Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

meta-efi-secure-boot: switch from EFI_BOOT_PATH to EFI_FILES_PATH #90

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

Dvergatal
Copy link
Contributor

As meta-secure-core depends on openembedded-core, which defines already EFI_FILES_PATH in openembedded-core/meta/conf/image-uefi.conf, we should not define a new variable, but use already defined one.

@yizhao1
Copy link
Collaborator

yizhao1 commented Jan 26, 2025

I got the following error with your patch when building secure-core-image:

ERROR: secure-core-image-1.0-r0 do_rootfs: Could not invoke dnf. Command '/build/tmp/work/genericx86_64-poky-linux/secure-core-image/1.0/recipe-sysroot-native/usr/bin/dnf -v --rpmverbosity=info -y -c /build/tmp/work/genericx86_64-poky-linux/secure-core-image/1.0/rootfs/etc/dnf/dnf.conf --setopt=reposdir=/build/tmp/work/genericx86_64-poky-linux/secure-core-image/1.0/rootfs/etc/yum.repos.d --installroot=/build/tmp/work/genericx86_64-poky-linux/secure-core-image/1.0/rootfs --setopt=logdir=/build/tmp/work/genericx86_64-poky-linux/secure-core-image/1.0/temp --repofrompath=oe-repo,/build/tmp/work/genericx86_64-poky-linux/secure-core-image/1.0/oe-rootfs-repo --nogpgcheck install base-passwd dnf kernel-image-bzimage kernel-initramfs packagegroup-core-boot packagegroup-efi-secure-boot packagegroup-tpm2 run-postinsts shadow util-linux' returned 1:
[snip]
Transaction Summary

Install 325 Packages

Total size: 86 M
Installed size: 206 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Error: Transaction test error:
file /boot/EFI/BOOT/grub.cfg conflicts between attempted installs of grub-efi-2.12-r0.core2_64 and grub-bootconf-1.00-r0.genericx86_64

@Dvergatal
Copy link
Contributor Author

Dvergatal commented Jan 26, 2025

@yizhao1 yeah and I know exactly why this does not work, it's because by default grub-efi has a run dependency virtual-grub-bootconf and I have removed it in my layer's bbappend with RDEPENDS:${PN}:remove = "virtual-grub-bootconf" and I need to think how to do it properly within meta-secure-core layer, meaning if we should use grub-bootconf_1.00.bb or my remove.

P.S. To bo honest I would prefer move of all grub configuration file to grub-bootconf package

As meta-secure-core depends on openembedded-core, which defines already
EFI_FILES_PATH in `openembedded-core/meta/conf/image-uefi.conf`, we should
not define a new variable, but use already defined one.

Signed-off-by: Piotr Łobacz <p.lobacz@welotec.com>
@Dvergatal
Copy link
Contributor Author

Dvergatal commented Jan 26, 2025

@yizhao1 I have fixed it please verify if it is building for you, but do not merge it until I will add additional commits regarding movement of all other files which are supposed to be in grub-bootconf package instead in grub-efi.

P.S. in grub-bootconf_1.00.bb there is a a call bb.build.exec_func('build_efi_cfg', d) for grub config file generation and I'm willing to write a similar function for boot-menu.inc generation as everybody may want to generate such on his own per device.

By default grub-efi has set RDEPENDS:${PN} = "virtual-grub-bootconf",
which is grub-bootconf package. It is used for generation of boot
configuration file.

Currently it is not being used for generation, but signing it, when
secure boot is enabled, should be run in this recipe instead grub-efi,
as grub.cfg is part of it.

Signed-off-by: Piotr Łobacz <p.lobacz@welotec.com>
@yizhao1
Copy link
Collaborator

yizhao1 commented Jan 27, 2025

Thanks for the update. I'm on vacation now, I'll verify it as soon as I get back.

@Dvergatal
Copy link
Contributor Author

Dvergatal commented Jan 27, 2025

Thanks for the update. I'm on vacation now, I'll verify it as soon as I get back.

Hava a nice holidays 👍 Take your time don't rush I still need to implement a lot in here:P

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants