mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-09-25 23:51:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

eclass/secureboot: Sync with Gentoo

Browse Source 
It's from Gentoo commit f6642547cd274ab4edd7d34b71674d1aa04a2d74.
This commit is contained in:
Krzesimir Nowak 2024-08-02 16:04:37 +02:00
parent b6b431290b
commit 1fe3c81c7b
1 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
sdk_container/src/third_party/portage-stable/eclass/secureboot.eclass vendored
View File

@ -1,4 +1,4 @@
# Copyright 1999-2023 Gentoo Authors # Copyright 1999-2024 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2 # Distributed under the terms of the GNU General Public License v2
# @ECLASS: secureboot.eclass # @ECLASS: secureboot.eclass
@ -44,7 +44,12 @@ case ${EAPI} in
esac esac
IUSE="secureboot" IUSE="secureboot"
BDEPEND="secureboot? ( app-crypt/sbsigntools )" BDEPEND="
secureboot? (
app-crypt/sbsigntools
dev-libs/openssl
)
"
# @ECLASS_VARIABLE: SECUREBOOT_SIGN_KEY # @ECLASS_VARIABLE: SECUREBOOT_SIGN_KEY
# @USER_VARIABLE # @USER_VARIABLE
@ -75,12 +80,19 @@ _secureboot_die_if_unset() {
if [[ -z ${SECUREBOOT_SIGN_KEY} || -z ${SECUREBOOT_SIGN_CERT} ]]; then if [[ -z ${SECUREBOOT_SIGN_KEY} || -z ${SECUREBOOT_SIGN_CERT} ]]; then
die "USE=secureboot enabled but SECUREBOOT_SIGN_KEY and/or SECUREBOOT_SIGN_CERT not set." die "USE=secureboot enabled but SECUREBOOT_SIGN_KEY and/or SECUREBOOT_SIGN_CERT not set."
fi fi
if [[ ! ${SECUREBOOT_SIGN_KEY} == pkcs11:* && ! -r ${SECUREBOOT_SIGN_KEY} ]]; then
die "SECUREBOOT_SIGN_KEY=${SECUREBOOT_SIGN_KEY} not found or not readable!" # Sanity check: fail early if key/cert in DER format or does not exist
fi local openssl_args=(
if [[ ! -r ${SECUREBOOT_SIGN_CERT} ]]; then -inform PEM -in "${SECUREBOOT_SIGN_CERT}"
die "SECUREBOOT_SIGN_CERT=${SECUREBOOT_SIGN_CERT} not found or not readable!" -noout -nocert
)
if [[ ${SECUREBOOT_SIGN_KEY} == pkcs11:* ]]; then
openssl_args+=( -engine pkcs11 -keyform ENGINE -key "${SECUREBOOT_SIGN_KEY}" )
else
openssl_args+=( -keyform PEM -key "${SECUREBOOT_SIGN_KEY}" )
fi fi
openssl x509 "${openssl_args[@]}" ||
die "Secure Boot signing certificate or key not found or not PEM format."
} }
# @FUNCTION: secureboot_pkg_setup # @FUNCTION: secureboot_pkg_setup