Hi,
On Mon, Sep 02, 2024 at 06:13:06PM +0200, A. Sverdlin via
lists.openembedded.org wrote:
> From: Alexander Sverdlin <[email protected]>
>
> mkimage doesn't fail if it is not able to sign FIT nodes.
> This may lead to unbootable images in secure boot configurations.
> Make signing failures fatal by parsing the mkimage output.
>
> Signed-off-by: Alexander Sverdlin <[email protected]>
> ---
> Changes in v3:
> - bbfatag_log -> bberror + bbfatal_log with relevant mkimage output snippets
> Changes in v2:
> - bbfatal -> bbfatal_log
>
> meta/classes-recipe/kernel-fitimage.bbclass | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/meta/classes-recipe/kernel-fitimage.bbclass
> b/meta/classes-recipe/kernel-fitimage.bbclass
> index 67c98adb232..ccf848e643f 100644
> --- a/meta/classes-recipe/kernel-fitimage.bbclass
> +++ b/meta/classes-recipe/kernel-fitimage.bbclass
> @@ -753,11 +753,16 @@ fitimage_assemble() {
> # Step 8: Sign the image
> #
> if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ] ; then
> - ${UBOOT_MKIMAGE_SIGN} \
> + output=$(${UBOOT_MKIMAGE_SIGN} \
Will this subshell return errors as before or is "set -e" propagated there?
> ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if
> len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
> -F -k "${UBOOT_SIGN_KEYDIR}" \
> -r ${KERNEL_OUTPUT_DIR}/$2 \
> - ${UBOOT_MKIMAGE_SIGN_ARGS}
> + ${UBOOT_MKIMAGE_SIGN_ARGS})
> + echo "$output"
> + if err=$(echo "$output" | grep -C9 -E "Sign
> value:\s*unavailable"); then
> + bberror "${UBOOT_MKIMAGE_SIGN} failed to provide
> signatures for these images:"
> + bbfatal_log "\n$err"
Is the problem really in mkimage since it does not return errors when signing
fails?
Cheers,
-Mikko
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#204120):
https://lists.openembedded.org/g/openembedded-core/message/204120
Mute This Topic: https://lists.openembedded.org/mt/108229511/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
