Re: [isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds

[Jan Kiszka <jan.kiszka@siemens.com>]

On 27.07.26 16:11, Shivanand.Kunijadar@toshiba-tsip.com wrote:
> From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> 
> The .key & .pem files are addded using below .deb package,
> https://snapshot.debian.org/file/d32d11a5aacbf5685b81e8176a27a6918e9b55fb/ovmf-generic_2025.11-5_all.deb
> 
> Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> ---
>  Kconfig                                       |  4 +++
>  conf/distro/cip-core-forky.conf               | 13 ++++++++
>  kas/opt/forky.yml                             | 15 ++++++++++
>  .../files/forky/PkKek-1-snakeoil.key          | 30 +++++++++++++++++++
>  .../files/forky/PkKek-1-snakeoil.pem          | 23 ++++++++++++++

So, current sid uses different keys that forky? Is that always the case?

>  .../swupdate-certificates/files/forky         |  1 +
>  start-qemu.sh                                 |  2 ++
>  7 files changed, 88 insertions(+)
>  create mode 100644 conf/distro/cip-core-forky.conf
>  create mode 100644 kas/opt/forky.yml
>  create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
>  create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
>  create mode 120000 recipes-devtools/swupdate-certificates/files/forky
> 
> diff --git a/Kconfig b/Kconfig
> index 438234c..14cd677 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -241,6 +241,9 @@ config DEBIAN_TRIXIE
>  config DEBIAN_SID
>  	bool "Sid (Unstable)"
>  
> +config DEBIAN_FORKY
> +	bool "forky (14)"
> +

Let's sort forky before sid.

>  endchoice
>  
>  config KAS_INCLUDE_DEBIAN
> @@ -250,6 +253,7 @@ config KAS_INCLUDE_DEBIAN
>  	default "kas/opt/bookworm.yml" if DEBIAN_BOOKWORM
>  	default "kas/opt/trixie.yml" if DEBIAN_TRIXIE
>  	default "kas/opt/sid.yml" if DEBIAN_SID
> +	default "kas/opt/forky.yml" if DEBIAN_FORKY
>  

Here as well.

