linux/meta-secure-core.git, branch sumo

Updated the URI for Jeremy Kerr's sbsigntools

2022-02-09T00:58:58+00:00

Jeremy Kerr's sbsigntools are no longer hosted on git://kernel.ubuntu.com/jk/sbsigntool. A copy exists at git://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools. This change is required to build meta-secure-core under sumo.

Update git source URL because of 404 error.

2021-11-22T09:19:37+00:00

Signed-off-by: tomita

initrdscripts-secure-core: remove /sys and /proc from package

2021-11-22T09:19:37+00:00

The following failure is shown during secure-core-image-initramfs:do_rootfs(): Error: Transaction check error: file /proc conflicts between attempted installs of initrdscripts-secure-core-1.0-r0.corei7_64 and base-files-3.0.14-r89.intel_x86_64 file /sys conflicts between attempted installs of initrdscripts-secure-core-1.0-r0.corei7_64 and base-files-3.0.14-r89.intel_x86_64 So remove /sys and /proc as base-files has already provided them. Signed-off-by: tomita

base-files: only apply the bbappend if ima distro flag set

2018-12-08T01:42:55+00:00

When the meta-integrity layer is included but feature ima is not set, we would get the following error when the system startup: qemux86-64 systemd-remount-fs[81]: mount: /sys/kernel/security: mount point does not exist. qemux86-64 systemd-remount-fs[81]: /bin/mount for /sys/kernel/security exited with exit status 32. Rename base-files_%.bbappend to base-files-integrity.inc and add a new bbappend. Make sure this piece of code should be applied only if the ima feature is set. Signed-off-by: Yi Zhao

kernel-initramfs: only apply the bbappend if efi-secure-boot distro flag set

2018-12-08T01:42:55+00:00

When the meta-efi-secure-boot layer is included but feature efi-secure-boot is not set. We got the following error with kernel-initramfs building: ERROR: kernel-initramfs-1.0-r0 do_deploy: Function failed: do_deploy (log file is located at /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995) ERROR: Logfile of failure stored in: /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995 Log data follows: | DEBUG: Executing python function sstate_task_prefunc | DEBUG: Python function sstate_task_prefunc finished | DEBUG: Executing shell function do_deploy | install: cannot stat '/buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/image/boot/*.p7b': No such file or directory | WARNING: /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/run.do_deploy.16995:1 exit 1 from 'install -m 0644 ${SIG} /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/deploy-kernel-initramfs' | ERROR: Function failed: do_deploy (log file is located at /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995) ERROR: Task (/buildarea/poky/meta-secure-core/meta/recipes-core/images/kernel-initramfs.bb:do_deploy) failed with exit code '1' Rename kernel-initramfs.bbappend to kernel-initramfs-efi-secure-boot.inc and add a new bbappend. Make sure this piece of code should be applied only if the efi-secure-boot feature is set. Signed-off-by: Yi Zhao

kernel-initramfs: fix inconsistent indentation

2018-12-08T01:42:55+00:00

Use spaces consistently to indent do_install() Signed-off-by: Yi Zhao

meta-efi-secure-boot: Ensure openssl-native exists when we need it

2018-12-08T01:42:55+00:00

In order to deploy our secure boot keys in DER format we need to use openssl. This must be listed in our DEPENDS line in order for the sysroot to be populated correctly when we run do_sign. Also drop the explicit fakeroot on our empty grub-efi do_sign as we may not have globally populated virtual/fakeroot-native at that point in time. Fixes: 92316d4b402b ("meta-signing-key: When deploying keys UEFI keys, deploy DER format") Signed-off-by: Tom Rini

meta-signing-key: When deploying keys UEFI keys, deploy DER format

2018-10-25T15:07:35+00:00

Generally speaking, for firmware to import PK/KEK/DB keys they need to be in the binary "DER" format and typically have the "cer" file extension. When deploying our keys, convert what we have to that format and deploy as well for ease of use. Signed-off-by: Tom Rini

Maintain the stable branch sumo

2018-09-21T06:26:49+00:00

The following commits are reverted by the way: - meta-integrity: rpm: Add back in required patches for rocko (5fa9c85) - meta-intel-sgx: Initial support of linux-sgx-driver (7d4f711) The former is applicable to rocko only, and the latter is still experimental. Signed-off-by: Jia Zhang

libsign: Fix build faiure due to -fstack-protector-strong

2018-09-20T14:41:05+00:00

SECURITY_LDFLAGS includes -fstack-protector-strong which cannot work with CCLD. To work around this issue, filter out it from LDFLAGS. Signed-off-by: Jia Zhang