[PATCH 05/10] add support to sign kernel modules

[Felix Moessbauer <felix.moessbauer@siemens.com>]

This patchs extends the module.inc class to add support to sign the
compiled kernel modules. If the module is signed or not is controlled
via a build profile named pkg.sign. When enabled, the kernels sign-file
is executed. The path to the keyfile inside the schroot has to be
provided in SIGNATURE_KEYFILE, the path to the corresponding cert in
SIGNATURE_CERTFILE. The used hash-function can be controlled using
SIGNATURE_HASHFN. All modules in the current build directory are
signed.

The implementation - by design - does not specify how to provide the
keys in the schroot inside the sbuild. This gives some flexibility, e.g.
the keys can be provided in a package, added as build dependency or
alternatively via a mountpoint.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/recipes-kernel/linux-module/files/debian/rules.tmpl | 3 +++
 meta/recipes-kernel/linux-module/module.inc              | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git a/meta/recipes-kernel/linux-module/files/debian/rules.tmpl b/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
index c1c2560..7d950e3 100755
--- a/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
+++ b/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
@@ -50,6 +50,9 @@ override_dh_auto_clean:
 
 override_dh_auto_build:
 	$(MAKE) -C $(KDIR) M=$(PWD) $(PARALLEL_MAKE) modules
+ifneq ($(filter pkg.sign,$(DEB_BUILD_PROFILES)),)
+	find . -name "*.ko" -print -exec $(KDIR)/scripts/sign-file ${SIGNATURE_HASHFN} ${SIGNATURE_KEYFILE} ${SIGNATURE_CERTFILE} {} \;
+endif
 
 override_dh_auto_install:
 	$(MAKE) -C $(KDIR) M=$(PWD) INSTALL_MOD_PATH=$(PWD)/debian/${PN} modules_install
diff --git a/meta/recipes-kernel/linux-module/module.inc b/meta/recipes-kernel/linux-module/module.inc
index cfc6d20..a9e5d3d 100644
--- a/meta/recipes-kernel/linux-module/module.inc
+++ b/meta/recipes-kernel/linux-module/module.inc
@@ -18,6 +18,10 @@ KERNEL_HEADERS_PKG ??= "linux-headers-${KERNEL_NAME}"
 DEPENDS += "${KERNEL_HEADERS_PKG}"
 DEBIAN_BUILD_DEPENDS = "${KERNEL_HEADERS_PKG}"
 
+SIGNATURE_KEYFILE ??= ""
+SIGNATURE_CERTFILE ??= ""
+SIGNATURE_HASHFN ??= "sha256"
+
 SRC_URI += "file://debian/"
 
 AUTOLOAD ?= ""
@@ -33,6 +37,9 @@ TEMPLATE_VARS += " \
     KERNEL_IMAGE_PKG \
     KERNEL_HEADERS_PKG \
     DEBIAN_BUILD_DEPENDS \
+    SIGNATURE_KEYFILE \
+    SIGNATURE_CERTFILE \
+    SIGNATURE_HASHFN \
     PN"
 
 do_prepare_build() {
-- 
2.34.1