summaryrefslogtreecommitdiffstats
path: root/meta-tpm
Commit message (Collapse)AuthorAgeFilesLines
* libhoth: update to latestScott Murray5 days3-2/+196
| | | | | | | | | | | Update libhoth SRCREV to its latest commit, and add patches to fix gcc 15 and build dependency issues. Since the last update was so long ago, the changelog is longer than seems reasonable to include here, please refer to: https://github.com/google/libhoth/commits/main/?since=2024-01-16&until=2025-07-03 Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* Adapt to S/UNPACKDIR changesScott Murray5 days12-21/+1
| | | | | | | Remove or update S definitions as required to work with oe-core S/UNPACKDIR changes. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* layer.conf: Update to whinlatter (5.3) releaseScott Murray5 days1-1/+1
| | | | | | | | Update LAYERSERIES_COMPAT in all layer.conf files with the exception of meta-parsec to whinlatter. For meta-parsec, whinlatter has been added, and the EOL releases removed, as an initial update. Signed-off-by: Scott Murray <scott.murray@konsulko.com>
* Update maintainersScott Murray12 days2-16/+18
| | | | | | | | | | | Add Marta and myself as maintainers for meta-security and the other embedded layers that Armin had been maintaining. To avoid Armin getting bugged about individual recipes, set the RECIPE_MAINTAINER variables to myself for now as a starting point that can be adjusted as things get more settled. Signed-off-by: Scott Murray <scott.murray@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Remove self as MaintainerArmin Kuster2025-06-231-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* systemd: fix empty file list with sedMikko Rapeli2025-06-231-2/+5
| | | | | | | | | If measured-uki support is not enabled or build is continuing from previous stages, then the matching file list can be empty. Fixes build failure where sed says no input files. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* recipes: fix whitespace warningsMax Krummenacher2025-06-233-4/+4
| | | | | | | | | | | | | | | Since OE bitbake commit 24772dd2ae6c ("parse/ConfHandler: Add warning for deprecated whitespace usage"), the current build generates the following warning (as example): | WARNING: ...meta-security/meta-tpm/recipes-core/systemd/systemd-boot_%.bbappend:7 | has a lack of whitespace around the assignment: | 'EXTRA_OEMESON:append= " ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', '-Dtpm2=true', '', d)} "' Fix all the warnings. Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-pkcs11: Add tools python runtime dependencieswalnascarOmri Sarig2025-04-131-1/+1
| | | | | | | | | | | | | | | | | | The tpm2-pkcs11-tools python module is importing several modules which are not currently included in it's dependencies. This causes the script invocation to fail. The current commit adds the relevant dependencies, to ensure that the python module is always able to run. The relevant dependencies are: * python3-fcntl: To add the fcntl module, imported in db.py. * python3-sqlite3: To add the sqlite3 module, imported in db.py. * python3-tpm2-pytss: To add the tpm2_pytss module, imported in utils.py. * python3-compression: To add the zipfile module, imported through "importlib.metadata import distribution" in tpm2_ptool. Signed-off-by: Omri Sarig <omri.sarig13@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-pytss: Add python3-asn1crypto runtime dependencyOmri Sarig2025-04-131-1/+1
| | | | | | | | | | | | | The tpm2-pytss module is importing the module asn1crypto in tsskey.py, however, the current bitbake recipe is not including this python package as runtime dependency. This causes the module invocation to fail at the moment. The commit adds this dependency to the bitbake recipe, to make the recipe self contained. Signed-off-by: Omri Sarig <omri.sarig13@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* pcr-extend: fix config errorArmin Kuster2025-04-131-0/+2
