Re: [PATCH 4/5] meta/recipes-kernel/linux-module: add option to set default signing profile and dependencies

["'Jan Kiszka' via isar-users" <isar-users@googlegroups.com>]

On 15.04.25 14:22, 'Gokhan Cetin' via isar-users wrote:
> Introduces single configuration variable (`SIGNATURE_ENABLED`) to
> set all predefined profile and dependencies need to be provided.
> 
> By using this option, downstreams will be able to sign all
> kernel modules without appending any additional configuration
> into their module recipes.
> 
> Signed-off-by: Gokhan Cetin <gokhan.cetin@siemens.com>
> ---
>  meta/recipes-kernel/linux-module/module.inc | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/meta/recipes-kernel/linux-module/module.inc b/meta/recipes-kernel/linux-module/module.inc
> index 45d88d48..576a2cad 100644
> --- a/meta/recipes-kernel/linux-module/module.inc
> +++ b/meta/recipes-kernel/linux-module/module.inc
> @@ -27,6 +27,12 @@ SIGNATURE_KEYFILE ??= "/usr/share/secure-boot-secrets/secure-boot.key"
>  SIGNATURE_CERTFILE ??= "/usr/share/secure-boot-secrets/secure-boot.pem"
>  SIGNATURE_HASHFN ??= "sha256"
>  SIGNATURE_SIGNWITH ??= "/usr/bin/sign-module.sh"
> +SIGNATURE_ENABLED ??= ""

Should this last control actually be by module recipe (which includes
module.inc), or shouldn't we also support build-wide enabling via
local.conf etc.? In the latter case, isar should introduce a global
control variable, say KERNEL_MODULE_SIGNATURES, which controls that for
every module recipe.

Jan

> +
> +# Define signing profile and dependencies if SIGNATURE_ENABLED is set to "1"
> +DEB_BUILD_PROFILES += "${@'pkg.signwith' if bb.utils.to_boolean(d.getVar('SIGNATURE_ENABLED')) else ''}"
> +DEPENDS += "${@'module-signer secure-boot-secrets' if bb.utils.to_boolean(d.getVar('SIGNATURE_ENABLED')) else ''}"
> +DEBIAN_BUILD_DEPENDS .= "${@', module-signer, secure-boot-secrets' if bb.utils.to_boolean(d.getVar('SIGNATURE_ENABLED')) else ''}"
>  
>  SRC_URI += "file://debian/"
>  


-- 
Siemens AG, Foundational Technologies
Linux Expert Center

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/73ca026a-3f26-44c1-a2df-c305a2e2d71f%40siemens.com.