Commit f57fb375 authored by Ard Biesheuvel's avatar Ard Biesheuvel
Browse files

efi: libstub: Remove zboot signing from build options 



The zboot decompressor series introduced a feature to sign the PE/COFF
kernel image for secure boot as part of the kernel build. This was
necessary because there are actually two images that need to be signed:
the kernel with the EFI stub attached, and the decompressor application.

This is a bit of a burden, because it means that the images must be
signed on the the same system that performs the build, and this is not
realistic for distros.

During the next cycle, we will introduce changes to the zboot code so
that the inner image no longer needs to be signed. This means that the
outer PE/COFF image can be handled as usual, and be signed later in the
release process.

Let's remove the associated Kconfig options now so that they don't end
up in a LTS release while already being deprecated.

Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
parent 9abf2313

drivers/firmware/efi/Kconfig

+0 −22
Original line number Diff line number Diff line
@@ -124,28 +124,6 @@ config EFI_ZBOOT 
	  is supported by the encapsulated image. (The compression algorithm

	  used is described in the zboot image header)



config EFI_ZBOOT_SIGNED

	def_bool y

	depends on EFI_ZBOOT_SIGNING_CERT != ""

	depends on EFI_ZBOOT_SIGNING_KEY != ""



config EFI_ZBOOT_SIGNING

	bool "Sign the EFI decompressor for UEFI secure boot"

	depends on EFI_ZBOOT

	help

	  Use the 'sbsign' command line tool (which must exist on the host

	  path) to sign both the EFI decompressor PE/COFF image, as well as the

	  encapsulated PE/COFF image, which is subsequently compressed and

	  wrapped by the former image.



config EFI_ZBOOT_SIGNING_CERT

	string "Certificate to use for signing the compressed EFI boot image"

	depends on EFI_ZBOOT_SIGNING



config EFI_ZBOOT_SIGNING_KEY

	string "Private key to use for signing the compressed EFI boot image"

	depends on EFI_ZBOOT_SIGNING



config EFI_ARMSTUB_DTB_LOADER

	bool "Enable the DTB loader"

	depends on EFI_GENERIC_STUB && !RISCV && !LOONGARCH

drivers/firmware/efi/libstub/Makefile.zboot

+4 −25
Original line number Diff line number Diff line
@@ -20,18 +20,7 @@ zboot-size-len-y := 4 
zboot-method-$(CONFIG_KERNEL_GZIP)	:= gzip

zboot-size-len-$(CONFIG_KERNEL_GZIP)	:= 0



quiet_cmd_sbsign = SBSIGN  $@

      cmd_sbsign = sbsign --out $@ $< \

		   --key $(CONFIG_EFI_ZBOOT_SIGNING_KEY) \

		   --cert $(CONFIG_EFI_ZBOOT_SIGNING_CERT)



$(obj)/$(EFI_ZBOOT_PAYLOAD).signed: $(obj)/$(EFI_ZBOOT_PAYLOAD) FORCE

	$(call if_changed,sbsign)



ZBOOT_PAYLOAD-y				 := $(EFI_ZBOOT_PAYLOAD)

ZBOOT_PAYLOAD-$(CONFIG_EFI_ZBOOT_SIGNED) := $(EFI_ZBOOT_PAYLOAD).signed



$(obj)/vmlinuz: $(obj)/$(ZBOOT_PAYLOAD-y) FORCE

$(obj)/vmlinuz: $(obj)/$(EFI_ZBOOT_PAYLOAD) FORCE

	$(call if_changed,$(zboot-method-y))



OBJCOPYFLAGS_vmlinuz.o := -I binary -O $(EFI_ZBOOT_BFD_TARGET) \
@@ -53,18 +42,8 @@ LDFLAGS_vmlinuz.efi.elf := -T $(srctree)/drivers/firmware/efi/libstub/zboot.lds 
$(obj)/vmlinuz.efi.elf: $(obj)/vmlinuz.o $(ZBOOT_DEPS) FORCE

	$(call if_changed,ld)



ZBOOT_EFI-y				:= vmlinuz.efi

ZBOOT_EFI-$(CONFIG_EFI_ZBOOT_SIGNED)	:= vmlinuz.efi.unsigned



OBJCOPYFLAGS_$(ZBOOT_EFI-y) := -O binary

$(obj)/$(ZBOOT_EFI-y): $(obj)/vmlinuz.efi.elf FORCE

OBJCOPYFLAGS_vmlinuz.efi := -O binary

$(obj)/vmlinuz.efi: $(obj)/vmlinuz.efi.elf FORCE

	$(call if_changed,objcopy)



targets += zboot-header.o vmlinuz vmlinuz.o vmlinuz.efi.elf vmlinuz.efi
 


ifneq ($(CONFIG_EFI_ZBOOT_SIGNED),)

$(obj)/vmlinuz.efi: $(obj)/vmlinuz.efi.unsigned FORCE

	$(call if_changed,sbsign)

endif



targets += $(EFI_ZBOOT_PAYLOAD).signed vmlinuz.efi.unsigned