| | | | | | | | | Skip configure step to fix this error: pcr-extend-0.1+git-r0 do_configure: no configure script found at ../git/configure There is no configure for this package. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss-engine: add .so symmlink to engines packageAdrian Freihofer2025-04-131-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | Without the symlink, the engine is not found by openssl: openssl engine -t -c tpm2tss 20F0C5BDFFFF0000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:/usr/src/debug/openssl/3.2.4/crypto/dso/dso_dlfcn.c:118: filename(/usr/lib/engines-3/tpm2tss.so): /usr/lib/engines-3/tpm2tss.so: cannot open shared object file: No such file or directory ... With sym-link it works (also without extra configuration for openssl) cd /usr/lib/engines-3/ ln -s libtpm2tss.so tpm2tss.so openssl engine -t -c tpm2tss (tpm2tss) TPM2-TSS engine for OpenSSL [RSA, RAND] [ available ] For exmample also the Fedora package has the symlink. Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-openssl: update to 1.3.0Michael Haener2025-04-131-2/+2
| | | | | Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: update from 0.8.2 to 0.10.0Mikko Rapeli2024-12-271-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Improves error reporting among other things. Changes: https://github.com/stefanberger/swtpm/releases/tag/v0.10.0 version 0.10.0: swtpm: Requires libtpms v0.10.0 Display tpmstate-opt-lock as a new capability Add support for lock option parameter to tpmstate option nvstore_linear: Add support for file-backend locking Remove broken logic to check for neither dir nor file backend Use ptm_cap_n to build PTM_GET_CAPABILITY response Define a structure to return PTM_GET_CAPABILITY result Implement --print-info to run TPMLIB_GetInfo with flags Support --profile fd= to read profile from file descriptor Support --profile file= to read profile from file Ignore remove-disabled parameter on non-'custom' profile Check for good entropy source in chroot environment Implement a check for HMAC+sha1 for testing future restriction Implement function to check whether a crypto algorithm is disabled Print cmdarg-print-profiles as part of capabilities Check whether SHA1 signature support is disabled in profile Use TPMLIB_WasManufactured to check whether profile was applied Determine whether OpenSSL needs to be configured (FIPs, SHA1 signature) Add support for --print-profiles option Print profile names as part of capabilities JSON Display new capability to allow setting a profile Add support for --profile option to set a profile on TPM 2 swtpm_setup: Comment flags for storage primary key and deprecate --create-spk Implement --print-profiles to display all profile Add profile entries to swtpm_setup.conf written by swtpm_setup Add support for --profile-name option Accept profiles with name starting with 'custom:' Support default profile from file in swtpm_setup.conf Support --profile-file-fd to read profile from file descriptor Support --profile-file to read profile from file Always log the active profile Implement --profile-remove-fips-disabled option Read default profile from swtpm_setup.conf Print profile names as part of capabilities JSON Add support for --profile parameter Get default rsa keysize from setup_setup.conf if not given swtpm_ioctl: Use ptm_cap_n for non-CUSE PTM_GET_CAPABILITY response selinux: Change write to append for appending to log Add rule for logging to svirt_image_t labeled files from swtpm_t tests: Update IBMTSS2 test suite to v2.4.0 Test activation of PCR banks when not all are available Enable SWTPM_TEST_PROFILE for running test_tpm2_ibmtss2 with profile Add a check for OPENSSL_ENABLE_SHA1_SIGNATURES in log file Consolidate custom profile test cases and check for StateFormatLevel Convert test_samples_create_tpmca to run installed Mention test_tpm2_libtpms_versions_profiles requiring env. variables allow running ibmtss2 tests against installed version Derive support for CUSE from SWTPM_EXE help screen Set OPENSSL_ENABLE_SHA1_SIGNATURES=1 for IBMTSS2 test Extend test case testing across libtpms versions Add test case for testing profiles across libtpms versions Test the --profile option of swtpm_setup and swtpm teach them to run installed add installed-runner.sh install tests on the system lookup system binaries if INSTALLED is set build-sys: enable 64-bit file API on 32-bit systems Add -Wshadow to the CFLAGS Require that libtpms v0.10 is available for TPMLIB_SetProfile debian: Add rule to allow usage of /var/tmp directory (QEMU) Add rules for reading profiles from distro and local dirs Allow non-owner file write access in /var/lib/libvirt/swtpm/ Add sys_admin capability to apparmor profile https://github.com/stefanberger/swtpm/releases/tag/v0.9.0 version 0.9.0: Note: The SElinux policy for swtpm was completely redone. For systems with an SELinux policy the