vyos/vyos-build
1
0
Fork 0
mirror of https://github.com/vyos/vyos-build.git synced 2025-10-01 20:28:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

T861: use secure-boot certificates from data/certificates

Browse Source
This commit is contained in:
Christian Breunig 2025-03-16 20:10:09 +01:00
parent 8d58a72368
commit a02b10b2ba
4 changed files with 6 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -7,7 +7,6 @@ packer_cache/*
key/*
packages/*
!packages/*/
data/live-build-config/includes.chroot/var/lib/shim-signed/mok/*
/testinstall*.img
/testinstall*.efivars
/*.qcow2

1
data/certificates/.gitignore vendored Normal file
View File

@ -0,0 +1 @@
*.key

11
data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md
View File

@ -1,11 +0,0 @@
# Secure Boot
## CA
Create Certificate Authority used for Kernel signing. CA is loaded into the
Machine Owner Key store on the target system.
```bash
openssl req -new -x509 -newkey rsa:4096 -keyout MOK.key -outform DER -out MOK.der -days 36500 -subj "/CN=VyOS Secure Boot CA/" -nodes
openssl x509 -inform der -in MOK.der -out MOK.pem
```

5
scripts/image-build/build-vyos-image
View File

@ -367,6 +367,11 @@ if __name__ == "__main__":
shutil.copytree("data/live-build-config/", lb_config_dir)
os.makedirs(lb_config_dir, exist_ok=True)
## Secure Boot - Copy public Keys to image
sb_certs = 'data/certificates'
if os.path.isdir(sb_certs):
shutil.copytree(sb_certs, f'{lb_config_dir}/includes.chroot/var/lib/shim-signed/mok')
# Switch to the build directory, this is crucial for the live-build work
# because the efective build config files etc. are there.
#