mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-09-24 04:59:14 -07:00
sys-kernel/gentoo-kernel-bin: set SECUREBOOT_SIGN_CERT to used cert
For these builds we use the same key for modules, kernel image and UKI. Therefore, certs/signing_key.x509 is the certificate that was used for secureboot signing and we can thus use it to verify in kernel-install.eclass that the signing was successful and to remove padding if required. Signed-off-by: Nowa Ammerlaan <nowa@gentoo.org>
This commit is contained in:
Nowa Ammerlaan
@@ -152,6 +152,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -152,6 +152,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -152,6 +152,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -152,6 +152,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -152,6 +152,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -152,6 +152,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -152,6 +152,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -152,6 +152,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -152,6 +152,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
@@ -157,6 +157,14 @@ src_configure() {
|
||||
|
||||
local image="${kernel_dir}/$(dist-kernel_get_image_path)"
|
||||
local uki="${image%/*}/uki.efi"
|
||||
|
||||
# Override user variable with the cert used during build
|
||||
openssl x509 \
|
||||
-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
|
||||
-outform PEM -out "${T}/cert.pem" ||
|
||||
die "Failed to convert pcrpkey to PEM format"
|
||||
export SECUREBOOT_SIGN_CERT=${T}/cert.pem
|
||||
|
||||
if [[ -s ${uki} ]]; then
|
||||
# We need to extract the plain image for the test phase
|
||||
# and USE=-generic-uki.
|
||||
|
||||
Reference in New Issue
Block a user