same policy (>= 40.17) as used in Fedora >= 40 is required due to changes in labels related to libvirt that made the re-development of the SELinux policy necessary. swtpm: Use umask() to create/truncated state file rather than fchmod() Use fchmod to set mode bits provided by user Replace mkstemp with g_mkstemp_full (Coverity) fix typo in help message cuse: Fix Coverity complaints regarding locks Fix double free in error path Close fd after main loop Restore logging to stderr on log open failure swtpm_setup: Fail --pcr-banks without --tpm2 Fail --decryption or --allow-signing without --tpm2 Initialized argv in get_swtpm_capabilities() Flush spk after persisting to create room for another key Refactor duplicate code into swtpm_tpm2_write_cert_nvram Move persisting of certificate into tpm2_persist_certificate Pass key_type to function creating filename for key Add scheme parameter before curveid to createprimary_ecc Rename is_ek to preserve for future extension Mask-out EK and plaform certificate flags and set cert_flags Move common code into new function read_certificate_file() Exit with '0' upon --version rather than '1' Close file descriptors passed to swtpm process on parent side Make stdout unbuffered Use medium duration on TSC_PhysicalPresence to avoid timeouts Add poll() after write() and before read() to detect errors swtpm_localca: Add support for up to 20 bytes serial numbers Introduce --key as more generic alias for --ek Add missing NULL option to end of array Make stdout unbuffered swtpm_cert: Add support for serial numbers up to 20 bytes long swtpm_ioctl: Separate return code from flags Repeatedly call PTM_GET_INFO for long responses selinux: Re-add rule for svirt_tcg_t and user_tmp_t:sock_file (virt-install) New SELinux policy that requires Fedora 40 or later tests: Fixed occurrences of stray '' before '-' Rearrange order of test cases to run some also as 'root' Add tests for command line options and combinations of options Add softhsm_setup to shellcheck'ed files and fix issues Add missing 'exit 1' on unexpected file size on --reconfigure Add test cases for swtpm_cert with max serial number Fix spelling mistakes reformat regexs for easier readability and extension ibmtss2: Add patch to disable x509 test with older libtpms Upgrade to ibmtss2 v2.0.1 Fixed several issues detected by shellcheck build-sys: Add support for --disable-tests to disable tests Display GMP_LIBS and GMP_CFLAGS Only display warning if pkg-config for gmp fails Add gmp library and devel package as dependency use PKG_CHECK_MODULES to check libtpms version rpm: Add gmp library and devel package as dependency Split off SELinux files to build an selinux package debian: Sync AppArmor profile with what is used by Ubuntu Add gmp library and devel package as dependency Allow apparmor access to qemu session bus swtpm files Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libtpms: set CVE_PRODUCTMikko Rapeli2024-12-271-0/+2
| | | | | | | | | | Using vendor "libtpms_project" and product "libtpms" as in https://nvd.nist.gov/vuln/detail/CVE-2021-3446 Matches CVEs better when analyzing with cve_check.bbclass. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libtpm: rename to libtpmsMikko Rapeli2024-12-273-2/+2
| | | | | | | | Upstream and other distros like Debian use package name libtpms so use this name for recipe too to match CVEs etc. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libtpm: update from 0.9.6 to 0.10.0Mikko Rapeli2024-12-271-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Needed by newer swtpm. Improves error messages etc. Changes: https://github.com/stefanberger/libtpms/releases/tag/v0.10.0 version 0.10.0: tpm2: Support for profiles: default-v1 & custom tpm2: Add new API call TPMLIB_SetProfile to enable user to set a profile tpm2: Extende TPMLIB_GetInfo to return profiles-related info tpm2: Implemented crypto tests and restrictions on crypto related to FIPS-140-3; can be enabled with profiles tpm2: Enable Camellia-192 and AES-192 tpm2: Implement TPMLIB_WasManufactured API call tpm2: Fixes for issues detected by static analyzers tpm2: Use OpenSSL-based KDFe implementation if possible tpm2: Update to TPM 2 spec rev 183 (many changes) tpm2: Better support for OpenSSL 3.x tpm2: Use Carmichael function for RSA priv. exponent D (>= 2048 bits) tpm2: Fixes for CVE-2023-1017 and CVE-2023-1018 tpm2: Fix of SignedCompareB(). NOTE: This fix may result in backwards compatibility issues with PCR policies used by TPM2_PolicyCounterTimer and TPM2_PolicyNV when upgrading from v0.9 to v0.10. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* systemd-boot: enable TPM support via "tpm2" in DISTRO_FEATURESMikko Rapeli2024-12-271-0/+7
