[PATCH v2 4/5] meta/recipes-kernel/linux-module: add option to set default signing profile and dependencies

["'Gokhan Cetin' via isar-users" <isar-users@googlegroups.com>]

Introduces single control variable (`KERNEL_MODULE_SIGNATURES`) to
set all predefined build profile and dependencies need to be configured
for kernel module signing.

By using this option, downstreams will be able to enable build-wide signing
of kernel modules which include module.inc without appending any additional
configuration into their module recipes.

Signed-off-by: Gokhan Cetin <gokhan.cetin@siemens.com>
---
 meta/recipes-kernel/linux-module/module.inc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/meta/recipes-kernel/linux-module/module.inc b/meta/recipes-kernel/linux-module/module.inc
index 45d88d48..8fe5eed4 100644
--- a/meta/recipes-kernel/linux-module/module.inc
+++ b/meta/recipes-kernel/linux-module/module.inc
@@ -28,6 +28,13 @@ SIGNATURE_CERTFILE ??= "/usr/share/secure-boot-secrets/secure-boot.pem"
 SIGNATURE_HASHFN ??= "sha256"
 SIGNATURE_SIGNWITH ??= "/usr/bin/sign-module.sh"
 
+KERNEL_MODULE_SIGNATURES ??= ""
+
+# Define signing profile and dependencies if KERNEL_MODULE_SIGNATURES is set to "1"
+DEB_BUILD_PROFILES += "${@'pkg.signwith' if bb.utils.to_boolean(d.getVar('KERNEL_MODULE_SIGNATURES')) else ''}"
+DEPENDS += "${@'module-signer secure-boot-secrets' if bb.utils.to_boolean(d.getVar('KERNEL_MODULE_SIGNATURES')) else ''}"
+DEBIAN_BUILD_DEPENDS .= "${@', module-signer, secure-boot-secrets' if bb.utils.to_boolean(d.getVar('KERNEL_MODULE_SIGNATURES')) else ''}"
+
 SRC_URI += "file://debian/"
 
 AUTOLOAD ?= ""
-- 
2.39.2

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20250416171709.742191-5-gokhan.cetin%40siemens.com.