[Buildroot] [PATCH 1/1] package/chipsec: new package

[Buildroot] [PATCH 1/1] package/chipsec: new package

[Tal Lubko via buildroot]

Signed-off-by: Tal Lubko <tallubko@yahoo.com>
---
 package/Config.in                             |  1 +
 ...ed-modules-instead-of-source-modules.patch | 27 +++++++++++++++++++
 package/chipsec/Config.in                     | 19 +++++++++++++
 package/chipsec/chipsec.hash                  |  3 +++
 package/chipsec/chipsec.mk                    | 23 ++++++++++++++++
 5 files changed, 73 insertions(+)
 create mode 100644 package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
 create mode 100644 package/chipsec/Config.in
 create mode 100644 package/chipsec/chipsec.hash
 create mode 100644 package/chipsec/chipsec.mk

diff --git a/package/Config.in b/package/Config.in
index 2f83c87582..ce73e2db72 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -2010,6 +2010,7 @@ endif
 endmenu
 
 menu "Security"
+	source "package/chipsec/Config.in"
 	source "package/libapparmor/Config.in"
 	source "package/libselinux/Config.in"
 	source "package/libsemanage/Config.in"
diff --git a/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch b/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
new file mode 100644
index 0000000000..08a87bf3cc
--- /dev/null
+++ b/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
@@ -0,0 +1,27 @@
+From fd67e6878daec7abeef649bb687464c832a04ee6 Mon Sep 17 00:00:00 2001
+From: Tal Lubko <tallubko@yahoo.com>
+Date: Wed, 22 Sep 2021 15:50:46 +0300
+Subject: [PATCH] search for compiled modules instead of source code modules
+
+change chipsec_main to search for compiled modules (PYCs) instead of
+source code modules (PYs).
+---
+ chipsec_main.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/chipsec_main.py b/chipsec_main.py
+index 1aa46ea..11cf9c6 100755
+--- a/chipsec_main.py
++++ b/chipsec_main.py
+@@ -215,7 +215,7 @@ class ChipsecMain:
+                 while len(subdirs) > 0:
+                     subdirs.pop()
+             for modx in mod_fnames:
+-                if fnmatch.fnmatch( modx, '*.py' ) and not fnmatch.fnmatch( modx, '__init__.py' ):
++                if fnmatch.fnmatch( modx, '*.pyc' ) and not fnmatch.fnmatch( modx, '__init__.pyc' ):
+                     self.load_module( os.path.join( dirname, modx ), self._module_argv )
+         self.Loaded_Modules.sort()
+ 
+-- 
+2.17.1
+
diff --git a/package/chipsec/Config.in b/package/chipsec/Config.in
new file mode 100644
index 0000000000..3da41c14a6
--- /dev/null
+++ b/package/chipsec/Config.in
@@ -0,0 +1,19 @@
+config BR2_PACKAGE_CHIPSEC
+	bool "chipsec"
+	depends on BR2_LINUX_KERNEL
+	depends on BR2_PACKAGE_PYTHON3
+	depends on BR2_i386 || BR2_x86_64
+	select BR2_PACKAGE_PYTHON_SETUPTOOLS # runtime
+
+	help
+	  CHIPSEC is a framework for analyzing the security of PC
+	  platforms including hardware, system firmware (BIOS/UEFI),
+	  and platform components. 
+
+	  https://github.com/chipsec/chipsec
+
+comment "chipsec needs a Linux kernel to be built"
+	depends on !BR2_LINUX_KERNEL
+
+comment "chipsec depends on python3"
+	depends on !BR2_PACKAGE_PYTHON3
diff --git a/package/chipsec/chipsec.hash b/package/chipsec/chipsec.hash
new file mode 100644
index 0000000000..344eb4fab8
--- /dev/null
+++ b/package/chipsec/chipsec.hash
@@ -0,0 +1,3 @@
+# Locally calculated
+sha256 0470326e00f66c91d751e9827d9e0050e3e4ac5b2bc7a9943a76381beda58162  chipsec-1.7.1.tar.gz
+sha256 4c2ca80f4d3675a53a216a64d67e7b411a81a6e958defd248c6f1ecf44dc6607  COPYING
diff --git a/package/chipsec/chipsec.mk b/package/chipsec/chipsec.mk
new file mode 100644
index 0000000000..96d96176cc
--- /dev/null
+++ b/package/chipsec/chipsec.mk
@@ -0,0 +1,23 @@
+################################################################################
+#
+# chipsec
+#
+################################################################################
+
+CHIPSEC_VERSION = 1.7.1
+CHIPSEC_SITE = $(call github,chipsec,chipsec,$(CHIPSEC_VERSION))
+CHIPSEC_SETUP_TYPE = setuptools
+CHIPSEC_LICENSE = GPL-2.0
+CHIPSEC_LICENSE_FILES = LICENSE
+CHIPSEC_DEPENDENCIES = linux
+CHIPSEC_ENV = KSRC=$(LINUX_DIR)
+CHIPSEC_BUILD_OPTS = build_ext -i
+
+CHIPSEC_POST_INSTALL_TARGET_HOOKS += CHIPSEC_INSTALL_LKM
+
+define CHIPSEC_INSTALL_LKM
+	$(INSTALL) -m 0644 -D $(@D)/chipsec/helper/linux/chipsec.ko \
+		$(TARGET_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages/chipsec/helper/linux
+endef
+
+$(eval $(python-package))
-- 
2.17.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/chipsec: new package

[Tal Lubko via buildroot]

[-- Attachment #1.1: Type: text/plain, Size: 5283 bytes --]

 Hi
I've submitted a patch which adds new package - chipsec, which is a framework for analyzing the security of PC platforms.
I haven't got a reply for this patch so I've got a feeling I've done something wrong.Have I?
Thanks,Tal
    On Friday, October 1, 2021, 04:54:58 AM GMT+3, Tal Lubko via buildroot <buildroot@buildroot.org> wrote:  
 
 Signed-off-by: Tal Lubko <tallubko@yahoo.com>
---
 package/Config.in                            |  1 +
 ...ed-modules-instead-of-source-modules.patch | 27 +++++++++++++++++++
 package/chipsec/Config.in                    | 19 +++++++++++++
 package/chipsec/chipsec.hash                  |  3 +++
 package/chipsec/chipsec.mk                    | 23 ++++++++++++++++
 5 files changed, 73 insertions(+)
 create mode 100644 package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
 create mode 100644 package/chipsec/Config.in
 create mode 100644 package/chipsec/chipsec.hash
 create mode 100644 package/chipsec/chipsec.mk

diff --git a/package/Config.in b/package/Config.in
index 2f83c87582..ce73e2db72 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -2010,6 +2010,7 @@ endif
 endmenu
 
 menu "Security"
+    source "package/chipsec/Config.in"
     source "package/libapparmor/Config.in"
     source "package/libselinux/Config.in"
     source "package/libsemanage/Config.in"
diff --git a/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch b/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
new file mode 100644
index 0000000000..08a87bf3cc
--- /dev/null
+++ b/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
@@ -0,0 +1,27 @@
+From fd67e6878daec7abeef649bb687464c832a04ee6 Mon Sep 17 00:00:00 2001
+From: Tal Lubko <tallubko@yahoo.com>
+Date: Wed, 22 Sep 2021 15:50:46 +0300
+Subject: [PATCH] search for compiled modules instead of source code modules
+
+change chipsec_main to search for compiled modules (PYCs) instead of
+source code modules (PYs).
+---
+ chipsec_main.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/chipsec_main.py b/chipsec_main.py
+index 1aa46ea..11cf9c6 100755
+--- a/chipsec_main.py
++++ b/chipsec_main.py
+@@ -215,7 +215,7 @@ class ChipsecMain:
+                while len(subdirs) > 0:
+                    subdirs.pop()
+            for modx in mod_fnames:
+-                if fnmatch.fnmatch( modx, '*.py' ) and not fnmatch.fnmatch( modx, '__init__.py' ):
++                if fnmatch.fnmatch( modx, '*.pyc' ) and not fnmatch.fnmatch( modx, '__init__.pyc' ):
+                    self.load_module( os.path.join( dirname, modx ), self._module_argv )
+        self.Loaded_Modules.sort()
+ 
+-- 
+2.17.1
+
diff --git a/package/chipsec/Config.in b/package/chipsec/Config.in
new file mode 100644
index 0000000000..3da41c14a6
--- /dev/null
+++ b/package/chipsec/Config.in
@@ -0,0 +1,19 @@
+config BR2_PACKAGE_CHIPSEC
+    bool "chipsec"
+    depends on BR2_LINUX_KERNEL
+    depends on BR2_PACKAGE_PYTHON3
+    depends on BR2_i386 || BR2_x86_64
+    select BR2_PACKAGE_PYTHON_SETUPTOOLS # runtime
+
+    help
+      CHIPSEC is a framework for analyzing the security of PC
+      platforms including hardware, system firmware (BIOS/UEFI),
+      and platform components. 
+
+      https://github.com/chipsec/chipsec
+
+comment "chipsec needs a Linux kernel to be built"
+    depends on !BR2_LINUX_KERNEL
+
+comment "chipsec depends on python3"
+    depends on !BR2_PACKAGE_PYTHON3
diff --git a/package/chipsec/chipsec.hash b/package/chipsec/chipsec.hash
new file mode 100644
index 0000000000..344eb4fab8
--- /dev/null
+++ b/package/chipsec/chipsec.hash
@@ -0,0 +1,3 @@
+# Locally calculated
+sha256 0470326e00f66c91d751e9827d9e0050e3e4ac5b2bc7a9943a76381beda58162  chipsec-1.7.1.tar.gz
+sha256 4c2ca80f4d3675a53a216a64d67e7b411a81a6e958defd248c6f1ecf44dc6607  COPYING
diff --git a/package/chipsec/chipsec.mk b/package/chipsec/chipsec.mk
new file mode 100644
index 0000000000..96d96176cc
--- /dev/null
+++ b/package/chipsec/chipsec.mk
@@ -0,0 +1,23 @@
+################################################################################
+#
+# chipsec
+#
+################################################################################
+
+CHIPSEC_VERSION = 1.7.1
+CHIPSEC_SITE = $(call github,chipsec,chipsec,$(CHIPSEC_VERSION))
+CHIPSEC_SETUP_TYPE = setuptools
+CHIPSEC_LICENSE = GPL-2.0
+CHIPSEC_LICENSE_FILES = LICENSE
+CHIPSEC_DEPENDENCIES = linux
+CHIPSEC_ENV = KSRC=$(LINUX_DIR)
+CHIPSEC_BUILD_OPTS = build_ext -i
+
+CHIPSEC_POST_INSTALL_TARGET_HOOKS += CHIPSEC_INSTALL_LKM
+
+define CHIPSEC_INSTALL_LKM
+    $(INSTALL) -m 0644 -D $(@D)/chipsec/helper/linux/chipsec.ko \
+        $(TARGET_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages/chipsec/helper/linux
+endef
+
+$(eval $(python-package))
-- 
2.17.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
  

[-- Attachment #1.2: Type: text/html, Size: 10321 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/chipsec: new package

[Thomas Petazzoni]

Hello,

On Fri, 1 Oct 2021 14:35:03 +0000 (UTC)
Tal Lubko <tallubko@yahoo.com> wrote:

> I've submitted a patch which adds new package - chipsec, which is a framework for analyzing the security of PC platforms.
> I haven't got a reply for this patch so I've got a feeling I've done something wrong.Have I?

No, you have not. You just need to give some time for the community to
review your patch. The current backlog of patches is ~390 patches to
review, which explains why not all patches receive immediate attention.

As long as you can see your patch at
https://patchwork.ozlabs.org/project/buildroot/list/ it means that it
hasn't been forgotten.

In any case, thanks a lot for your contribution!

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/chipsec: new package

[Arnout Vandecappelle]

  Hi Tal,

On 01/10/2021 03:54, Tal Lubko via buildroot wrote:
> Signed-off-by: Tal Lubko <tallubko@yahoo.com>
> ---
>   package/Config.in                             |  1 +
>   ...ed-modules-instead-of-source-modules.patch | 27 +++++++++++++++++++
>   package/chipsec/Config.in                     | 19 +++++++++++++
>   package/chipsec/chipsec.hash                  |  3 +++
>   package/chipsec/chipsec.mk                    | 23 ++++++++++++++++


  Please add yourself to the DEVELOPERS file [1] for this package. This way, 
you'll get an e-mail if the package fails in the autobuilders, or when a new 
version is released if the package is registered on release-monitoring.org.


>   5 files changed, 73 insertions(+)
>   create mode 100644 package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
>   create mode 100644 package/chipsec/Config.in
>   create mode 100644 package/chipsec/chipsec.hash
>   create mode 100644 package/chipsec/chipsec.mk
> 
> diff --git a/package/Config.in b/package/Config.in
> index 2f83c87582..ce73e2db72 100644
> --- a/package/Config.in
> +++ b/package/Config.in
> @@ -2010,6 +2010,7 @@ endif
>   endmenu
>   
>   menu "Security"
> +	source "package/chipsec/Config.in"
>   	source "package/libapparmor/Config.in"
>   	source "package/libselinux/Config.in"
>   	source "package/libsemanage/Config.in"
> diff --git a/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch b/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
> new file mode 100644
> index 0000000000..08a87bf3cc
> --- /dev/null
> +++ b/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
> @@ -0,0 +1,27 @@
> +From fd67e6878daec7abeef649bb687464c832a04ee6 Mon Sep 17 00:00:00 2001
> +From: Tal Lubko <tallubko@yahoo.com>
> +Date: Wed, 22 Sep 2021 15:50:46 +0300
> +Subject: [PATCH] search for compiled modules instead of source code modules
> +
> +change chipsec_main to search for compiled modules (PYCs) instead of
> +source code modules (PYs).

  Every patch must have a signed-off-by, to validate that it takes the license 
of the patched project rather then Buildroot's GPLv2.

  Also, please add a line with

Upstream: <URL>

with a URL that points to your upstream submission of the patch (pull request, 
most likely).

> +---
> + chipsec_main.py | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/chipsec_main.py b/chipsec_main.py
> +index 1aa46ea..11cf9c6 100755
> +--- a/chipsec_main.py
> ++++ b/chipsec_main.py
> +@@ -215,7 +215,7 @@ class ChipsecMain:
> +                 while len(subdirs) > 0:
> +                     subdirs.pop()
> +             for modx in mod_fnames:
> +-                if fnmatch.fnmatch( modx, '*.py' ) and not fnmatch.fnmatch( modx, '__init__.py' ):
> ++                if fnmatch.fnmatch( modx, '*.pyc' ) and not fnmatch.fnmatch( modx, '__init__.pyc' ):

  That's not the proper way to do this, since it may instead be a .pyo. Or it's 
possible that the module wasn't compiled yet and there really is only a .py. So 
you need to extend the fnmatch to match *.py, *.pyo and *.pyc.

> +                     self.load_module( os.path.join( dirname, modx ), self._module_argv )
> +         self.Loaded_Modules.sort()
> +
> +--
> +2.17.1
> +
> diff --git a/package/chipsec/Config.in b/package/chipsec/Config.in
> new file mode 100644
> index 0000000000..3da41c14a6
> --- /dev/null
> +++ b/package/chipsec/Config.in
> @@ -0,0 +1,19 @@
> +config BR2_PACKAGE_CHIPSEC
> +	bool "chipsec"
> +	depends on BR2_LINUX_KERNEL
> +	depends on BR2_PACKAGE_PYTHON3

  We generally prefer a select instead of depends in this case (since it's not 
immediately obvious that chipsec is a Python program). Of course, that means you 
have to propagate the dependencies of python3. See e.g. libsigrokdecode.

> +	depends on BR2_i386 || BR2_x86_64
> +	select BR2_PACKAGE_PYTHON_SETUPTOOLS # runtime

  I haven't checked, but does this package really require setuptools at runtime? 
That's pretty unusual.

> +
> +	help
> +	  CHIPSEC is a framework for analyzing the security of PC
> +	  platforms including hardware, system firmware (BIOS/UEFI),
> +	  and platform components.
> +
> +	  https://github.com/chipsec/chipsec
> +
> +comment "chipsec needs a Linux kernel to be built"
> +	depends on !BR2_LINUX_KERNEL

  You need to include the architecture dependencies here:

	depends on BR2_i386 || BR2_x86_64

We don't want to show the comment if the package can't be selected anyway.

> +
> +comment "chipsec depends on python3"
> +	depends on !BR2_PACKAGE_PYTHON3
> diff --git a/package/chipsec/chipsec.hash b/package/chipsec/chipsec.hash
> new file mode 100644
> index 0000000000..344eb4fab8
> --- /dev/null
> +++ b/package/chipsec/chipsec.hash
> @@ -0,0 +1,3 @@
> +# Locally calculated
> +sha256 0470326e00f66c91d751e9827d9e0050e3e4ac5b2bc7a9943a76381beda58162  chipsec-1.7.1.tar.gz

  Please use two spaces after "sha256" (like the two spaces that come after the 
hash itself).

> +sha256 4c2ca80f4d3675a53a216a64d67e7b411a81a6e958defd248c6f1ecf44dc6607  COPYING
> diff --git a/package/chipsec/chipsec.mk b/package/chipsec/chipsec.mk
> new file mode 100644
> index 0000000000..96d96176cc
> --- /dev/null
> +++ b/package/chipsec/chipsec.mk
> @@ -0,0 +1,23 @@
> +################################################################################
> +#
> +# chipsec
> +#
> +################################################################################
> +
> +CHIPSEC_VERSION = 1.7.1
> +CHIPSEC_SITE = $(call github,chipsec,chipsec,$(CHIPSEC_VERSION))
> +CHIPSEC_SETUP_TYPE = setuptools
> +CHIPSEC_LICENSE = GPL-2.0
> +CHIPSEC_LICENSE_FILES = LICENSE
> +CHIPSEC_DEPENDENCIES = linux
> +CHIPSEC_ENV = KSRC=$(LINUX_DIR)
> +CHIPSEC_BUILD_OPTS = build_ext -i

  It would be good to document why these are needed.

> +
> +CHIPSEC_POST_INSTALL_TARGET_HOOKS += CHIPSEC_INSTALL_LKM

  We normally put this just after the definition of the hook, not before it.

> +
> +define CHIPSEC_INSTALL_LKM
> +	$(INSTALL) -m 0644 -D $(@D)/chipsec/helper/linux/chipsec.ko \
> +		$(TARGET_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages/chipsec/helper/linux
> +endef

  We generally prefer to use Buildroot's infrastructure to build kernel modules 
[2]. That takes care of the depmod, and passing the correct CFLAGS etc. to the 
kernel build system.

  However, in this case, it apparently needs to be installed in a nonstandard 
location. If that really is the case, then this way is probably better. But 
please add a comment to explain why.


  Regards,
  Arnout

[1] https://buildroot.org/downloads/manual/manual.html#DEVELOPERS
[2] https://buildroot.org/manual.html#kernel-module-tutorial

> +
> +$(eval $(python-package))
> 

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/chipsec: new package

[Tal Lubko via buildroot]

[-- Attachment #1.1: Type: text/plain, Size: 1371 bytes --]

 Hi
I've resubmitted the patch for chipsec few days ago.I can't find any sign to it here https://patchwork.ozlabs.org/project/buildroot/list/ and I haven't got any mail with comments.
How can I know the patch state?
Regards,Tal
    On Friday, October 1, 2021, 05:41:06 PM GMT+3, Thomas Petazzoni <thomas.petazzoni@bootlin.com> wrote:  
 
 Hello,

On Fri, 1 Oct 2021 14:35:03 +0000 (UTC)
Tal Lubko <tallubko@yahoo.com> wrote:

> I've submitted a patch which adds new package - chipsec, which is a framework for analyzing the security of PC platforms.
> I haven't got a reply for this patch so I've got a feeling I've done something wrong.Have I?

No, you have not. You just need to give some time for the community to
review your patch. The current backlog of patches is ~390 patches to
review, which explains why not all patches receive immediate attention.

As long as you can see your patch at
https://patchwork.ozlabs.org/project/buildroot/list/ it means that it
hasn't been forgotten.

In any case, thanks a lot for your contribution!

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
  

[-- Attachment #1.2: Type: text/html, Size: 3453 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot