@@ -166,8 +166,8 @@ local_conf_header:
INITRAMFS_INSTALL:remove = "initramfs-abrootfs-hook"
secure-boot: |
- IMAGER_BUILD_DEPS += "ebg-secure-boot-signer"
- IMAGER_INSTALL:wic += "ebg-secure-boot-signer"
+ IMAGER_BUILD_DEPS += "sign-secure-image"
+ IMAGER_INSTALL:wic += "sign-secure-image"
# Use user-generated keys
PREFERRED_PROVIDER_secure-boot-secrets = "secure-boot-key"
@@ -347,13 +347,30 @@ host$ sudo umount /mnt
```
Launch KeyTool.efi binary from the built in EFI shell and follow step-4 from the section [Add Keys to OVMF](#add-keys-to-ovmf) to inject Secure Boot keys. Otherwise, consult the manual of the specific UEFI Firmware.
-Use the recipes [secure-boot-key](###secure-boot-key) to provided the keys
-to the signing script contained in
-[ebg-secure-boot-signer](###ebg-secure-boot-signer).
+### Signing efibootguard and Unified Kernel Image
-### [ebg-secure-boot-signer](./recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.2.bb)
+Use the recipes
+[secure-boot-secrets](###./recipes-devtools/sign-secure-image/secure-boot-secrets)
+to provide the secure boot keys to the signing script
+[sign-secure-image](./recipes-devtools/sign-secure-image/sign-secure-image_0.1.bb).
+`sign-secure-image` exports the attributes from the efi to be signed and requests signature from provided
+`ebg-secure-boot-signer` package. Then it imports the signature into the efi and verifies the signed efi with
+public key installed by `secure-boot-secrets`.
-During building a efibootguard based wic image the scripts contained in
-the recipe ebg-secure-boot-signer can be used to sign the bootloader and
-unified kernel image(UKI). If the keys are stored in a HSM the script can
-be exchanged to sign the artifacts in a more secure way.
+This layer provides a signer package
+[ebg-secure-boot-signer](./recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.3.bb)
+to be used in cases where both public and private keys are accessible at the project directory level.
+
+If there is a scenario where the private key cannot be accessed, such as HSM based signing or
+server side signing, `secure-boot-secrets` and `ebg-secure-boot-signer` can be provided from
+downstream layers for project specific requirements.
+
+```
+PREFERRED_PROVIDER_secure-boot-secrets = "<own secure boot secrets>"
+PREFERRED_PROVIDER_ebg-secure-boot-signer = "<own secure boot signer>"
+```
+
+The package `ebg-secure-boot-signer` must install its signing executable on `/usr/bin/sign-ebg`.
+This package may depend `secure-boot-signer` if it needs access to secure boot keys as done in this layer
+for signing or verification purposes. In such cases, secure boot keys should always be searched
+in designated locations as `secure-boot.pem` and `secure-boot.key` located in `/usr/share/secure-boot-secrets`.
@@ -25,8 +25,8 @@ local_conf_header:
INITRAMFS_INSTALL:remove = "initramfs-abrootfs-hook"
secure-boot: |
- IMAGER_BUILD_DEPS += "ebg-secure-boot-signer"
- IMAGER_INSTALL:wic += "ebg-secure-boot-signer"
+ IMAGER_BUILD_DEPS += "sign-secure-image"
+ IMAGER_INSTALL:wic += "sign-secure-image"
# Use snakeoil keys
PREFERRED_PROVIDER_secure-boot-secrets = "secure-boot-snakeoil"
similarity index 51%
rename from recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.2.bb
rename to recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.3.bb
@@ -1,7 +1,7 @@
#
# CIP Core, generic profile
#
-# Copyright (c) Siemens AG, 2020-2022
+# Copyright (c) Siemens AG, 2020-2025
#
# Authors:
# Quirin Gylstorff <quirin.gylstorff@siemens.com>
@@ -11,17 +11,19 @@
#
inherit dpkg-raw
+DPKG_ARCH = "all"
+
+PROVIDES = "ebg-secure-boot-signer"
+DEBIAN_PROVIDES = "ebg-secure-boot-signer"
DESCRIPTION = "Signing script for EFI Boot Guard setups"
DEPENDS = "secure-boot-secrets"
-DEBIAN_DEPENDS = "sbsigntool, secure-boot-secrets, faketime"
-DPKG_ARCH = "all"
+DEBIAN_DEPENDS = "secure-boot-secrets, openssl"
-SRC_URI = "file://sign_secure_image.sh"
+SRC_URI = "file://sign-ebg.sh"
+do_install[cleandirs] = "${D}/usr/bin/"
do_install() {
- TARGET=${D}/usr/bin
- install -d ${TARGET}
- install -m 755 ${WORKDIR}/sign_secure_image.sh ${TARGET}/sign_secure_image.sh
+ install -m 0755 ${WORKDIR}/sign-ebg.sh ${D}/usr/bin/sign-ebg
}
new file mode 100644
@@ -0,0 +1,34 @@
+#!/bin/sh
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2020-2025
+#
+# Authors:
+# Quirin Gylstorff <quirin.gylstorff@siemens.com>
+# Jan Kiszka <jan.kiszka@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+set -e
+
+signee=$1
+signature=$2
+
+usage(){
+ echo "sign image attributes with secure boot keys"
+ echo "$0 signee signature"
