linux/meta-secure-core.git, branch thud

fix sbsigningtool SRC_URI

2021-08-24T01:19:32+00:00

The SRC_URI git://kernel.ubuntu.com/jk/sbsigntool no longer exists. I've updated the SRC_URI to point to the new location.

Create the stable branch thud

2018-12-11T02:10:50+00:00

And Yi Zhao becomes the maintainer for this branch. Signed-off-by: Jia Zhang

grub-efi: fix the potential uninitialized error for variable 'err'

2018-12-03T07:12:41+00:00

Fix the build errors with DEBUG_BUILD enabled: grub-core/loader/linux.c: In function 'grub_initrd_load': grub-core/loader/linux.c:326:10: error: 'err' may be used \ uninitialized in this function [-Werror=maybe-uninitialized] In function grub_initrd_load: grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, char *argv[], void *target) { [snip] grub_err_t err; [snip] #ifdef GRUB_MACHINE_EFI [snip] err = grub_verify_file (argv[i]); [snip] #endif [snip] fail: [snip] return err; } If the GRUB_MACHINE_EFI is not defined, the function would return an uninitialized value for 'err'. We should initialize it when this variable is assigned. Signed-off-by: Wenzong Fan Signed-off-by: Yi Zhao

base-files: only apply the bbappend if ima distro flag set

2018-12-03T07:12:41+00:00

When the meta-integrity layer is included but feature ima is not set, we would get the following error when the system startup: qemux86-64 systemd-remount-fs[81]: mount: /sys/kernel/security: mount point does not exist. qemux86-64 systemd-remount-fs[81]: /bin/mount for /sys/kernel/security exited with exit status 32. Rename base-files_%.bbappend to base-files-integrity.inc and add a new bbappend. Make sure this piece of code should be applied only if the ima feature is set. Signed-off-by: Yi Zhao

kernel-initramfs: only apply the bbappend if efi-secure-boot distro flag set

2018-11-30T05:46:35+00:00

When the meta-efi-secure-boot layer is included but feature efi-secure-boot is not set. We got the following error with kernel-initramfs building: ERROR: kernel-initramfs-1.0-r0 do_deploy: Function failed: do_deploy (log file is located at /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995) ERROR: Logfile of failure stored in: /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995 Log data follows: | DEBUG: Executing python function sstate_task_prefunc | DEBUG: Python function sstate_task_prefunc finished | DEBUG: Executing shell function do_deploy | install: cannot stat '/buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/image/boot/*.p7b': No such file or directory | WARNING: /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/run.do_deploy.16995:1 exit 1 from 'install -m 0644 ${SIG} /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/deploy-kernel-initramfs' | ERROR: Function failed: do_deploy (log file is located at /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995) ERROR: Task (/buildarea/poky/meta-secure-core/meta/recipes-core/images/kernel-initramfs.bb:do_deploy) failed with exit code '1' Rename kernel-initramfs.bbappend to kernel-initramfs-efi-secure-boot.inc and add a new bbappend. Make sure this piece of code should be applied only if the efi-secure-boot feature is set. Signed-off-by: Yi Zhao

kernel-initramfs: fix inconsistent indentation

2018-11-30T05:46:35+00:00

Use spaces consistently to indent do_install() Signed-off-by: Yi Zhao

meta-efi-secure-boot: Ensure openssl-native exists when we need it

2018-11-07T15:40:20+00:00

In order to deploy our secure boot keys in DER format we need to use openssl. This must be listed in our DEPENDS line in order for the sysroot to be populated correctly when we run do_sign. Also drop the explicit fakeroot on our empty grub-efi do_sign as we may not have globally populated virtual/fakeroot-native at that point in time. Fixes: 92316d4b402b ("meta-signing-key: When deploying keys UEFI keys, deploy DER format") Signed-off-by: Tom Rini

mtree: update context of configure.ac-automake-error.patch

2018-11-07T09:09:00+00:00

It shows warning when apply configure.ac-automake-error.patch: | WARNING: mtree-1.0.3+gitAUTOINC+4f3e901aea-r0 do_patch: | ... | Details: | Applying patch configure.ac-automake-error.patch | patching file configure.ac | Hunk #1 succeeded at 4 with fuzz 2 (offset -2 lines). Update context of configure.ac-automake-error.patch to sync with current mtree source codes. Signed-off-by: Kai Kang

key-store: rename ima private key and certificate on target

2018-11-07T06:22:47+00:00

If sample keys are selected, key-store service will deploy IMA private key during first boot, but beople may be confused if we deploy a sample private key like "xxx.crt", so this commit is making sure key/cert on target are consistent with key files on build system. Signed-off-by: Yunguo Wei

meta-signing-key: When deploying keys UEFI keys, deploy DER format

2018-10-25T15:03:40+00:00

Generally speaking, for firmware to import PK/KEK/DB keys they need to be in the binary "DER" format and typically have the "cer" file extension. When deploying our keys, convert what we have to that format and deploy as well for ease of use. Signed-off-by: Tom Rini