Yocto staged builds?

Yocto staged builds?

[Edmund Nadolski]

[-- Attachment #1: Type: text/plain, Size: 415 bytes --]

Hello list,

Can anyone pls. help me understand what Yocto/bitbake supports (or could support) in terms of staged builds?  IOW, something like this sequence that performs nested signing of binaries:


  *   Create and sign binary files (ie kernel, modules, dtb, ...).
  *   Create fs images from above and sign those.
  *   Create FIT images and sign.

Any/all thoughts greatly appreciated.

Ed





[-- Attachment #2: Type: text/html, Size: 5327 bytes --]

Re: Yocto staged builds?

[Burton, Ross]

On Tue, 18 Dec 2018 at 16:07, Edmund Nadolski
<Edmund.Nadolski@microsoft.com> wrote:
> Create and sign binary files (ie kernel, modules, dtb, …).

Kernel modules can be signed.  No idea about DTB.  Also packages can be signed.

> Create fs images from above and sign those.

Depends how you want to sign the image, most likely not hard to implement.

> Create FIT images and sign.

Pass.

Yocto is generally flexible enough that any signing that isn't
currently doesn't wouldn't be too difficult to add.

Ross

Re: Yocto staged builds?

[Edmund Nadolski]

> -----Original Message-----
> From: Burton, Ross <ross.burton@intel.com>
> Sent: Tuesday, December 18, 2018 12:48 PM
> To: Edmund Nadolski <Edmund.Nadolski@microsoft.com>
> Cc: Yocto-mailing-list <yocto@yoctoproject.org>
> Subject: Re: [yocto] Yocto staged builds?
> 
> On Tue, 18 Dec 2018 at 16:07, Edmund Nadolski
> <Edmund.Nadolski@microsoft.com> wrote:
> > Create and sign binary files (ie kernel, modules, dtb, …).
> 
> Kernel modules can be signed.  No idea about DTB.  Also packages can be
> signed.
> 
> > Create fs images from above and sign those.
> 
> Depends how you want to sign the image, most likely not hard to implement.
> 
> > Create FIT images and sign.
> 
> Pass.
> 
> Yocto is generally flexible enough that any signing that isn't currently doesn't
> wouldn't be too difficult to add.
> 
> Ross

Thanks Ross.  So sounds like it should be a matter of appending an addtask at the
relevant part of each recipe -- is it that straightforward or have I overlooked
anything important?

Ed

Re: Yocto staged builds?

[Burton, Ross]

On Fri, 21 Dec 2018 at 01:19, Edmund Nadolski
<Edmund.Nadolski@microsoft.com> wrote:
> > Yocto is generally flexible enough that any signing that isn't currently doesn't
> > wouldn't be too difficult to add.
>
> Thanks Ross.  So sounds like it should be a matter of appending an addtask at the
> relevant part of each recipe -- is it that straightforward or have I overlooked
> anything important?

Using a class you can add tasks for all recipes.  If you explain what
you're actually trying to do then we can give better advice.

Ross

Re: Yocto staged builds?

[Edmund Nadolski]

> -----Original Message-----
> From: Burton, Ross <ross.burton@intel.com>
> Sent: Friday, January 4, 2019 4:12 AM
> To: Edmund Nadolski <Edmund.Nadolski@microsoft.com>
> Cc: Yocto-mailing-list <yocto@yoctoproject.org>
> Subject: Re: [yocto] Yocto staged builds?
> 
> On Fri, 21 Dec 2018 at 01:19, Edmund Nadolski
> <Edmund.Nadolski@microsoft.com> wrote:
> > > Yocto is generally flexible enough that any signing that isn't
> > > currently doesn't wouldn't be too difficult to add.
> >
> > Thanks Ross.  So sounds like it should be a matter of appending an
> > addtask at the relevant part of each recipe -- is it that
> > straightforward or have I overlooked anything important?
> 
> Using a class you can add tasks for all recipes.  If you explain what you're
> actually trying to do then we can give better advice.

I'm thinking of a full build separated into say 3 sequential steps, A, B, and C, with each step being some series of bitbake tasks.   The idea is run all the tasks in step A and then regain control so I can run some additional tools/transforms on artifacts (eg signing) produced in that step.  Then, resume bitbake from step B, and after that completes then again regain control and run some additional transforms.  Finally resume bitbake from step C and let that run to completion as well.

I wasn't sure whether the bitbake has that sort of "pause and resume" capability, tho perhaps the addtask in the right places is one way to effect a similar result?

(Apologies, this is probably a lame/awkward description on my part)

Thanks again,
Ed

Re: Yocto staged builds?

[Burton, Ross]

On Tue, 8 Jan 2019 at 22:10, Edmund Nadolski
<Edmund.Nadolski@microsoft.com> wrote:
> I'm thinking of a full build separated into say 3 sequential steps, A, B, and C, with each step being some series of bitbake tasks.   The idea is run all the tasks in step A and then regain control so I can run some additional tools/transforms on artifacts (eg signing) produced in that step.  Then, resume bitbake from step B, and after that completes then again regain control and run some additional transforms.  Finally resume bitbake from step C and let that run to completion as well.
>
> I wasn't sure whether the bitbake has that sort of "pause and resume" capability, tho perhaps the addtask in the right places is one way to effect a similar result?
>
> (Apologies, this is probably a lame/awkward description on my part)

Don't do that.  Bitbake will have no knowledge of your intermediate
out-of-band changes.  Just write tasks that call the signing tools as
part of the build.

Ross