diff options
Diffstat (limited to 'recipes-sota/aktualizr/aktualizr-device-prov-creds.bb')
| -rw-r--r-- | recipes-sota/aktualizr/aktualizr-device-prov-creds.bb | 60 |
1 files changed, 0 insertions, 60 deletions
diff --git a/recipes-sota/aktualizr/aktualizr-device-prov-creds.bb b/recipes-sota/aktualizr/aktualizr-device-prov-creds.bb deleted file mode 100644 index 6e02a50..0000000 --- a/recipes-sota/aktualizr/aktualizr-device-prov-creds.bb +++ /dev/null | |||
| @@ -1,60 +0,0 @@ | |||
| 1 | SUMMARY = "Credentials for device provisioning with fleet CA certificate" | ||
| 2 | HOMEPAGE = "https://github.com/advancedtelematic/aktualizr" | ||
| 3 | SECTION = "base" | ||
| 4 | LICENSE = "MPL-2.0" | ||
| 5 | LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MPL-2.0;md5=815ca599c9df247a0c7f619bab123dad" | ||
| 6 | |||
| 7 | inherit allarch | ||
| 8 | |||
| 9 | # WARNING: it is NOT a production solution. The secure way to provision devices | ||
| 10 | # is to create certificate request directly on the device (either with HSM/TPM | ||
| 11 | # or with software) and then sign it with a CA stored on a disconnected machine. | ||
| 12 | |||
| 13 | DEPENDS = "aktualizr aktualizr-native" | ||
| 14 | ALLOW_EMPTY_${PN} = "1" | ||
| 15 | |||
| 16 | SRC_URI = " \ | ||
| 17 | file://ca.cnf \ | ||
| 18 | " | ||
| 19 | |||
| 20 | require credentials.inc | ||
| 21 | |||
| 22 | export SOTA_CACERT_PATH | ||
| 23 | export SOTA_CAKEY_PATH | ||
| 24 | |||
| 25 | do_install() { | ||
| 26 | if [ -n "${SOTA_PACKED_CREDENTIALS}" ]; then | ||
| 27 | if [ -z ${SOTA_CACERT_PATH} ]; then | ||
| 28 | SOTA_CACERT_PATH=${DEPLOY_DIR_IMAGE}/CA/cacert.pem | ||
| 29 | SOTA_CAKEY_PATH=${DEPLOY_DIR_IMAGE}/CA/ca.private.pem | ||
| 30 | mkdir -p ${DEPLOY_DIR_IMAGE}/CA | ||
| 31 | bbwarn "SOTA_CACERT_PATH is not specified, use default one at ${SOTA_CACERT_PATH}" | ||
| 32 | |||
| 33 | if [ ! -f ${SOTA_CACERT_PATH} ]; then | ||
| 34 | bbwarn "${SOTA_CACERT_PATH} does not exist, generate a new CA" | ||
| 35 | SOTA_CACERT_DIR_PATH="$(dirname "${SOTA_CACERT_PATH}")" | ||
| 36 | openssl genrsa -out ${SOTA_CACERT_DIR_PATH}/ca.private.pem 4096 | ||
| 37 | openssl req -key ${SOTA_CACERT_DIR_PATH}/ca.private.pem -new -x509 -days 7300 -out ${SOTA_CACERT_PATH} -subj "/C=DE/ST=Berlin/O=Reis und Kichererbsen e.V/commonName=meta-updater" -batch -config ${WORKDIR}/ca.cnf -extensions cacert | ||
| 38 | bbwarn "${SOTA_CACERT_PATH} has been created, you'll need to upload it to the server" | ||
| 39 | fi | ||
| 40 | fi | ||
| 41 | |||
| 42 | if [ -z ${SOTA_CAKEY_PATH} ]; then | ||
| 43 | bbfatal "SOTA_CAKEY_PATH should be set when using device credential provisioning" | ||
| 44 | fi | ||
| 45 | |||
| 46 | install -m 0700 -d ${D}${localstatedir}/sota | ||
| 47 | aktualizr-cert-provider --credentials ${SOTA_PACKED_CREDENTIALS} \ | ||
| 48 | --fleet-ca ${SOTA_CACERT_PATH} \ | ||
| 49 | --fleet-ca-key ${SOTA_CAKEY_PATH} \ | ||
| 50 | --root-ca \ | ||
| 51 | --server-url \ | ||
| 52 | --local ${D} \ | ||
| 53 | --config ${STAGING_DIR_HOST}${libdir}/sota/sota-device-cred.toml | ||
| 54 | fi | ||
| 55 | } | ||
| 56 | |||
| 57 | FILES_${PN} = " \ | ||
| 58 | ${localstatedir}/sota/*" | ||
| 59 | |||
| 60 | # vim:set ts=4 sw=4 sts=4 expandtab: | ||