| | | | | | | systemd-boot will then measure boot components to TPM device. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* systemd: enable TPM supportMikko Rapeli2024-12-271-0/+17
| | | | | | | | | | | | Enable "tpm2" support if "tpm2" is in DISTRO_FEATURES. Also enable cryptsetup, openssl and repart features which are needed to use TPM device to encrypt filesystems with systemd configuration. See: https://www.freedesktop.org/software/systemd/man/latest/systemd-repart.html#--tpm2-device= Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* u-boot: enable TPM support via "tpm2" in MACHINE_FEATURESMikko Rapeli2024-12-271-1/+1
| | | | | | | | "tpm2" is used elsewhere in distro and machine featues to enable TPM device support. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tools: add dependency to efivarMikko Rapeli2024-12-271-1/+1
| | | | | | | | | | | | | | Without this there is a floating dependency which can fall back to build host and possibly fail if header file is found but shared library not. Without this change do_configure log shows: checking for efivar... no checking for efivar/efivar.h... no ../tpm2-tools-5.7/configure: line 15461: efivar: command not found Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* u-boot: tpm: Enable Measured BootJavier Tia2024-11-242-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Measured Boot is the term used to describe the process of securely recording and computing hashes of code and critical data at each stage in the boot chain prior to their use. These measurements can be employed by other system components to establish a comprehensive attestation system. For example, they could be employed to enforce local attestation policies (such as the release of specific platform keys) or to securely transmit them to a remote challenger, also known as a verifier, post-boot to verify the condition of the code and critical data. Measured launch does not authenticate the code or critical data; rather, it records the code or critical data that was present on the system during boot. Initially, the TPM measures the BIOS/EFI layer in the fundamental flow. This measurement involves the generation of a cryptographic hash of the binary image and the verification of the binary instructions that this layer will execute. The TPM stores the generated hash in one of the numerous "slots" in the Platform Configuration Register (PCR). The TPM or entities external to the TPM can read these portions of memory at a later time; however, they are unalterable once they have been written. These memory pieces are protected by integrity protection from the instant they are first written. This guarantees that the value written to a PCR by the TPM will remain constant for the duration of the system, unless the system is powered off or rebooted. Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Javier Tia <javier.tia@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss-engine: update to 1.2.0Armin Kuster2024-11-243-2/+131
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-pkcs11: update to 1.9.1Armin Kuster2024-11-241-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: update to 4.1.3Armin Kuster2024-11-241-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Update to walnascar (5.2) layer/release seriesArmin Kuster2024-11-241-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Update to styhead release name seriesArmin Kuster2024-09-151-1/+1
| | | | | | few more layers to fixup Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-tpm2-pyts: switch to PEP-517 build backendArmin Kuster2024-08-101-1/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tools: Upgrade 5.5 -> 5.7Vijay Anusuri2024-08-061-1/+1
| | | | | | | | | | | | | Include Security fixes: Fixed CVE-2024-29038 Fixed CVE-2024-29039 Changelog: https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7 https://github.com/tpm2-software/tpm2-tools/releases/tag/5.6 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm-tools: fix QA and compile errors.Armin Kuster2024-07-311-1/+5