+ echo "signee: path to the image attributes to be signed"
+ echo "signature: path to store the signature"
+}
+
+if [ -z "$signee" ] || [ -z "$signature" ]; then
+ usage
+ exit 1
+fi
+
+keydir=/usr/share/secure-boot-secrets
+
+openssl dgst -binary -sha256 "${signee}" > "${signee}.digest"
+openssl pkeyutl -sign -in "${signee}.digest" -inkey "${keydir}/secure-boot.key" -pkeyopt digest:sha256 -keyform PEM -out "${signature}"
deleted file mode 100644
@@ -1,38 +0,0 @@
-#!/bin/sh
-#
-# CIP Core, generic profile
-#
-# Copyright (c) Siemens AG, 2020-2022
-#
-# Authors:
-# Quirin Gylstorff <quirin.gylstorff@siemens.com>
-# Jan Kiszka <jan.kiszka@siemens.com>
-#
-# SPDX-License-Identifier: MIT
-#
-
-set -e
-
-signee=$1
-signed=$2
-
-usage(){
- echo "sign with image keys"
- echo "$0 signee signed"
- echo "signee: path to the image to be signed"
- echo "signed: path to store the signed image"
-}
-
-if [ -z "$signee" ] || [ -z "$signed" ]; then
- usage
- exit 1
-fi
-
-keydir=/usr/share/secure-boot-secrets
-
-faketime_cmd=""
-if [ -n "$SOURCE_DATE_EPOCH" ]; then
- faketime_cmd="faketime -f \"$(TZ=UTC date -d @$SOURCE_DATE_EPOCH +'%Y-%m-%d %H:%M:%S')\""
-fi
-
-eval $faketime_cmd sbsign --key ${keydir}/secure-boot.key --cert ${keydir}/secure-boot.pem --output $signed $signee
new file mode 100644
@@ -0,0 +1,55 @@
+#!/bin/sh
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2025
+#
+# Authors:
+# Quirin Gylstorff <quirin.gylstorff@siemens.com>
+# Jan Kiszka <jan.kiszka@siemens.com>
+# Gokhan Cetin <gokhan.cetin@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+set -e
+
+signee=$1
+signed=$2
+
+usage(){
+ echo "sign image with secure boot signer"
+ echo "$0 signee signed"
+ echo "signee: path to the image to be signed"
+ echo "signed: path to store the signed image"
+}
+
+if [ -z "$signee" ] || [ -z "$signed" ]; then
+ usage
+ exit 1
+fi
+
+keydir=/usr/share/secure-boot-secrets
+
+tmpdir=$(mktemp -d)
+
+mkdir "${tmpdir}/certdb"
+certutil -d "${tmpdir}/certdb" cert.db -A -n cert -t ,,u -i "${keydir}/secure-boot.pem"
+
+pesign -i "$signee" -E "${tmpdir}/elf.sattrs"
+
+if [ ! -x /usr/bin/sign-ebg ]; then
+ echo "Could not find the executable '/usr/bin/sign-ebg'" 1>&2
+ exit 1
+fi
+
+if ! /usr/bin/sign-ebg "${tmpdir}/elf.sattrs" "${tmpdir}/elf.sattrs.sig" ; then
+ echo "Could not create signature file for '${signee}'" 1>&2
+ exit 1
+fi
+
+pesign -c cert -n "${tmpdir}/certdb" -R "${tmpdir}/elf.sattrs.sig" -I "${tmpdir}/elf.sattrs" -i "$signee" -o "$signed"
+
+rm -rf "${tmpdir}"
+
+sbverify "$signed" --cert "${keydir}/secure-boot.pem"
new file mode 100644
@@ -0,0 +1,27 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2025
+#
+# Authors:
+# Quirin Gylstorff <quirin.gylstorff@siemens.com>
+# Jan Kiszka <jan.kiszka@siemens.com>
+# Gokhan Cetin <gokhan.cetin@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+inherit dpkg-raw
+DPKG_ARCH = "all"
+
+DESCRIPTION = "Signing script wrapper for EFI Boot Guard"
+
+DEPENDS = "secure-boot-secrets ebg-secure-boot-signer"
+DEBIAN_DEPENDS = "secure-boot-secrets, ebg-secure-boot-signer, pesign, sbsigntool"
+
+SRC_URI = "file://sign_secure_image.sh"
+
+do_install[cleandirs] = "${D}/usr/bin/"
+do_install() {
+ install -m 755 ${WORKDIR}/sign_secure_image.sh ${D}/usr/bin/sign_secure_image.sh
+}
These changes split the signing process into two stages. In the first stage, the `sign-secure-image` script called by the efibootguard wic plugin now uses a hook to create a detached signature. This allows downstream layers to provide their own signer scripts in a similar manner for the second stage, without having to overwrite signer script or partition's source parameter. Signed-off-by: Gokhan Cetin <gokhan.cetin@siemens.com> --- doc/README.secureboot.md | 37 +++++++++---- kas/opt/ebg-secure-boot-snakeoil.yml | 4 +- ...r_0.2.bb => ebg-secure-boot-signer_0.3.bb} | 16 +++--- .../ebg-secure-boot-signer/files/sign-ebg.sh | 34 ++++++++++++ .../files/sign_secure_image.sh | 38 ------------- .../files/sign_secure_image.sh | 55 +++++++++++++++++++ .../sign-secure-image_0.1.bb | 27 +++++++++ 7 files changed, 154 insertions(+), 57 deletions(-) rename recipes-devtools/ebg-secure-boot-signer/{ebg-secure-boot-signer_0.2.bb => ebg-secure-boot-signer_0.3.bb} (51%) create mode 100644 recipes-devtools/ebg-secure-boot-signer/files/sign-ebg.sh delete mode 100644 recipes-devtools/ebg-secure-boot-signer/files/sign_secure_image.sh create mode 100644 recipes-devtools/sign-secure-image/files/sign_secure_image.sh create mode 100644 recipes-devtools/sign-secure-image/sign-secure-image_0.1.bb