Re: [PATCH v4 00/13] qemuarm64-secureboot: Add UEFI Secure Boot

[Jon Mason <jdmason@kudzu.us>]

Looks like this series is not building for me.  I'm seeing the
following error:

ERROR: /builder/meta-arm/build/../poky/meta/recipes-kernel/linux/linux-yocto_6.10.bb: Unable to get checksum for linux-yocto SRC_URI entry db.key: file could not be found                     | ETA:  0:00:12
The following paths were searched:
/builder/meta-arm/build/../meta-arm/uefi-sb-keys/db.key
ERROR: Parsing halted due to errors, see error messages above                                                                                                                                  | ETA:  0:00:14
ERROR: /builder/meta-arm/build/../poky/meta/recipes-core/systemd/systemd-boot_256.5.bb: Unable to get checksum for systemd-boot SRC_URI entry db.key: file could not be found
The following paths were searched:
/builder/meta-arm/build/../meta-arm/uefi-sb-keys/db.key
ERROR: /builder/meta-arm/build/../poky/meta/recipes-kernel/linux/linux-yocto_6.6.bb: Unable to get checksum for linux-yocto SRC_URI entry db.key: file could not be found
The following paths were searched:
/builder/meta-arm/build/../meta-arm/uefi-sb-keys/db.key

I've not looked into it, but it's being seen on mulitple setups and is
trivial to replicate with:
kas build ci/qemuarm64-secureboot.yml:ci/testimage.yml

Thanks,
Jon


On Thu, Aug 29, 2024 at 10:31:56AM -0600, Javier Tia wrote:
> Hi,
> 
> Addressing comments from patch series v3.
> 
> A backport from meta-ts with the minimal changes to add UEFI Secure Boot
> into qemuarm64-secureboot machine.
> 
> Requirements:
> 
>   - Create a UEFI disk partition to copy EFI apps.
> 
>   - Add UEFI settings to U-Boot, systemd-boot, and Linux kernel.
> 
>   - UEFI keys are to be stored in U-Boot and used to sign systemd-boot
>     and Linux kernel images.
> 
>   - Add systemd as Init manager to auto-mount efivarfs.
> 
> Introduces uefi-secureboot machine feature.
> 
> UEFI keys must be genereated in order to be added to U-Boot. Sign both
> systemd-boot EFI app and Linux kernel image.
> 
> Build and verification steps:
> 
> $ kas build 'ci/qemuarm64-secureboot.yml:ci/testimage.yml'
> 
> ---
> 
> Changes since v3:
> - For image creation use core-image-minimal, instead of core-image-base.
> 
> Changes since v2:
> - Remove commit "qemuarm64-secureboot.yml: Set branch to scarthgap".
> 
> Changes since v1:
> - Rework all subject commits to follow OE, Yocto, and meta-arm guidelines.
> - Add gen-uefi-sb-keys.bb recipe to generate UEFI keys.
> - Add an OE test to validate UEFI Secure Boot.
> - Simplify gen_uefi_keys.sh to avoid code repetition.
> - Replace grub with systemd-boot.
> - Simplify signing binary images with sbsign class.
> - Set OE branch to Scarthgap.
> 
> Changes since the v0:
> - Remove u-boot recipe.
> - Split the change in several commits.
> - Remove sample UEFI keys.
> - Validate UEFI keys exist before building.
> - Insolate most of changes under uefi-secureboot machine feature.
> 
> Javier Tia (13):
>   qemuarm64-secureboot: Introduce uefi-secureboot machine feature
>   core-image-minimal: Use UEFI layout disk partitions
>   layer.conf: Introduce UEFI_SB_KEYS_DIR
>   uefi-sb-keys.bbclass: Add class to validate UEFI keys
>   sbsign.bbclass: Add class to sign binaries
>   core-image-minimal: Inherit uefi-sb-keys
>   meta-arm: Introduce gen-uefi-sb-keys.bb recipe
>   u-boot: Setup UEFI and Secure Boot
>   qemuarm64-secureboot: Add meta-secure-core layer as dependency
>   linux-yocto: Setup UEFI and sign kernel image
>   systemd: Add UEFI support
>   systemd-boot: Use it as bootloader & sign UEFI image
>   meta-arm: Add UEFI Secure Boot test
> 
>  ci/qemuarm64-secureboot.yml                   | 14 ++++---
>  .../u-boot/u-boot-qemuarm64-secureboot.inc    | 18 +++++++++
>  .../u-boot/u-boot/uefi-secureboot.cfg         | 10 +++++
>  .../recipes-bsp/u-boot/u-boot_%.bbappend      |  2 +-
>  meta-arm-bsp/wic/efi-disk-no-swap.wks.in      |  2 +-
>  meta-arm/classes/sbsign.bbclass               | 39 +++++++++++++++++++
>  meta-arm/classes/uefi-sb-keys.bbclass         | 24 ++++++++++++
>  meta-arm/conf/layer.conf                      |  2 +
>  .../conf/machine/qemuarm64-secureboot.conf    |  8 ++++
>  .../oeqa/runtime/cases/uefi_secure_boot.py    | 32 +++++++++++++++
>  meta-arm/recipes-bsp/uefi/gen-uefi-sb-keys.bb | 26 +++++++++++++
>  .../core-image-minimal-uefi-secureboot.inc    | 17 ++++++++
>  .../images/core-image-minimal.bbappend        |  1 +
>  .../systemd/systemd-boot-uefi-secureboot.inc  | 12 ++++++
>  .../systemd/systemd-boot_%.bbappend           |  1 +
>  meta-arm/recipes-core/systemd/systemd-efi.inc |  1 +
>  .../recipes-core/systemd/systemd_%.bbappend   |  1 +
>  .../linux/linux-yocto%.bbappend               |  2 +
>  .../linux/linux-yocto-uefi-secureboot.inc     | 19 +++++++++
>  meta-arm/uefi-sb-keys/.gitignore              |  4 ++
>  meta-arm/uefi-sb-keys/gen_uefi_keys.sh        | 33 ++++++++++++++++
>  21 files changed, 261 insertions(+), 7 deletions(-)
>  create mode 100644 meta-arm-bsp/recipes-bsp/u-boot/u-boot-qemuarm64-secureboot.inc
>  create mode 100644 meta-arm-bsp/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
>  create mode 100644 meta-arm/classes/sbsign.bbclass
>  create mode 100644 meta-arm/classes/uefi-sb-keys.bbclass
>  create mode 100644 meta-arm/lib/oeqa/runtime/cases/uefi_secure_boot.py
>  create mode 100644 meta-arm/recipes-bsp/uefi/gen-uefi-sb-keys.bb
>  create mode 100644 meta-arm/recipes-core/images/core-image-minimal-uefi-secureboot.inc
>  create mode 100644 meta-arm/recipes-core/images/core-image-minimal.bbappend
>  create mode 100644 meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
>  create mode 100644 meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
>  create mode 100644 meta-arm/recipes-core/systemd/systemd-efi.inc
>  create mode 100644 meta-arm/recipes-core/systemd/systemd_%.bbappend
>  create mode 100644 meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
>  create mode 100644 meta-arm/uefi-sb-keys/.gitignore
>  create mode 100755 meta-arm/uefi-sb-keys/gen_uefi_keys.sh
> 
> -- 
> 2.46.0
> 
>