mirror of
https://git.yoctoproject.org/poky
synced 2026-04-22 06:32:12 +02:00
kernel-signing-keys-native: refactor key generation into a new recipe
The do_kernel_generate_rsa_keys function from kernel-fitimage.bbclass is moved to a new recipe, kernel-signing-keys-native.bb. This refactoring introduces no functional changes. Intention this change: - Remove the dependency of uboot-sign.bbclass on kernel-fitimage.bbclass. - Simplify the use of custom key generation implementations by isolating the functionality into a separate recipe. Known limitations of this (and also the previous) implementation: - When generating from an existing TMPDIR, the existing key is reused. However, when generating from an empty TMPDIR or an SDK using the sstate-cache, a new key is generated, which may lead to inconsistencies. - The use of random keys (via FIT_GENERATE_KEYS) is convenient for experiments but unsuitable for production environments requiring deterministic and secure key management. Future improvements to consider: - Ensure reproducibility, even when using the sstate-cache. However, simply storing the private key in a potentially shared sstate artifact may not always be ideal from a security perspective. - Support encrypted keys via `SRC_URI` for reliable key updates. - Enable signing with an HSM (Hardware Security Module) through mechanisms like PKCS#11 or post-processing scripts. (From OE-Core rev: 88736bb53fd2f0ffa1d249fc1a37897d10c8be18) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Adrian Freihofer
committed by
Richard Purdie
Richard Purdie
parent
8b8bdc4a19
commit
29a931bfbf
@@ -27,7 +27,10 @@ def get_fit_replacement_type(d):
|
||||
return replacementtype
|
||||
|
||||
KERNEL_IMAGETYPE_REPLACEMENT ?= "${@get_fit_replacement_type(d)}"
|
||||
DEPENDS:append = " ${@'u-boot-tools-native dtc-native' if 'fitImage' in (d.getVar('KERNEL_IMAGETYPES') or '').split() else ''}"
|
||||
DEPENDS:append = " \
|
||||
${@'u-boot-tools-native dtc-native' if 'fitImage' in (d.getVar('KERNEL_IMAGETYPES') or '').split() else ''} \
|
||||
${@'kernel-signing-keys-native' if d.getVar('FIT_GENERATE_KEYS') == '1' else ''} \
|
||||
"
|
||||
|
||||
python __anonymous () {
|
||||
# Override KERNEL_IMAGETYPE_FOR_MAKE variable, which is internal
|
||||
@@ -754,53 +757,6 @@ do_assemble_fitimage_initramfs() {
|
||||
|
||||
addtask assemble_fitimage_initramfs before do_deploy after do_bundle_initramfs
|
||||
|
||||
do_kernel_generate_rsa_keys() {
|
||||
if [ "${UBOOT_SIGN_ENABLE}" = "0" ] && [ "${FIT_GENERATE_KEYS}" = "1" ]; then
|
||||
bbwarn "FIT_GENERATE_KEYS is set to 1 even though UBOOT_SIGN_ENABLE is set to 0. The keys will not be generated as they won't be used."
|
||||
fi
|
||||
|
||||
if [ "${UBOOT_SIGN_ENABLE}" = "1" ] && [ "${FIT_GENERATE_KEYS}" = "1" ]; then
|
||||
|
||||
# Generate keys to sign configuration nodes, only if they don't already exist
|
||||
if [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key ] || \
|
||||
[ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".crt ]; then
|
||||
|
||||
# make directory if it does not already exist
|
||||
mkdir -p "${UBOOT_SIGN_KEYDIR}"
|
||||
|
||||
bbnote "Generating RSA private key for signing fitImage"
|
||||
openssl genrsa ${FIT_KEY_GENRSA_ARGS} -out \
|
||||
"${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key \
|
||||
"${FIT_SIGN_NUMBITS}"
|
||||
|
||||
bbnote "Generating certificate for signing fitImage"
|
||||
openssl req ${FIT_KEY_REQ_ARGS} "${FIT_KEY_SIGN_PKCS}" \
|
||||
-key "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key \
|
||||
-out "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".crt
|
||||
fi
|
||||
|
||||
# Generate keys to sign image nodes, only if they don't already exist
|
||||
if [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key ] || \
|
||||
[ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".crt ]; then
|
||||
|
||||
# make directory if it does not already exist
|
||||
mkdir -p "${UBOOT_SIGN_KEYDIR}"
|
||||
|
||||
bbnote "Generating RSA private key for signing fitImage"
|
||||
openssl genrsa ${FIT_KEY_GENRSA_ARGS} -out \
|
||||
"${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key \
|
||||
"${FIT_SIGN_NUMBITS}"
|
||||
|
||||
bbnote "Generating certificate for signing fitImage"
|
||||
openssl req ${FIT_KEY_REQ_ARGS} "${FIT_KEY_SIGN_PKCS}" \
|
||||
-key "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key \
|
||||
-out "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".crt
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
addtask kernel_generate_rsa_keys before do_assemble_fitimage after do_compile
|
||||
|
||||
kernel_do_deploy[vardepsexclude] = "DATETIME"
|
||||
kernel_do_deploy:append() {
|
||||
# Update deploy directory
|
||||
|
||||
@@ -112,13 +112,14 @@ UBOOT_FIT_CONF_USER_LOADABLES ?= ''
|
||||
UBOOT_FIT_UBOOT_LOADADDRESS ?= "${UBOOT_LOADADDRESS}"
|
||||
UBOOT_FIT_UBOOT_ENTRYPOINT ?= "${UBOOT_ENTRYPOINT}"
|
||||
|
||||
|
||||
DEPENDS:append = " ${@'kernel-signing-keys-native' if d.getVar('FIT_GENERATE_KEYS') == '1' else ''}"
|
||||
|
||||
python() {
|
||||
# We need u-boot-tools-native if we're creating a U-Boot fitImage
|
||||
sign = d.getVar('UBOOT_SIGN_ENABLE') == '1'
|
||||
if d.getVar('UBOOT_FITIMAGE_ENABLE') == '1' or sign:
|
||||
d.appendVar('DEPENDS', " u-boot-tools-native dtc-native")
|
||||
if d.getVar('FIT_GENERATE_KEYS') == '1' and sign:
|
||||
d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' virtual/kernel:do_kernel_generate_rsa_keys')
|
||||
}
|
||||
|
||||
concat_dtb() {
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
# Automatically generate key pairs in UBOOT_SIGN_KEYDIR if they do not exist.
|
||||
# The key pair is generated by the kernel-signing-keys-native recipe and is not
|
||||
# stored in the sstate cache. This can be beneficial from a security standpoint,
|
||||
# as it avoids unintentionally caching and distributing private keys.
|
||||
# However, this behavior can lead to non-reproducible builds. For example, if
|
||||
# the keys are deleted, they must be manually restored, or you must run:
|
||||
# bitbake -c cleanall kernel-signing-keys-native
|
||||
# before new key pairs are generated.
|
||||
#
|
||||
# However, this approach is only suitable for simple or local development use
|
||||
# cases. For more advanced or production-grade scenarios, a more robust solution
|
||||
# is usually required—such as external signing or re-signing using e.g a HSM.
|
||||
|
||||
|
||||
SUMMARY = "Signing keys for the kernel FIT image"
|
||||
LICENSE = "MIT"
|
||||
LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
|
||||
|
||||
require conf/image-fitimage.conf
|
||||
|
||||
DEPENDS += "openssl-native"
|
||||
|
||||
inherit native
|
||||
|
||||
do_fetch[noexec] = "1"
|
||||
do_unpack[noexec] = "1"
|
||||
do_patch[noexec] = "1"
|
||||
do_configure[noexec] = "1"
|
||||
do_install[noexec] = "1"
|
||||
|
||||
|
||||
do_compile() {
|
||||
if [ "${UBOOT_SIGN_ENABLE}" = "0" ] && [ "${FIT_GENERATE_KEYS}" = "1" ]; then
|
||||
bbwarn "FIT_GENERATE_KEYS is set to 1 even though UBOOT_SIGN_ENABLE is set to 0. The keys will not be generated as they won't be used."
|
||||
fi
|
||||
|
||||
if [ "${UBOOT_SIGN_ENABLE}" = "1" ] && [ "${FIT_GENERATE_KEYS}" = "1" ]; then
|
||||
|
||||
# Generate keys to sign configuration nodes, only if they don't already exist
|
||||
if [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key ] || \
|
||||
[ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".crt ]; then
|
||||
|
||||
# make directory if it does not already exist
|
||||
mkdir -p "${UBOOT_SIGN_KEYDIR}"
|
||||
|
||||
bbnote "Generating RSA private key for signing fitImage"
|
||||
openssl genrsa ${FIT_KEY_GENRSA_ARGS} -out \
|
||||
"${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key \
|
||||
"${FIT_SIGN_NUMBITS}"
|
||||
|
||||
bbnote "Generating certificate for signing fitImage"
|
||||
openssl req ${FIT_KEY_REQ_ARGS} "${FIT_KEY_SIGN_PKCS}" \
|
||||
-key "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".key \
|
||||
-out "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_KEYNAME}".crt
|
||||
fi
|
||||
|
||||
# Generate keys to sign image nodes, only if they don't already exist
|
||||
if [ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key ] || \
|
||||
[ ! -f "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".crt ]; then
|
||||
|
||||
# make directory if it does not already exist
|
||||
mkdir -p "${UBOOT_SIGN_KEYDIR}"
|
||||
|
||||
bbnote "Generating RSA private key for signing fitImage"
|
||||
openssl genrsa ${FIT_KEY_GENRSA_ARGS} -out \
|
||||
"${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key \
|
||||
"${FIT_SIGN_NUMBITS}"
|
||||
|
||||
bbnote "Generating certificate for signing fitImage"
|
||||
openssl req ${FIT_KEY_REQ_ARGS} "${FIT_KEY_SIGN_PKCS}" \
|
||||
-key "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".key \
|
||||
-out "${UBOOT_SIGN_KEYDIR}/${UBOOT_SIGN_IMG_KEYNAME}".crt
|
||||
fi
|
||||
fi
|
||||
}
|
||||
Reference in New Issue
Block a user