license file. So it is recommended to use '${COMMON_LICENSE_DIR}/MIT' for a MIT License file in LIC_FILES_CHKSUM. This will become an error in the future. Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* Update BB_HASHBASE_WHITELISTJia Zhang2017-09-011-3/+7
| | | | Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* create-user-key-store.sh: Add arguments to specify gpg's key name and email ↵yunguowei2017-08-281-1/+27
| | | | | address (#14) Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
* key-store: Fix two key-store-rpm-pubkey user key issues (#13)Guojian2017-08-241-5/+5
| | | | | | | | | | 1. user key pub rpm package also could be created. 2. The latest bitbake could not support the d.getVar() function nest call. Such as the following function call always return "None" d.getVar(d.getVar('RPM_KEY_DIR', True) + '/RPM-GPG-KEY-*', True) It caused the key-store-rpm-pubkey rpm package could not be created in the latest oe-core project. Signed-off-by: Guojian Zhou <guojian.zhou@windriver.com>
* meta-signing-key: replace the sample RPM signing keyJia Zhang2017-08-232-44/+83
| | | | | | The previous cannot be handled by gpg v2 properly when importing it. Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* Fix the user rpm sign key can not be found issue (#5)Guojian2017-08-221-4/+0
| | | | | | | | When the SIGNING_MODEL is set to "user", the signing-keys recipes will run failed on the get_public_keys task. uks_rpm_keys_dir() function could not return the right rpm_keys directory when the SIGNING_MODEL is set to "user". Signed-off-by: Guojian Zhou <guojian.zhou@windriver.com>
* create-user-key-store.sh: support gpg 2.x used to generate rpm signing keyJia Zhang2017-08-201-18/+26
| | | | Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* sign_rpm_ext.bbclass: use the default setting from meta-signing-keyJia Zhang2017-08-191-2/+2
| | | | Signed-off-by: Jia Zhang <lans.zhang2008@gmail.com>
* sign_rpm_ext: support RPM signingLans Zhang2017-08-173-2/+68
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* meta-signing-key: clean up the default values of sample RPM signing keyLans Zhang2017-08-151-1/+2
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* meta-signing-key: renew the sample keys for UEFI Secure BootLans Zhang2017-08-146-127/+129
| | | | | | The DB and KEK now are self-signed. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* create-user-key-store.sh: gpg key creation updatesLans Zhang2017-08-112-20/+34
| | | | | | | | - code style fixup - remove gen_rpm_keyring script - check gpg version Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* create-user-key-store.sh: self-sign KEK and DBLans Zhang2017-08-011-2/+2
| | | | | | | UEFI spec never ask for the fact that KEK must be signed by PK and DB must be signed by KEK. Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* meta-secure-core: code style fixupLans Zhang2017-07-281-1/+1
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
* user-key-store.bbclass: set SYSTEM_TRUSTED only if ima is configuredLans Zhang2017-07-251-1/+1
| | | | Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 03:31:06 +0000