Skip to content

base: Add lmp-signing#1311

Merged
ricardosalveti merged 2 commits intofoundriesio:mainfrom
quaresmajose:lmp-staging-modsing
Oct 19, 2023
Merged

base: Add lmp-signing#1311
ricardosalveti merged 2 commits intofoundriesio:mainfrom
quaresmajose:lmp-staging-modsing

Conversation

@quaresmajose
Copy link
Copy Markdown
Member

@quaresmajose quaresmajose commented Oct 10, 2023

This bitbake class will store the hash of the keys files so that all tasks using these keys will re-run when the keys changed.
The main function add_varfiles_hash_to_vardeps_of_var is used for adding the hash value of the files in 'varfiles' on the 'var' variable dependency chain.

To unblock #916

@quaresmajose quaresmajose requested a review from a team October 10, 2023 16:49
Copy link
Copy Markdown
Contributor

@MrCry0 MrCry0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with a minor note:

I'd shorten the commit subject to avoid wrapping it:
base: lmp-staging: Adds function to take in consideration the hash of… … the keys to, like, base: lmp-staging: Store hash of varfiles to vardeps

@quaresmajose
Copy link
Copy Markdown
Member Author

LGTM with a minor note:

I'd shorten the commit subject to avoid wrapping it: base: lmp-staging: Adds function to take in consideration the hash of… … the keys to, like, base: lmp-staging: Store hash of varfiles to vardeps

Thanks for the sugestion.

Copy link
Copy Markdown
Member

@ricardosalveti ricardosalveti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM for the kernel module signing, but for the original issue we were concerned with we should also track the content for the keys used for signing the kernel fitimage (u-boot signing key).

@quaresmajose
Copy link
Copy Markdown
Member Author

The MODSIGN_PRIVKEY can be tested with:

bitbake virtual/kernel
echo >> conf/keys/privkey_modsign.pem
bitbake virtual/kernel

@quaresmajose
Copy link
Copy Markdown
Member Author

quaresmajose commented Oct 18, 2023

The UEFI_SIGN_KEYDIR keys can be tested with the machine intel-corei7-64:

# populate the sstate-cache
echo 'require conf/sign.conf' >> conf/auto.conf
echo > conf/sign.conf
bitbake lmp-base-console-image

# generate new keys to invalidate the sstate-cache
rm -rf conf/keys_test; cp -r conf/keys conf/keys_test
openssl req -x509 -sha256 -newkey rsa:2048 -subj "/CN=${CN} DB/" -keyout conf/keys_test/uefi/DB.key -out conf/keys_test/uefi/DB.crt -nodes -days 3650
echo 'UEFI_SIGN_KEYDIR = "${TOPDIR}/conf/keys_test/uefi"' > conf/sign.conf
bitbake lmp-base-console-image

As can be see every task that uses the keys will run again:

$ grep Running tmp-lmp/log/cooker/*/console-latest.log | rev | cut -d'/' -f 1 | rev
packagegroup-core-boot.bb:do_package_setscene)
systemd_250.5.bb:do_package_setscene)
systemd-boot_250.5.bb:do_write_config)
systemd-boot_250.5.bb:do_fetch)
systemd-boot_250.5.bb:do_prepare_recipe_sysroot)
systemd-boot_250.5.bb:do_unpack)
initramfs-ostree-lmp-image.bb:do_fetch)
initramfs-ostree-lmp-image.bb:do_prepare_recipe_sysroot)
efitools_git.bb:do_fetch)
efitools_git.bb:do_prepare_recipe_sysroot)
efitools_git.bb:do_unpack)
ostree-kernel-initramfs_0.0.1.bb:do_fetch)
ostree-kernel-initramfs_0.0.1.bb:do_prepare_recipe_sysroot)
ostree-kernel-initramfs_0.0.1.bb:do_unpack)
ostree-kernel-initramfs_0.0.1.bb:do_patch)
lmp-base-console-image.bb:do_fetch)
core-image-minimal-initramfs.bb:do_fetch)
core-image-minimal-initramfs.bb:do_prepare_recipe_sysroot)
systemd-boot_250.5.bb:do_patch)
ostree-kernel-initramfs_0.0.1.bb:do_configure)
ostree-kernel-initramfs_0.0.1.bb:do_compile)
efitools_git.bb:do_patch)
systemd-boot_250.5.bb:do_configure)
lmp-base-console-image.bb:do_unpack)
efitools_git.bb:do_configure)
efitools_git.bb:do_prepare_local_auths)
efitools_git.bb:do_compile)
efitools_git.bb:do_install)
efitools_git.bb:do_package)
efitools_git.bb:do_deploy)
efitools_git.bb:do_populate_sysroot)
efitools_git.bb:do_packagedata)
efitools_git.bb:do_package_qa)
efitools_git.bb:do_package_write_ipk)
efitools_git.bb:do_rm_work)
systemd-boot_250.5.bb:do_compile)
systemd-boot_250.5.bb:do_efi_sign)
systemd-boot_250.5.bb:do_deploy)
systemd-boot_250.5.bb:do_install)
systemd-boot_250.5.bb:do_package)
systemd-boot_250.5.bb:do_populate_sysroot)
lmp-base-console-image.bb:do_prepare_recipe_sysroot)
systemd-boot_250.5.bb:do_packagedata)
systemd_250.5.bb:do_package_qa)
systemd-boot_250.5.bb:do_package_qa)
packagegroup-core-boot.bb:do_package_qa)
systemd_250.5.bb:do_package_write_ipk)
systemd-boot_250.5.bb:do_package_write_ipk)
packagegroup-core-boot.bb:do_package_write_ipk)
systemd-boot_250.5.bb:do_rm_work)
packagegroup-core-boot.bb:do_rm_work)
systemd_250.5.bb:do_rm_work)
initramfs-ostree-lmp-image.bb:do_rootfs)
core-image-minimal-initramfs.bb:do_rootfs)
initramfs-ostree-lmp-image.bb:do_write_qemuboot_conf)
initramfs-ostree-lmp-image.bb:do_flush_pseudodb)
initramfs-ostree-lmp-image.bb:do_image_qa)
initramfs-ostree-lmp-image.bb:do_image)
initramfs-ostree-lmp-image.bb:do_image_cpio)
core-image-minimal-initramfs.bb:do_write_qemuboot_conf)
core-image-minimal-initramfs.bb:do_flush_pseudodb)
core-image-minimal-initramfs.bb:do_image_qa)
core-image-minimal-initramfs.bb:do_image)
initramfs-ostree-lmp-image.bb:do_image_complete)
core-image-minimal-initramfs.bb:do_image_cpio)
linux-lmp_6.1.bb:do_bundle_initramfs)
linux-lmp_6.1.bb:do_efi_sign)
core-image-minimal-initramfs.bb:do_image_complete)
linux-lmp_6.1.bb:do_deploy)
ostree-kernel-initramfs_0.0.1.bb:do_install)
core-image-minimal-initramfs.bb:do_populate_lic_deploy)
initramfs-ostree-lmp-image.bb:do_populate_lic_deploy)
core-image-minimal-initramfs.bb:do_rm_work)
initramfs-ostree-lmp-image.bb:do_rm_work)
ostree-kernel-initramfs_0.0.1.bb:do_package)
ostree-kernel-initramfs_0.0.1.bb:do_packagedata)
ostree-kernel-initramfs_0.0.1.bb:do_package_qa)
ostree-kernel-initramfs_0.0.1.bb:do_package_write_ipk)
ostree-kernel-initramfs_0.0.1.bb:do_rm_work)
lmp-base-console-image.bb:do_rootfs)
lmp-base-console-image.bb:do_write_qemuboot_conf)
lmp-base-console-image.bb:do_flush_pseudodb)
lmp-base-console-image.bb:do_image_qa)
lmp-base-console-image.bb:do_image)
lmp-base-console-image.bb:do_rootfs_wicenv)
lmp-base-console-image.bb:do_write_wks_template)
lmp-base-console-image.bb:do_image_ostree)
lmp-base-console-image.bb:do_image_ostreecommit)
lmp-base-console-image.bb:do_image_ostreepush)
lmp-base-console-image.bb:do_image_ota)
lmp-base-console-image.bb:do_image_garagesign)
lmp-base-console-image.bb:do_image_garagecheck)
lmp-base-console-image.bb:do_image_ota_esp)
lmp-base-console-image.bb:do_image_ota_ext4)
lmp-base-console-image.bb:do_image_wic)
lmp-base-console-image.bb:do_image_complete)
lmp-base-console-image.bb:do_populate_lic_deploy)
lmp-base-console-image.bb:do_rm_work)
lmp-base-console-image.bb:do_rm_work_all)
lmp-base-console-image.bb:do_build)

@quaresmajose
Copy link
Copy Markdown
Member Author

Tests for UBOOT_SIGN and for UBOOT_SPL_SIGN are still pending.

@quaresmajose quaresmajose changed the title Force rebuilding kernel/modules when the sign keys changes base: Add lmp-signing Oct 18, 2023
Comment thread meta-lmp-base/classes/lmp-signing.bbclass Outdated
@ricardosalveti
Copy link
Copy Markdown
Member

Nice, looks fine from the code perspective, we should be good once you finish testing/validating with the u-boot based keys.

@quaresmajose
Copy link
Copy Markdown
Member Author

quaresmajose commented Oct 19, 2023

The UBOOT_SIGN_KEYDIR keys can be tested with the machine qemuarm64-secureboot :

# populate the sstate-cache
echo 'require conf/sign.conf' >> conf/auto.conf
echo > conf/sign.conf
bitbake lmp-base-console-image

# generate new keys to invalidate the sstate-cache
rm -rf conf/keys_test; cp -r conf/keys conf/keys_test
openssl genpkey -algorithm RSA -out conf/keys_test/ubootdev.key -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537
openssl req -batch -new -x509 -key conf/keys_test/ubootdev.key -out conf/keys_test/ubootdev.crt
echo 'UBOOT_SIGN_KEYDIR = "${TOPDIR}/conf/keys_test"' > conf/sign.conf
bitbake lmp-base-console-image

As can be see every task that uses the keys will run again:

$ grep Running tmp-lmp/log/cooker/*/console-latest.log | rev | cut -d'/' -f 1 | rev
linux-lmp_6.1.bb:do_kernel_generate_rsa_keys)
linux-lmp_6.1.bb:do_assemble_fitimage)
initramfs-ostree-lmp-image.bb:do_fetch)
initramfs-ostree-lmp-image.bb:do_prepare_recipe_sysroot)
initramfs-ostree-lmp-recovery.bb:do_fetch)
initramfs-ostree-lmp-recovery.bb:do_prepare_recipe_sysroot)
initramfs-ostree-lmp-recovery.bb:do_unpack)
u-boot-ostree-scr-fit.bb:do_fetch)
ostree-kernel-initramfs_0.0.1.bb:do_fetch)
ostree-kernel-initramfs_0.0.1.bb:do_unpack)
ostree-kernel-initramfs_0.0.1.bb:do_patch)
lmp-base-console-image.bb:do_fetch)
linux-lmp_6.1.bb:do_install)
u-boot-ostree-scr-fit.bb:do_prepare_recipe_sysroot)
u-boot-ostree-scr-fit.bb:do_unpack)
lmp-base-console-image.bb:do_unpack)
u-boot-ostree-scr-fit.bb:do_patch)
u-boot-ostree-scr-fit.bb:do_deploy_source_date_epoch)
u-boot-ostree-scr-fit.bb:do_configure)
u-boot-ostree-scr-fit.bb:do_compile)
u-boot-ostree-scr-fit.bb:do_install)
u-boot-ostree-scr-fit.bb:do_package)
u-boot-ostree-scr-fit.bb:do_deploy)
u-boot-ostree-scr-fit.bb:do_populate_sysroot)
linux-lmp_6.1.bb:do_package)
linux-lmp_6.1.bb:do_populate_sysroot)
lmp-base-console-image.bb:do_prepare_recipe_sysroot)
u-boot-ostree-scr-fit.bb:do_packagedata)
u-boot-ostree-scr-fit.bb:do_package_qa)
u-boot-ostree-scr-fit.bb:do_package_write_ipk)
ostree-kernel-initramfs_0.0.1.bb:do_prepare_recipe_sysroot)
ostree-kernel-initramfs_0.0.1.bb:do_configure)
ostree-kernel-initramfs_0.0.1.bb:do_compile)
u-boot-ostree-scr-fit.bb:do_rm_work)
linux-lmp_6.1.bb:do_packagedata)
linux-lmp_6.1.bb:do_package_qa)
linux-lmp_6.1.bb:do_package_write_ipk)
initramfs-ostree-lmp-image.bb:do_rootfs)
initramfs-ostree-lmp-recovery.bb:do_rootfs)
initramfs-ostree-lmp-image.bb:do_write_qemuboot_conf)
initramfs-ostree-lmp-image.bb:do_flush_pseudodb)
initramfs-ostree-lmp-image.bb:do_image_qa)
initramfs-ostree-lmp-image.bb:do_image)
initramfs-ostree-lmp-image.bb:do_image_cpio)
initramfs-ostree-lmp-image.bb:do_image_complete)
initramfs-ostree-lmp-recovery.bb:do_write_qemuboot_conf)
initramfs-ostree-lmp-recovery.bb:do_flush_pseudodb)
initramfs-ostree-lmp-recovery.bb:do_image_qa)
linux-lmp_6.1.bb:do_bundle_initramfs)
initramfs-ostree-lmp-recovery.bb:do_image)
initramfs-ostree-lmp-recovery.bb:do_image_cpio)
initramfs-ostree-lmp-recovery.bb:do_image_complete)
linux-lmp_6.1.bb:do_assemble_fitimage_initramfs)
linux-lmp_6.1.bb:do_deploy)
ostree-kernel-initramfs_0.0.1.bb:do_install)
initramfs-ostree-lmp-recovery.bb:do_populate_lic_deploy)
initramfs-ostree-lmp-image.bb:do_populate_lic_deploy)
initramfs-ostree-lmp-recovery.bb:do_rm_work)
initramfs-ostree-lmp-image.bb:do_rm_work)
ostree-kernel-initramfs_0.0.1.bb:do_package)
ostree-kernel-initramfs_0.0.1.bb:do_packagedata)
ostree-kernel-initramfs_0.0.1.bb:do_package_qa)
ostree-kernel-initramfs_0.0.1.bb:do_package_write_ipk)
ostree-kernel-initramfs_0.0.1.bb:do_rm_work)
lmp-base-console-image.bb:do_rootfs)
lmp-base-console-image.bb:do_write_qemuboot_conf)
lmp-base-console-image.bb:do_flush_pseudodb)
lmp-base-console-image.bb:do_image_qa)
lmp-base-console-image.bb:do_image)
lmp-base-console-image.bb:do_rootfs_wicenv)
lmp-base-console-image.bb:do_write_wks_template)
lmp-base-console-image.bb:do_image_ostree)
lmp-base-console-image.bb:do_image_ostreecommit)
lmp-base-console-image.bb:do_image_ota)
lmp-base-console-image.bb:do_image_ostreepush)
lmp-base-console-image.bb:do_image_garagesign)
lmp-base-console-image.bb:do_image_garagecheck)
lmp-base-console-image.bb:do_image_ota_ext4)
lmp-base-console-image.bb:do_image_wic)
lmp-base-console-image.bb:do_image_complete)
lmp-base-console-image.bb:do_populate_lic_deploy)
lmp-base-console-image.bb:do_rm_work)
lmp-base-console-image.bb:do_rm_work_all)
lmp-base-console-image.bb:do_build)

@quaresmajose
Copy link
Copy Markdown
Member Author

quaresmajose commented Oct 19, 2023

The UBOOT_SIGN_KEYDIR SPL keys can be tested with the machine lmp-uz3eg-iocc-ebbr-sec:

# populate the sstate-cache
echo 'require conf/sign.conf' >> conf/auto.conf
echo > conf/sign.conf
bitbake lmp-base-console-image

# generate new keys to invalidate the sstate-cache
rm -rf conf/keys_test; cp -r conf/keys conf/keys_test
openssl genpkey -algorithm RSA -out conf/keys_test/spldev.key -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537
openssl req -batch -new -x509 -key conf/keys_test/spldev.key -out conf/keys_test/spldev.crt
echo 'UBOOT_SIGN_KEYDIR = "${TOPDIR}/conf/keys_test"' > conf/sign.conf
bitbake lmp-base-console-image

As can be see every task that uses the keys will run again:

$ grep Running tmp-lmp/log/cooker/*/console-latest.log | rev | cut -d'/' -f 1 | rev
efitools_git.bb:do_package_write_ipk_setscene)
base-files-issue.bb:do_package_write_ipk_setscene)
optee-fiovb_git.bb:do_package_write_ipk_setscene)
optee-os-fio_3.20.0.bb:do_package_write_ipk_setscene)
optee-os-tadevkit_3.20.0.bb:do_package_write_ipk_setscene)
optee-test_3.20.0.bb:do_package_write_ipk_setscene)
lmp-device-register_git.bb:do_package_write_ipk_setscene)
bitstream-signed.bb:do_package_write_ipk_setscene)
aktualizr-hwid.bb:do_package_write_ipk_setscene)
aktualizr_git.bb:do_package_write_ipk_setscene)
ostree-kernel-initramfs_0.0.1.bb:do_package_write_ipk_setscene)
external-hdf.bb:do_package_write_ipk_setscene)
arm-trusted-firmware_2022.1.bb:do_package_write_ipk_setscene)
device-tree.bb:do_package_write_ipk_setscene)
pmufw.bb:do_package_write_ipk_setscene)
pmu-firmware_2022.1.bb:do_package_write_ipk_setscene)
efibootmgr_17.bb:do_package_write_ipk_setscene)
efivar_38.bb:do_package_write_ipk_setscene)
grub-bootconf_1.00.bb:do_package_write_ipk_setscene)
grub-efi_2.06.bb:do_package_write_ipk_setscene)
grub_2.06.bb:do_package_write_ipk_setscene)
base-files_3.0.14.bb:do_package_write_ipk_setscene)
initramfs-framework_1.0.bb:do_package_write_ipk_setscene)
os-release.bb:do_package_write_ipk_setscene)
packagegroup-base.bb:do_package_write_ipk_setscene)
packagegroup-core-boot.bb:do_package_write_ipk_setscene)
systemd-conf_1.0.bb:do_package_write_ipk_setscene)
shadow-securetty_4.6.bb:do_package_write_ipk_setscene)
linux-firmware_20230625.bb:do_package_write_ipk_setscene)
u-boot-ostree-scr-fit.bb:do_fetch)
u-boot-xlnx_2022.01.bb:do_fetch)
u-boot-ostree-scr-fit.bb:do_prepare_recipe_sysroot)
u-boot-ostree-scr-fit.bb:do_unpack)
u-boot-xlnx_2022.01.bb:do_unpack)
u-boot-ostree-scr-fit.bb:do_patch)
initramfs-ostree-lmp-image.bb:do_populate_lic_deploy)
u-boot-ostree-scr-fit.bb:do_configure)
u-boot-ostree-scr-fit.bb:do_compile)
u-boot-ostree-scr-fit.bb:do_install)
initramfs-ostree-lmp-image.bb:do_rm_work)
lmp-boot-firmware.bb:do_fetch)
u-boot-ostree-scr-fit.bb:do_package)
u-boot-ostree-scr-fit.bb:do_deploy)
u-boot-ostree-scr-fit.bb:do_populate_sysroot)
u-boot-xlnx_2022.01.bb:do_patch)
lmp-boot-firmware.bb:do_unpack)
lmp-base-console-image.bb:do_fetch)
lmp-boot-firmware.bb:do_patch)
u-boot-xlnx_2022.01.bb:do_prepare_recipe_sysroot)
lmp-base-console-image.bb:do_unpack)
u-boot-ostree-scr-fit.bb:do_packagedata)
u-boot-ostree-scr-fit.bb:do_package_qa)
u-boot-ostree-scr-fit.bb:do_package_write_ipk)
u-boot-xlnx_2022.01.bb:do_configure)
u-boot-ostree-scr-fit.bb:do_rm_work)
u-boot-xlnx_2022.01.bb:do_compile)
u-boot-xlnx_2022.01.bb:do_uboot_generate_rsa_keys)
u-boot-xlnx_2022.01.bb:do_create_extlinux_config)
u-boot-xlnx_2022.01.bb:do_install)
u-boot-xlnx_2022.01.bb:do_uboot_assemble_fitimage)
u-boot-xlnx_2022.01.bb:do_deploy)
u-boot-xlnx_2022.01.bb:do_package)
u-boot-xlnx_2022.01.bb:do_populate_sysroot)
lmp-boot-firmware.bb:do_prepare_recipe_sysroot)
lmp-base-console-image.bb:do_prepare_recipe_sysroot)
lmp-boot-firmware.bb:do_configure)
lmp-boot-firmware.bb:do_compile)
u-boot-xlnx_2022.01.bb:do_packagedata)
u-boot-xlnx_2022.01.bb:do_package_qa)
u-boot-xlnx_2022.01.bb:do_package_write_ipk)
u-boot-xlnx_2022.01.bb:do_rm_work)
lmp-boot-firmware.bb:do_install)
lmp-boot-firmware.bb:do_package)
lmp-boot-firmware.bb:do_deploy)
lmp-boot-firmware.bb:do_populate_sysroot)
lmp-boot-firmware.bb:do_packagedata)
lmp-boot-firmware.bb:do_package_qa)
lmp-boot-firmware.bb:do_package_write_ipk)
lmp-boot-firmware.bb:do_rm_work)
lmp-base-console-image.bb:do_rootfs)
lmp-base-console-image.bb:do_flush_pseudodb)
lmp-base-console-image.bb:do_image_qa)
lmp-base-console-image.bb:do_image)
lmp-base-console-image.bb:do_image_cpio)
lmp-base-console-image.bb:do_rootfs_wicenv)
lmp-base-console-image.bb:do_image_ostree)
lmp-base-console-image.bb:do_image_ostreecommit)
lmp-base-console-image.bb:do_image_ota)
lmp-base-console-image.bb:do_image_ostreepush)
lmp-base-console-image.bb:do_image_garagesign)
lmp-base-console-image.bb:do_image_garagecheck)
lmp-base-console-image.bb:do_image_ota_ext4)
lmp-base-console-image.bb:do_image_wic)
lmp-base-console-image.bb:do_image_complete)
lmp-base-console-image.bb:do_populate_lic_deploy)
lmp-base-console-image.bb:do_rm_work)
lmp-base-console-image.bb:do_rm_work_all)
lmp-base-console-image.bb:do_build)

This bitbake class will store the hash of the keys files
so that all tasks using these keys will re-run when the
keys changed.
The main function add_varfiles_hash_to_vardeps_of_var is
used for adding the hash value of the files in 'varfiles'
on the 'var' variable dependency chain.

Signed-off-by: Jose Quaresma <[email protected]>
Start tracking keys content/hash changes into consideration
to invalidate sstate-cache.

Signed-off-by: Jose Quaresma <[email protected]>
@quaresmajose
Copy link
Copy Markdown
Member Author

Tests for UBOOT_SIGN and for UBOOT_SPL_SIGN are still pending.

Done and ready to merge

Copy link
Copy Markdown
Member

@ricardosalveti ricardosalveti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ricardosalveti ricardosalveti merged commit e624337 into foundriesio:main Oct 19, 2023
@quaresmajose quaresmajose deleted the lmp-staging-modsing branch October 19, 2023 16:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants