Mirror of git.openembedded.org/meta-openembedded https://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=styhead 2024-03-05T23:09:24+00:00 2024-03-05T23:09:24+00:00 Ulrich Ölmann u.oelmann@pengutronix.de 2024-03-05T20:07:53+00:00 urn:sha1:123c58693ac786c3cef8a74b03c1557a66dc0142 Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2024-02-23T17:17:42+00:00 Sascha Hauer sha@pengutronix.de 2024-02-23T08:45:44+00:00 urn:sha1:30d1eb08b42e9eeb76037fdc8613610878ba1092 The function signing_import_pubkey_from_pem is defined twice, one of them should really be named signing_import_pubkey_from_der. Fix this and while at it fix some argument names in the comments above the functions as well. Reported-by: Miklos Toth <Miklos.Toth@knorr-bremse.com> Fixes: 4a6ac691f ("add signing.bbclass as infrastructure for build artifact signing") Signed-off-by: Sascha Hauer <sha@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2024-02-13T20:41:23+00:00 Sascha Hauer s.hauer@pengutronix.de 2024-02-13T09:18:12+00:00 urn:sha1:c9ddb71d35c68ba58f5318a5bcc504a2ee1026a9 "openssl rsa" works with RSA keys only. Use "openssl pkey" instead which is a frontend that picks the right operation automatically and works with RSA keys, eliptic curve keys and also DSA keys. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2023-10-09T16:38:49+00:00 Ahmad Fatoum a.fatoum@pengutronix.de 2023-09-20T14:33:41+00:00 urn:sha1:4ad790c7334b02d6d150285a952d84a02645773f OPENSSL_{MODULES,ENGINES,CONF} and SSL_CERT_{DIR,FILE} are currently exported globally for any recipe that inherits signing. This not only affects the tasks that use the signing infrastructure, but also unrelated tasks like e.g. do_fetch. Avoid this by exporting the variables only for these tasks that actually call signing_prepare. This resolves a breakage I observed on Ubuntu 18.04, where the host tool wget is called with the environment variables set and then fails with a SSL error (exit code 5). Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2023-02-15T16:23:49+00:00 Jan Luebbe jlu@pengutronix.de 2023-02-13T11:20:37+00:00 urn:sha1:4a6ac691f209204434da38fd271a91455391e728 This adds common infrastructure to access and used asymmetric keys to sign build artifacts. The approach and implementation was presented at the recent OpenEmbedded Workshop: https://pretalx.com/openembedded-workshop-2023/talk/3C8MFF/ A working demo setup for verified boot based on qemu is available at https://github.com/jluebbe/meta-code-signing. Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>