linux/meta-openembedded.git/meta-oe/classes, branch styhead-next

Add class for appending dm-verity hash data to block device images

2024-04-23T22:18:30+00:00

Add support to generate a dm-verity image and the parameters required to assemble the corresponding table for the device-mapper driver. The latter will be stored in the file ${DEPLOY_DIR_IMAGE}/.verity-params. Note that in the resulting image the hash tree data is appended to the contents of the original image without an explicit superblock to keep things simple and compact. The above mentioned parameter file can be sourced by a shell to finally create the desired blockdevice via "dmsetup" (found in meta-oe's recipe "libdevmapper"), e.g. . .verity-params dmsetup create --readonly --table "0 $VERITY_DATA_SECTORS verity \ 1 \ $VERITY_DATA_BLOCK_SIZE $VERITY_HASH_BLOCK_SIZE \ $VERITY_DATA_BLOCKS $VERITY_DATA_BLOCKS \ $VERITY_HASH_ALGORITHM $VERITY_ROOT_HASH $VERITY_SALT \ 1 ignore_zero_blocks" As the hash tree data is found at the end of the image, and should be the same blockdevice in the command shown above while is the name of the to be created dm-verity-device. The root hash is calculated using a salt to make attacks more difficult. Thus, please grant each image recipe its own salt which could be generated e.g. via dd if=/dev/random bs=1k count=1 | sha256sum and assign it to the parameter VERITY_SALT. Signed-off-by: Jan Luebbe Signed-off-by: Rouven Czerwinski Signed-off-by: Marco Felsch Signed-off-by: Ulrich Ölmann Signed-off-by: Khem Raj

signing.bbclass: fix typos

2024-03-05T23:09:24+00:00

Signed-off-by: Ulrich Ölmann Signed-off-by: Khem Raj

signing.bbclass: fix wrong function name

2024-02-23T17:17:42+00:00

The function signing_import_pubkey_from_pem is defined twice, one of them should really be named signing_import_pubkey_from_der. Fix this and while at it fix some argument names in the comments above the functions as well. Reported-by: Miklos Toth Fixes: 4a6ac691f ("add signing.bbclass as infrastructure for build artifact signing") Signed-off-by: Sascha Hauer Signed-off-by: Khem Raj

signing.bbclass: make it work with eliptic curve keys

2024-02-13T20:41:23+00:00

"openssl rsa" works with RSA keys only. Use "openssl pkey" instead which is a frontend that picks the right operation automatically and works with RSA keys, eliptic curve keys and also DSA keys. Signed-off-by: Sascha Hauer Signed-off-by: Khem Raj

gitpkgv.bbclass: adjust the example in comment a bit

2024-02-09T17:52:12+00:00

* the first example isn't very useful anymore since: SRCPV is deferred now from PV to PKGV since: https://git.openembedded.org/openembedded-core/commit/?h=nanbield&id=a8e7b0f932b9ea69b3a218fca18041676c65aba0 * but keep it in the bbclass in case someone is still using it for whatever reason (the version with tag still makes some sense) Signed-off-by: Martin Jansa

signing.bbclass: don't export OPENSSL environment variables globally

2023-10-09T16:38:49+00:00

OPENSSL_{MODULES,ENGINES,CONF} and SSL_CERT_{DIR,FILE} are currently exported globally for any recipe that inherits signing. This not only affects the tasks that use the signing infrastructure, but also unrelated tasks like e.g. do_fetch. Avoid this by exporting the variables only for these tasks that actually call signing_prepare. This resolves a breakage I observed on Ubuntu 18.04, where the host tool wget is called with the environment variables set and then fails with a SSL error (exit code 5). Signed-off-by: Ahmad Fatoum Signed-off-by: Khem Raj

image_types_sparse: Fix syntax error

2023-08-01T17:26:51+00:00

When using the image type: IMAGE_FSTYPES += " wic.sparse" IMAGE_CLASSES += " image_types_sparse" The following error arises: Syntax error: Bad function name So need to remove function in favor of variable. Also remove IMAGE_NAME_SUFFIX as per: https://git.openembedded.org/openembedded-core/commit/?id=26d97acc71379ab6702fa54a23b6542a3f51779c Signed-off-by: Chris Dimich Signed-off-by: Khem Raj

gitpkgv: Fix python deprecation warning

2023-05-03T23:26:17+00:00

Fixes DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13 pipes is an alias for shlex therefore switch to using shlex Signed-off-by: Khem Raj

add signing.bbclass as infrastructure for build artifact signing

2023-02-15T16:23:49+00:00

This adds common infrastructure to access and used asymmetric keys to sign build artifacts. The approach and implementation was presented at the recent OpenEmbedded Workshop: https://pretalx.com/openembedded-workshop-2023/talk/3C8MFF/ A working demo setup for verified boot based on qemu is available at https://github.com/jluebbe/meta-code-signing. Signed-off-by: Jan Luebbe Signed-off-by: Khem Raj

image_types_sparse: Generate "don't care" chunks

2022-08-13T14:05:31+00:00

By default, img2simg will only generate raw and fill chunks. This adds support for "don't care" chunks, based on file holes. This is similar to how bmaptool works. "don't care" chunks do not need to be written, speeding up flashing time. Signed-off-by: Sean Anderson Signed-off-by: Khem Raj