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-tpm2-pytss: update from 2.1.0 to 2.3.0Mikko Rapeli2024-07-291-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upstream changlog shows that python 3.12 support was added/fixed in version 2.2.0: https://github.com/tpm2-software/tpm2-pytss/blob/master/CHANGELOG.md To fix build error: | DEBUG: Executing python function autotools_aclocals | DEBUG: SITE files ['endian-little', 'bit-64', 'arm-common', 'arm-64', 'common-linux', 'common-glibc', 'aarch64-linux', 'common'] | DEBUG: Python function autotools_aclocals finished | DEBUG: Executing shell function do_compile | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/setuptools/__init__.py:80: _DeprecatedInstaller: setuptools.installer and fetch_build_eggs are deprecated. | !! | | ******************************************************************************** | Requirements should be satisfied by a PEP 517 installer. | If you are using pip, you can try `pip install --use-pep517`. | ******************************************************************************** | | !! | dist.fetch_build_eggs(dist.setup_requires) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:27: SyntaxWarning: invalid escape sequence '\(' | s = re.sub("#define TSS2_RC_LAYER\(level\).*", "", s) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:28: SyntaxWarning: invalid escape sequence '\(' | s = re.sub("(#define.*)TSS2_RC_LAYER\(0xff\)", "\g<1>0xff0000", s) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:28: SyntaxWarning: invalid escape sequence '\g' | s = re.sub("(#define.*)TSS2_RC_LAYER\(0xff\)", "\g<1>0xff0000", s) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:31: SyntaxWarning: invalid escape sequence '\*' | s = re.sub("/\*.*?\*/", "", s, flags=re.MULTILINE) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:34: SyntaxWarning: invalid escape sequence '\(' | s = re.sub("(#define [A-Za-z0-9_]+) +\(\(.*?\) \(.*?\)\)", "\g<1>...", s) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:34: SyntaxWarning: invalid escape sequence '\g' | s = re.sub("(#define [A-Za-z0-9_]+) +\(\(.*?\) \(.*?\)\)", "\g<1>...", s) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:35: SyntaxWarning: invalid escape sequence '\(' | s = re.sub("(#define [A-Za-z0-9_]+) +\(\(.*?\).*?\) ", "\g<1>...", s) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:35: SyntaxWarning: invalid escape sequence '\g' | s = re.sub("(#define [A-Za-z0-9_]+) +\(\(.*?\).*?\) ", "\g<1>...", s) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:37: SyntaxWarning: invalid escape sequence '\)' | "(#define [A-Za-z0-9_]+) .*\n.*?.*\)\)", "\g<1>...", s, flags=re.MULTILINE | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:37: SyntaxWarning: invalid escape sequence '\g' | "(#define [A-Za-z0-9_]+) .*\n.*?.*\)\)", "\g<1>...", s, flags=re.MULTILINE | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:39: SyntaxWarning: invalid escape sequence '\g' | s = re.sub("(#define [A-Za-z0-9_]+) .*", "\g<1>...", s) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:42: SyntaxWarning: invalid escape sequence '\[' | s = re.sub("\[.+?\]", "[...]", s) | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:77: SyntaxWarning: invalid escape sequence '\)' | "#define TPM2_MAX_TAGGED_POLICIES.*\n.*TPMS_TAGGED_POLICY\)\)", | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:262: SyntaxWarning: invalid escape sequence '\s' | "TSS2_RC\s+Tss2_MU_BYTE_Marshal\(.+?\);", s, re.DOTALL | re.MULTILINE | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:266: SyntaxWarning: invalid escape sequence '\s' | "TSS2_RC\s+Tss2_MU_BYTE_Marshal\(.+?\);", "", s, 1, re.DOTALL | re.MULTILINE | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:270: SyntaxWarning: invalid escape sequence '\s' | "TSS2_RC\s+Tss2_MU_BYTE_Unmarshal\(.+?\);", s, re.DOTALL | re.MULTILINE | /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts/prepare_headers.py:274: SyntaxWarning: invalid escape sequence '\s' | "TSS2_RC\s+Tss2_MU_BYTE_Unmarshal\(.+?\);", | adding path: /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/scripts | Traceback (most recent call last): | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/tpm2-pytss-2.1.0/setup.py", line 280, in <module> | setup( | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/setuptools/__init__.py", line 103, in setup | return distutils.core.setup(**attrs) | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/setuptools/_distutils/core.py", line 146, in setup | _setup_distribution = dist = klass(attrs) | ^^^^^^^^^^^^ | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/setuptools/dist.py", line 307, in __init__ | _Distribution.__init__(self, dist_attrs) | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/setuptools/_distutils/dist.py", line 286, in __init__ | self.finalize_options() | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/setuptools/dist.py", line 659, in finalize_options | ep(self) | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/setuptools/dist.py", line 679, in _finalize_setup_keywords | ep.load()(self, ep.name, value) | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/cffi/setuptools_ext.py", line 216, in cffi_modules | add_cffi_module(dist, cffi_module) | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/cffi/setuptools_ext.py", line 49, in add_cffi_module | execfile(build_file_name, mod_vars) | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/cffi/setuptools_ext.py", line 25, in execfile | exec(code, glob, glob) | File "scripts/libtss2_build.py", line 69, in <module> | ffibuilder.cdef(open("libesys.h").read()) | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/cffi/api.py", line 112, in cdef | self._cdef(csource, override=override, packed=packed, pack=pack) | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/cffi/api.py", line 126, in _cdef | self._parser.parse(csource, override=override, **options) | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/cffi/cparser.py", line 389, in parse | self._internal_parse(csource) | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/cffi/cparser.py", line 396, in _internal_parse | self._process_macros(macros) | File "/home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/recipe-sysroot-native/usr/lib/python3.12/site-packages/cffi/cparser.py", line 479, in _process_macros | raise CDefError( | cffi.CDefError: only supports one of the following syntax: | #define TPM2_HR_PCR ... (literally dot-dot-dot) | #define TPM2_HR_PCR NUMBER (with NUMBER an integer constant, decimal/hex/octal) | got: | #define TPM2_HR_PCR ...<< TPM2_HR_SHIFT) | ERROR: 'python3 setup.py build ' execution failed. | WARNING: /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/temp/run.do_compile.2430604:190 exit 1 from 'exit 1' | WARNING: Backtrace (BB generated script): | #1: bbfatal_log, /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/temp/run.do_compile.2430604, line 190 | #2: setuptools3_legacy_do_compile, /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/temp/run.do_compile.2430604, line 180 | #3: do_compile, /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/temp/run.do_compile.2430604, line 162 | #4: main, /home/builder/src/base/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/python3-tpm2-pytss/2.1.0/temp/run.do_compile.2430604, line 194 NOTE: recipe python3-tpm2-pytss-2.1.0-r0: task do_compile: Failed ERROR: Task (/home/builder/src/base/build/../meta-security/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_2.1.0.bb:do_compile) failed with exit code '1' Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* trousers: Start WORKDIR -> UNPACKDIR transitionWang Mingyu2024-07-291-3/+3
| | | | | | | Replace references of WORKDIR with UNPACKDIR where it makes sense to do so in preparation for changing the default value of UNPACKDIR. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: drop libgcryptRicardo Salveti2024-07-011-3/+1
| | | | | | | | | Upstream removed gcrypt backend as part of the 3.0.0 release (https://github.com/tpm2-software/tpm2-tss/pull/1781), but it was not removed from the recipe during the update. Signed-off-by: Ricardo Salveti <ricardo@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* recipes: WORKDIR -> UNPACKDIR transitionChangqing Li2024-06-171-2/+2
| | | | | | | | | * WORKDIR -> UNPACKDIR transition * Switch away from S = WORKDIR Signed-off-by: Changqing Li <changqing.li@windriver.com> [Fixed up the smack changes due to prior patch] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: upgrade 4.0.1 -> 4.1.2Valentin Kunin2024-06-172-8/+19
| | | | | | | | | | | | | | Bump tpm2-tss library version from 4.0.1 to 4.1.2. This simply involves renaming the recipe and chaning the target SHA256 library file hash. Also update the fixup_hosttools.patch to apply to the new version of the library. It stays the same functionally, but some line numbers needed to be updated to apply cleanly. Signed-off-by: Valentin Kunin <kunin@google.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: BBCLASSEXTEND nativesdkTim Orling2024-05-081-1/+1
| | | | | | | Dependency for nativesdk-swtpm Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libtpm: BBCLASSEXTEND nativesdkTim Orling2024-05-081-1/+1
| | | | | | | nativesdk-swtpm needs nativesdk-libtpm Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tools: BBCLASSEXTEND native and nativesdkTim Orling2024-05-081-0/+2
| | | | | | | tpm2-pkcs11-tools-native needs tpm2-tools-native Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-pkcs11: BBCLASSEXTEND native and nativesdkTim Orling2024-05-081-0/+2
| | | | | | | swtpm-native requires tpm2-pkcs11-tools-native for gnutls PACKAGECONFIG Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: upgrade 0.8.1 -> 0.8.2Tim Orling2024-05-081-1/+1
| | | | | | | | | | | | | version 0.8.2: - swtpm: - cuse: Lock file_ops_lock before reading tpm_running - build-sys: - Add support for --disable-tests to disable tests https://github.com/stefanberger/swtpm/compare/v0.8.1...v0.8.2 Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ibmtpm2tss: upgrade 1661 -> 2.2.0Yi Zhao2024-04-222-19/+21
| | | | | | | | * Refresh patch * Fix UPSTREAM_CHECK_GITTAGREGEX Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ibmswtpm2: upgrade 164-2020-192.1 -> 183-2024-03-27Yi Zhao2024-04-161-3/+3
| | | | | | | | | | Remove '-DALG_CAMELLIA=ALG_NO' from CFLAGS to fix compile error: | TpmProfile_Common.h:109: error: "ALG_CAMELLIA" redefined [-Werror] | 109 | #define ALG_CAMELLIA ALG_YES | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* README.md: update to new patches mailing listArmin Kuster2024-04-091-3/+3
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Update for the scarthgap release seriesMax Krummenacher2024-03-271-1/+1
| | | | | Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-security: Drop ${PYTHON_PN}Armin Kuster2024-03-271-3/+3
| | | | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> --- V2] Fix typo in python3-pyinotify changes
* meta-security: libhoth: SRCREV bump e520f8f...e482716Yushi Sun2024-01-281-1/+1
| | | | | | | | | | | | | | | | | Nicholas Nooney (1): Update error messages in htool_exec_hostcmd (#43) Royce (1): Add ability to process raw host commands (#41) Yoan Andreev (1): Payload getstatus (#40) daimeng (1): htool: Allow console snapshot on proxy channels (#42) Signed-off-by: Yushi Sun <yushis@google.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: support native buildsMikko Rapeli2023-12-291-0/+2
| | | | | | | | | | | | | | systemd tool ukify https://www.freedesktop.org/software/systemd/man/latest/ukify.html depends on systemd-measure https://www.freedesktop.org/software/systemd/man/latest/systemd-measure.html which depends on tpm2-tss. So to support creating UKI images containing both kernel and initramfs with systemd-native, tpm2-tss support is needed for native too. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Reviewed-by: Erik Schilling <erik.schilling@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layers: Move READMEs to markdown formatArmin Kuster2023-12-291-0/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libhoth recipe updateDawid Dabrowski2023-12-291-1/+1
| | | | | | | | | | | | Changelog: Dawid Dabrowski Add support for payload update protocol for generic Titan images. Nick Nooney Add BUILD rules to support using libhoth with external tools. Yoan Andreev Add spi passthrough enable and disable commands. Add arm_coordinated_reset. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libhoth: UpdateJohn Broadbent2023-09-251-1/+1
| | | | | | | | | | | | | | | | | | | | Changelog: Royce Rajan 0e3eec6 Claim + Release USB connection when running `htool console` b36ebfc bazel: Stamp Git commit as version fd90feb meson: Stamp Git commit as version ba1403d Add get/clear panic record commands (#30) Chris Evans e34e9bd Update README.md for recently-added commands. Daimeng Wang 611381e htool: Implement authz_record read/erase/build/set aaed60f htool: Add authz_record command API ad68019 libhoth: MTD allows zero byte read Pai Peng 101f711 Add the 'statistics' command Signed-off-by: John Broadbent <jebr@google.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: update 0.8.1Armin Kuster2023-09-251-3/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-09 22:29:40 +0000