From: Quirin Gylstorff <Quirin.Gylstorff@siemens.com>
To: cip-dev@lists.cip-project.org, felix.moessbauer@siemens.com,
jan.kiszka@siemens.com
Subject: [cip-dev][isar-cip-core][PATCH v3 1/6] swupdate: check output of sign-swu
Date: Tue, 5 Mar 2024 17:10:54 +0100 [thread overview]
Message-ID: <20240305161128.2777211-2-Quirin.Gylstorff@siemens.com> (raw)
In-Reply-To: <20240305161128.2777211-1-Quirin.Gylstorff@siemens.com>
From: Quirin Gylstorff <quirin.gylstorff@siemens.com>
Check for signing errors to avoid an unusable swu file.
This also moves the siging out of the loop to generate
the cpio archive *.swu as the Messages from the signing
can lead to errors in the archive generation. The cpio
options are no longer using the short form.
Use local variables to increase readability.
Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
classes/swupdate.bbclass | 44 ++++++++++++++++++++++++++++------------
1 file changed, 31 insertions(+), 13 deletions(-)
diff --git a/classes/swupdate.bbclass b/classes/swupdate.bbclass
index aaff072..31cfc4e 100644
--- a/classes/swupdate.bbclass
+++ b/classes/swupdate.bbclass
@@ -191,24 +191,42 @@ IMAGE_CMD:swu() {
"${PP_WORK}/$swu_file_base/${SWU_DESCRIPTION_FILE}"
done
cd "${PP_WORK}/$swu_file_base"
- for file in "${SWU_DESCRIPTION_FILE}" ${SWU_ADDITIONAL_FILES}; do
- if [ "$file" = "${SWU_DESCRIPTION_FILE}" ] || \
- grep -q "$file" "${PP_WORK}/$swu_file_base/${SWU_DESCRIPTION_FILE}"; then
+ cpio_files="${SWU_DESCRIPTION_FILE}"
+
+ if [ -n "$sign" ]; then
+ signature_file="${SWU_DESCRIPTION_FILE}.${SWU_SIGNATURE_EXT}"
+ if ! /usr/bin/sign-swu \
+ "${SWU_DESCRIPTION_FILE}" "$signature_file" \
+ > /dev/null 2>&1 || \
+ [ ! -f "$signature_file" ]; then
+ echo "Could not create swupdate signature file '$signature_file'" 1>&2
+ exit 1
+ fi
+ cpio_files="$cpio_files $signature_file"
+ fi
+
+ # sw-description must be first file in *.swu
+ for cpio_file in $cpio_files ${SWU_ADDITIONAL_FILES}; do
+ if [ -f "$cpio_file" ]; then
# Set file timestamps for reproducible builds
if [ -n "${SOURCE_DATE_EPOCH}" ]; then
touch -d@"${SOURCE_DATE_EPOCH}" "$file"
fi
- echo "$file"
- if [ -n "$sign" -a "${SWU_DESCRIPTION_FILE}" = "$file" ]; then
- sign-swu "$file" "$file.${SWU_SIGNATURE_EXT}"
- # Set file timestamps for reproducible builds
- if [ -n "${SOURCE_DATE_EPOCH}" ]; then
- touch -d@"${SOURCE_DATE_EPOCH}" "$file.${SWU_SIGNATURE_EXT}"
- fi
- echo "$file.${SWU_SIGNATURE_EXT}"
- fi
+ case "$cpio_file" in
+ sw-description*)
+ echo "$cpio_file"
+ ;;
+ *)
+ if grep -q "$cpio_file" \
+ "${WORKDIR}/$swu_file_base/${SWU_DESCRIPTION_FILE}"; then
+ echo "$cpio_file"
+ fi
+ ;;
+ esac
fi
- done | cpio -ovL --reproducible -H crc > "${PP_DEPLOY}/${SWU_IMAGE_FILE}$swu_file_extension.swu"
+ done | cpio \
+ --verbose --dereference --create --reproducible --format=crc \
+ > "${PP_DEPLOY}/${SWU_IMAGE_FILE}$swu_file_extension.swu"
EOIMAGER
done
}
--
2.43.0
next prev parent reply other threads:[~2024-03-05 16:11 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-05 16:10 [cip-dev][isar-cip-core][PATCH v3 0/6] Make swupdate signing more robust Quirin Gylstorff
2024-03-05 16:10 ` Quirin Gylstorff [this message]
2024-03-05 16:10 ` [cip-dev][isar-cip-core][PATCH v3 2/6] sign-swu-cms: check if key and cert are valid Quirin Gylstorff
2024-03-05 16:10 ` [cip-dev][isar-cip-core][PATCH v3 3/6] doc: Add section about SWUpdate signing to README.swupdate.md Quirin Gylstorff
2024-03-05 16:10 ` [cip-dev][isar-cip-core][PATCH v3 4/6] fix do not add files to each image recipe Quirin Gylstorff
2024-03-05 16:10 ` [cip-dev][isar-cip-core][PATCH v3 5/6] format: classes/efibootguard fix spacing Quirin Gylstorff
2024-03-05 16:10 ` [cip-dev][isar-cip-core][PATCH v3 6/6] format: classes/swupdate fix parenthesis Quirin Gylstorff
2024-03-12 8:40 ` [cip-dev][isar-cip-core][PATCH v3 0/6] Make swupdate signing more robust Jan Kiszka
2024-03-12 18:12 ` Gylstorff Quirin
2024-03-12 18:50 ` Gylstorff Quirin
2024-03-12 19:21 ` Jan Kiszka
2024-03-13 7:57 ` Gylstorff Quirin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240305161128.2777211-2-Quirin.Gylstorff@siemens.com \
--to=quirin.gylstorff@siemens.com \
--cc=cip-dev@lists.cip-project.org \
--cc=felix.moessbauer@siemens.com \
--cc=jan.kiszka@siemens.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.