>  comment "Image features"
>  
> diff --git a/conf/distro/cip-core-forky.conf b/conf/distro/cip-core-forky.conf
> new file mode 100644
> index 0000000..7a868ce
> --- /dev/null
> +++ b/conf/distro/cip-core-forky.conf
> @@ -0,0 +1,13 @@
> +#
> +# CIP Core, generic profile
> +#
> +# Copyright (c) Toshiba Corporation, 2026
> +#
> +# Authors:
> +#  Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> +#
> +# SPDX-License-Identifier: MIT
> +#
> +
> +require conf/distro/debian-forky.conf
> +require cip-core-common.inc
> diff --git a/kas/opt/forky.yml b/kas/opt/forky.yml
> new file mode 100644
> index 0000000..6c4fcdc
> --- /dev/null
> +++ b/kas/opt/forky.yml
> @@ -0,0 +1,15 @@
> +#
> +# CIP Core, generic profile
> +#
> +# Copyright (c) Toshiba Corporation, 2026
> +#
> +# Authors:
> +#  Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> +#
> +# SPDX-License-Identifier: MIT
> +#
> +
> +header:
> +  version: 14
> +
> +distro: cip-core-forky
> diff --git a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
> new file mode 100644
> index 0000000..dd7f492
> --- /dev/null
> +++ b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
> @@ -0,0 +1,30 @@
> +-----BEGIN ENCRYPTED PRIVATE KEY-----
> +MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIs4RXCLmGLJgCAggA
> +MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECHer6014IEhGBIIEyO8O2zL8CJwV
> +auQpWLJsMMWxu2aSh1WadX9+rg+O61mukuS4rQSH5shMQ2krZZKzyXx0q8+2AySD
> +EtDXwhLvep60gUxOoNqK1+l3AxSFfIGOY8NC6yW67VX+G09ajWpgHj3ox63VRW8v
> +6mA8TFWYbOIwB8J7ScF4NszVwyiUnW13oKi7svoBM3LYYG2IMvre+gOvyMGfM8uv
> +X3txcYqAjhRV6n7vGo9LRLIIRSPKzaJbm/W7nT38LRUJP8JMSQUOPKgeEwQvOTVZ
> ++1kd7WeaGZrjagTDM4yhBjpOmB3D8aeT6xkjBlUwuddPzbdi0N7GrU520RcJMjxt
> +JMyOgabHKUKmPTX4m0ZCKi2jSILi7/6fBF+TZDxpakLwAwpTzm6kXArXb6AYtTEX
> +GPihB4O69ZgEc90jp3EnZt7HtKZn1HTbPNQAlWgvESgJ7hWHnTlM5Obqnyb78tj5
> +VdcOfTSQRYmw4Rh/lSUX0vQLhdmYSVLiMFFvT4IepXZgQ6McIdcvqoVrPgr0HoVz
> +5YILZdmbs80VcgYL853lMfQ84kRwUcw8jNyz7mBK7V7rE5QhaF5lunZ/R41ZRXRy
> +1ys1rNvLPvtOq/K51+A9U+h5lLM9LjeoOR+IUk2Vg4aIap+Z+lxbImH0gcJTrpem
> +ctA/2sBjLN7w811EjB/Tlu2awzbsKLpIDFVGHiGBI2zb41gtPd2RkijmiZab6nuM
> +ETg4ad3GscMoa++01oX/lrnVe386ECSjurmThb7I01eTNZrBlNsLyBeFzlEIEoBR
> +TqUXHLiDACxzL6U4vWzdnvVrCOW9fwvJJqChj7Wy822w2LXxVhOryNujBmZCmOht
> +mgDaJ15QiF+DACcX6VoBbm/462z+9Skxa0DqGwGzMOD5HldwvQSyZSykk/BzGFWP
> +rXfLYoMjN+dgA/yNfem64ayGsmoPUAjnsE4YasD58UVO0XwwtdMGJSOVmkdyWMcM
> +t+lN74kX/gmIvciK06N6prBfowgBEIJ6ev2dzlydSN8rGORmQ+OFzjP14rT0O+1Q
> +O48yR2ZZ9jl4YPUKSFJ3EUc/Qt9vO+chNiNYSy6TABGXur0WWiDvGURG9K5fWTqq
> +U2KydSRoYD5iF0caOgMZecNhZV+4CX927j3XuuKKx49qTAt3WMtmJ/UQFHMtQ833
> +XDFWHpEKDImfHfyiB1f8bOmqYmPuE6Shup0UMJsMFel4QVJM0Jn9+wHw/0qqPiS3
> +a769S/u9U2dfyZY5PfymY8UjFRMDtLaUoJSRaGp6RNc6LynuMMKdzho0GwvL3+m9
> +xKLDbbks8hVdmtcxxDKiio+F0hp3yc/2PyA/VGAlARiGp7876WTCZox9Bwnf6lkS
> +k9eYLSabe/r3Ag1SbWEGpFk3VO37qCyfp2xTfrHXK1ZJlvFwj3FFSprUaMrV+81K
> +FCEcSozXpVsQ7e7d11A7S8rTbtp09Q/J2oxyR0A9lk/ia5Qd/xwbPl4QJcWK2Jar
> +K3yFK8VrUNib7CjI1kdB479KIllD8oK6druBkzwGzFxDtcl47RlfkqW96XSQT7x/
> +h/YKSLcpMx9x9TJd2GDKj2t4oE9eGTBC0YbdH+HJNSrjEsWkjgY6Uw++S6VzKvQZ
> +DDsMJfxwcChc2zKRou+BFA==
> +-----END ENCRYPTED PRIVATE KEY-----
> diff --git a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
> new file mode 100644
> index 0000000..7cd2487
> --- /dev/null
> +++ b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
> @@ -0,0 +1,23 @@
> +-----BEGIN CERTIFICATE-----
> +MIID1zCCAr+gAwIBAgIUDMG7xGGEPj+ABvbflim0PNb/loowDQYJKoZIhvcNAQEL
> +BQAwejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG
> +b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMS4wLAYDVQQDDCVTbmFrZU9p
> +bCBUZXN0IEtleSBmb3IgRUZJIFNlY3VyZSBCb290MCAXDTIzMDUxOTIzMTE0NVoY
> +DzIwNTMwNTE3MjMxMTQ1WjB6MQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh
> +ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwxLjAs
> +BgNVBAMMJVNuYWtlT2lsIFRlc3QgS2V5IGZvciBFRkkgU2VjdXJlIEJvb3QwggEi
> +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ
> +boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1
> +wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx
> ++L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy
> +I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u
> +Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB
> +AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW
> +gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
> +DQEBCwUAA4IBAQBBxlfo6MxBN44mXBIhE/QUbJZ+bo/Vrqv2DIZqOlV5+Sk6KnK8
> +X9Rz2IJwoqLjB6cW9yInk5P/QS45880K1fDT/lu5/2U64i3l1ZFK75qLDCn4/khF
> +birV2U6LBZpxLe3UvXk3xZMoUPzvT2rhrsf78G0pSmAnP8li8Co8F6hTjQzB8IgC
> +DpYVATCoWBH6GhudtjUp+CJSyGApdL+HKX6i6oD7vutvWYBf0Hx5r1NrqIv31Y4V
> +bhwvK5zajFamj/VYeVy7/roqD06hNF1ImhsuBOqoJlKu+cHMGN9DOJqjGup1T9aI
> +2dpEOK5vbKXFrox/yCLgXmUkdwZ3BK4lcxCq
> +-----END CERTIFICATE-----
> diff --git a/recipes-devtools/swupdate-certificates/files/forky b/recipes-devtools/swupdate-certificates/files/forky
> new file mode 120000
> index 0000000..2719d00
> --- /dev/null
> +++ b/recipes-devtools/swupdate-certificates/files/forky
> @@ -0,0 +1 @@
> +../../secure-boot-secrets/files/forky
> \ No newline at end of file
> diff --git a/start-qemu.sh b/start-qemu.sh
> index d12fa23..0b783d6 100755
> --- a/start-qemu.sh
> +++ b/start-qemu.sh
> @@ -47,6 +47,8 @@ if [ -z "${DISTRO_RELEASE}" ]; then
>  		DISTRO_RELEASE="trixie"
>  	elif grep -s -q "DEBIAN_SID: true" .config.yaml; then
>  		DISTRO_RELEASE="sid"
> +	elif grep -s -q "DEBIAN_FORKY: true" .config.yaml; then
> +		DISTRO_RELEASE="forky"

..and here.

>  	else
>  		echo "No supported Debian release configured"
>  		exit 1

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center