diff options
| author |   Andrew Ammerlaan <andrewammerlaan@gentoo.org> | 2023-08-26 21:26:46 +0200 |
|---|---|---|
| committer | Andrew Ammerlaan <andrewammerlaan@gentoo.org> | 2023-08-27 21:36:06 +0200 |
| commit | a740d65d10a325c3a5977036eb9f410e452db925 (patch) | |
| tree | fe0fdf8474adaa0fafe0c4cd21ed679d2317a1bd /eclass/kernel-build.eclass | |
| parent | secureboot.eclass: secureboot_sign_efi_file allow call with 1 arg (diff) | |
| download | gentoo-a740d65d10a325c3a5977036eb9f410e452db925.tar.gz gentoo-a740d65d10a325c3a5977036eb9f410e452db925.tar.bz2 gentoo-a740d65d10a325c3a5977036eb9f410e452db925.zip | |
kernel-build.eclass: sign the kernel image earlier in src_install
By signing it in src_install instead of pkg_postinst the signed version is
included in any generated binpkg. This is useful for enabling secureboot
on machines that do not have the secureboot private key available.
This change makes it possible to distribute a signed kernel image in
sys-kernel/gentoo-kernel-bin.
Note, UKIs are always generated locally, so if UKIs are used these will still
have to be signed in pkg_postinst and therefore the private key is still
required on all systems with USE=secureboot and uefi=yes in dracut.conf.
Signed-off-by: Andrew Ammerlaan <andrewammerlaan@gentoo.org>
Diffstat (limited to 'eclass/kernel-build.eclass')
| -rw-r--r-- | eclass/kernel-build.eclass | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/eclass/kernel-build.eclass b/eclass/kernel-build.eclass index 5b324e036c5f..ca105ee1f133 100644 --- a/eclass/kernel-build.eclass +++ b/eclass/kernel-build.eclass @@ -33,6 +33,7 @@ if [[ ${KERNEL_IUSE_MODULES_SIGN} ]]; then # If we have enabled module signing IUSE # then we can also enable secureboot IUSE KERNEL_IUSE_SECUREBOOT=1 + inherit secureboot fi inherit multiprocessing python-any-r1 savedconfig toolchain-funcs kernel-install @@ -348,6 +349,10 @@ kernel-build_src_install() { dosym "../../../${kernel_dir}" "/lib/modules/${module_ver}/build" dosym "../../../${kernel_dir}" "/lib/modules/${module_ver}/source" + if [[ ${KERNEL_IUSE_SECUREBOOT} ]]; then + secureboot_sign_efi_file "${ED}${kernel_dir}/${image_path}" + fi + # unset to at least be out of the environment file in, e.g. shared binpkgs unset KBUILD_SIGN_PIN |