From 60319a78dcb8cc83811f06c9ccbf3442b35de070 Mon Sep 17 00:00:00 2001 From: Usama Arif Date: Thu, 1 Oct 2020 10:27:13 +0100 Subject: ref-manual: document authentication key variables This documents the variables used to create keys for signing fitImage. (From yocto-docs rev: 7d0407249907259b59191e3759a3b140d30d993e) Signed-off-by: Usama Arif Signed-off-by: Richard Purdie --- documentation/ref-manual/ref-classes.rst | 4 +++- documentation/ref-manual/ref-variables.rst | 23 +++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) (limited to 'documentation') diff --git a/documentation/ref-manual/ref-classes.rst b/documentation/ref-manual/ref-classes.rst index 60ce8efd21..b007e34826 100644 --- a/documentation/ref-manual/ref-classes.rst +++ b/documentation/ref-manual/ref-classes.rst @@ -1413,7 +1413,9 @@ variables :term:`UBOOT_SIGN_ENABLE`, :term:`UBOOT_MKIMAGE_DTCOPTS`, :term:`UBOOT_SIGN_KEYDIR` and :term:`UBOOT_SIGN_KEYNAME` are set appropriately. The default values used for :term:`FIT_HASH_ALG` and :term:`FIT_SIGN_ALG` in ``kernel-fitimage`` are "sha256" and -"rsa2048" respectively. +"rsa2048" respectively. The keys for signing fitImage can be generated using +the ``kernel-fitimage`` class when both :term:`FIT_GENERATE_KEYS` and +:term:`UBOOT_SIGN_ENABLE` are set to "1". .. _ref-classes-kernel-grub: diff --git a/documentation/ref-manual/ref-variables.rst b/documentation/ref-manual/ref-variables.rst index cf37703814..2d6719df11 100644 --- a/documentation/ref-manual/ref-variables.rst +++ b/documentation/ref-manual/ref-variables.rst @@ -2585,13 +2585,36 @@ system and gives an overview of their function and contents. For guidance on how to create your own file permissions settings table file, examine the existing ``fs-perms.txt``. + FIT_GENERATE_KEYS + Decides whether to generate the keys for signing fitImage if they + don't already exist. The keys are created in ``UBOOT_SIGN_KEYDIR``. + The default value is 0. + FIT_HASH_ALG Specifies the hash algorithm used in creating the FIT Image. For e.g. sha256. + FIT_KEY_GENRSA_ARGS + Arguments to openssl genrsa for generating RSA private key for signing + fitImage. The default value is "-F4". i.e. the public exponent 65537 to + use. + + FIT_KEY_REQ_ARGS + Arguments to openssl req for generating certificate for signing fitImage. + The default value is "-batch -new". batch for non interactive mode + and new for generating new keys. + + FIT_KEY_SIGN_PKCS + Format for public key ceritifcate used in signing fitImage. + The default value is "x509". + FIT_SIGN_ALG Specifies the signature algorithm used in creating the FIT Image. For e.g. rsa2048. + FIT_SIGN_NUMBITS + Size of private key in number of bits used in fitImage. The default + value is "2048". + FONT_EXTRA_RDEPENDS When inheriting the :ref:`fontcache ` class, this variable specifies the runtime dependencies for font packages. -- cgit v1.2.3-54-g00ecf