764d81db0a
This is done for moving packages that are related to secure boot
out of LAT and into integ.
Add efitools 1.9.2-1 for debian.
The patches for code and changes for debian build are ported from
layers ( meta-lat and meta-secure-core ) of yocto upstream.
Test Plan:
The tests are done with all the changes for this porting,
which involves efitools/shim/grub2/grub-efi/lat-sdk.sh, because
they are in a chain for secure boot verification.
- PASS: secure boot OK on qemu.
- PASS: secure boot OK on PowerEdge R430 lab.
- PASS: secure boot NG on qemu/hardware when shim/grub-efi images
are without the right signatures.
Story: 2009221
Task: 46400
Signed-off-by: Li Zhou <li.zhou@windriver.com>
Change-Id: I672f0c0182bf894d10c508b83b959eec47971ceb
34 lines
1.0 KiB
Diff
34 lines
1.0 KiB
Diff
From 35157f9762530271cabc78e645f02dc34b0c025c Mon Sep 17 00:00:00 2001
|
|
From: Yunguo Wei <yunguo.wei@windriver.com>
|
|
Date: Tue, 17 Jan 2017 17:24:51 +0800
|
|
Subject: [PATCH 3/5] Makefile: do not build signed efi image
|
|
|
|
Signed-off-by: Yunguo Wei <yunguo.wei@windriver.com>
|
|
---
|
|
Makefile | 5 ++---
|
|
1 file changed, 2 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/Makefile b/Makefile
|
|
index fc061a6..8e7a926 100644
|
|
--- a/Makefile
|
|
+++ b/Makefile
|
|
@@ -1,5 +1,4 @@
|
|
-EFIFILES = HelloWorld.efi LockDown.efi Loader.efi ReadVars.efi UpdateVars.efi \
|
|
- KeyTool.efi HashTool.efi SetNull.efi ShimReplace.efi
|
|
+EFIFILES = LockDown.efi
|
|
BINARIES = cert-to-efi-sig-list sig-list-to-certs sign-efi-sig-list \
|
|
hash-to-efi-sig-list efi-readvar efi-updatevar cert-to-efi-hash-list \
|
|
flash-var
|
|
@@ -30,7 +29,7 @@ include Make.rules
|
|
|
|
EFISIGNED = $(patsubst %.efi,%-signed.efi,$(EFIFILES))
|
|
|
|
-all: $(EFISIGNED) $(BINARIES) $(MANPAGES) noPK.auth $(KEYAUTH) \
|
|
+all: $(EFIFILES) $(BINARIES) $(MANPAGES) noPK.auth $(KEYAUTH) \
|
|
$(KEYUPDATEAUTH) $(KEYBLACKLISTAUTH) $(KEYHASHBLACKLISTAUTH)
|
|
|
|
|
|
--
|
|
2.17.1
|
|
|