-
-
Notifications
You must be signed in to change notification settings - Fork 187
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #510 from tlaurion/gpg2
Gpg2 with all fixes included
- Loading branch information
Showing
26 changed files
with
360 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,14 +1,17 @@ | ||
| mount /dev/sda1 /boot | ||
| mount -o remount,rw /boot | ||
| rm /boot/kexec_* | ||
| mount-usb | ||
| mkdir -p /media/gpg_keys | ||
| gpg --home=/media/gpg_keys --card-edit | ||
| gpg --home=/media/gpg_keys --export --armor e@mail.address > /media/gpg_keys/public.key | ||
| gpg --home=/media/gpg_keys --export-secret-keys --armor e@mail.address > /media/gpg_keys/private.key | ||
| cbfs -o /media/coreboot.rom -a "heads/initrd/.gnupg/keys/public.key" -f /media/gpg_keys/public.key | ||
| cbfs -o /media/coreboot.rom -a "heads/initrd/.gnupg/keys/private.key" -f /media/gpg_keys/private.key | ||
| mount -o remount,ro /media | ||
| flash.sh /media/coreboot.com | ||
| #remove invalid kexec_* signed files | ||
| mount /dev/sda1 /boot && mount -o remount,rw /boot && rm /boot/kexec* && mount -o remount,ro /boot | ||
| #Generate keys from GPG smartcard: | ||
| mount-usb && gpg --home=/.gnupg/ --card-edit | ||
| #Copy generated public key, private_subkey, trustdb and artifacts to external media for backup: | ||
| mount -o remount,rw /media && mkdir -p /media/gpg_keys; gpg --export-secret-keys --armor email@address.com > /media/gpg_keys/private.key && gpg --export --armor email@address.com > /media/gpg_keys/public.key && gpg --export-ownertrust > /media/gpg_keys/otrust.txt && cp -r ./.gnupg/* /media/gpg_keys/ 2> /dev/null | ||
| #Insert public key and trustdb export into reproducible rom: | ||
| cbfs -o /media/coreboot.rom -a "heads/initrd/.gnupg/keys/public.key" -f /media/gpg_keys/public.key && cbfs -o /media/coreboot.rom -a "heads/initrd/.gnupg/keys/otrust.txt" -f /media/gpg_keys/otrust.txt | ||
| #Flush changes to external media: | ||
| mount -o,remount ro /media | ||
| #Flash modified reproducible rom with inserted public key and trustdb export from precedent step. Flushes actual rom's keys (-c: clean): | ||
| flash.sh -c /media/coreboot.rom | ||
| #Attest integrity of firmware as it is | ||
| seal-totp | ||
| #Verify Intel ME state: | ||
| cbmem --console | grep '^ME' | ||
| cbmem --console | less |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| scdaemon-program /bin/scdaemon | ||
| pinentry-program /bin/pinentry-tty | ||
| daemon |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| use-agent |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| modules-$(CONFIG_GPG2) += gpg2 | ||
|
|
||
| gpg2_version := 2.2.10 | ||
| gpg2_dir := gnupg-$(gpg2_version) | ||
| gpg2_tar := gnupg-$(gpg2_version).tar.bz2 | ||
| gpg2_url := https://www.gnupg.org/ftp/gcrypt/gnupg/$(gpg2_tar) | ||
| gpg2_hash := 799dd37a86a1448732e339bd20440f4f5ee6e69755f6fd7a73ee8af30840c915 | ||
|
|
||
| # For reproducibility reasons we have to override the exec_prefix | ||
| # and datarootdir on the configure line so that the Makefiles will | ||
| # be generated with the correct paths, but then re-write them when | ||
| # we use the install target so that they will be copied to the correct | ||
| # location. | ||
| gpg2_configure := ./configure \ | ||
| $(CROSS_TOOLS) \ | ||
| CPPFLAGS="-I$(INSTALL)/include/libusb-1.0" \ | ||
| --host x86_64-linux-musl \ | ||
| --with-libusb="$(INSTALL)" \ | ||
| --with-libgpg-error-prefix="$(INSTALL)" \ | ||
| --with-libgcrypt-prefix="$(INSTALL)" \ | ||
| --with-libassuan-prefix="$(INSTALL)" \ | ||
| --with-ksba-prefix="$(INSTALL)" \ | ||
| --with-npth-prefix="$(INSTALL)" \ | ||
| --prefix "/" \ | ||
| --libexecdir "/bin" \ | ||
| --enable-scdaemon \ | ||
| --enable-ccid-driver \ | ||
| --disable-tofu \ | ||
| --disable-rpath \ | ||
| --disable-regex \ | ||
| --disable-doc \ | ||
| --disable-bzip2 \ | ||
| --disable-asm \ | ||
| --disable-exec \ | ||
| --disable-photo-viewers \ | ||
| --disable-keyserver-helpers \ | ||
| --disable-ldap \ | ||
| --disable-hkp \ | ||
| --disable-finger \ | ||
| --disable-dns-srv \ | ||
| --disable-dns-cert \ | ||
| --disable-regex \ | ||
| --disable-nls \ | ||
| --disable-all-tests \ | ||
| --disable-wks-server \ | ||
| --disable-wks-tools \ | ||
| --disable-gnutls \ | ||
| --disable-dirmngr \ | ||
|
|
||
| # Run one build to generate the executables with the pre-defined | ||
| # exec_prefix and datarootdir, then a second make to install the binaries | ||
| # into our actual target location | ||
| gpg2_target := $(MAKE_JOBS) \ | ||
| && $(MAKE) -C $(build)/$(gpg2_dir) \ | ||
| DESTDIR="$(INSTALL)" \ | ||
| install | ||
|
|
||
| gpg2_output := g10/gpg agent/gpg-agent scd/scdaemon | ||
|
|
||
| gpg2_depends := libgpg-error libgcrypt libksba libassuan npth libusb-compat $(musl_dep) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| modules-$(CONFIG_GPG2) += libassuan | ||
| libassuan_version := 2.5.1 | ||
| libassuan_dir := libassuan-$(libassuan_version) | ||
| libassuan_tar := libassuan-$(libassuan_version).tar.bz2 | ||
| libassuan_url := https://gnupg.org/ftp/gcrypt/libassuan/$(libassuan_tar) | ||
| libassuan_hash := 47f96c37b4f2aac289f0bc1bacfa8bd8b4b209a488d3d15e2229cb6cc9b26449 | ||
|
|
||
| libassuan_configure := ./configure \ | ||
| $(CROSS_TOOLS) \ | ||
| --host x86_64-linux-musl \ | ||
| --prefix "/" \ | ||
| --disable-static \ | ||
| --disable-nls \ | ||
| --with-libgpg-error-prefix="$(INSTALL)" \ | ||
| --disable-asm \ | ||
|
|
||
| libassuan_target := $(MAKE_JOBS) \ | ||
| DESTDIR="$(INSTALL)" \ | ||
| $(CROSS_TOOLS) \ | ||
| install \ | ||
|
|
||
| libassuan_libraries := src/.libs/libassuan.so.0 | ||
|
|
||
| libassuan_depends := libgpg-error $(musl_dep) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| modules-$(CONFIG_GPG2) += libgcrypt | ||
| libgcrypt_version := 1.8.3 | ||
| libgcrypt_dir := libgcrypt-$(libgcrypt_version) | ||
| libgcrypt_tar := libgcrypt-$(libgcrypt_version).tar.bz2 | ||
| libgcrypt_url := https://gnupg.org/ftp/gcrypt/libgcrypt/$(libgcrypt_tar) | ||
| libgcrypt_hash := 66ec90be036747602f2b48f98312361a9180c97c68a690a5f376fa0f67d0af7c | ||
|
|
||
| libgcrypt_configure := ./configure \ | ||
| $(CROSS_TOOLS) \ | ||
| --host=x86_64-linux-musl \ | ||
| --prefix "/" \ | ||
| --disable-static \ | ||
| --with-libgpg-error-prefix="$(INSTALL)" \ | ||
| --disable-asm \ | ||
| --disable-nls \ | ||
|
|
||
| libgcrypt_target := $(MAKE_JOBS) \ | ||
| DESTDIR="$(INSTALL)" \ | ||
| $(CROSS_TOOLS) \ | ||
| install \ | ||
|
|
||
| libgcrypt_libraries := src/.libs/libgcrypt.so.20 | ||
|
|
||
| libgcrypt_depends := libgpg-error $(musl_dep) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| modules-$(CONFIG_GPG2) += libgpg-error | ||
| libgpg-error_version := 1.32 | ||
| libgpg-error_dir := libgpg-error-$(libgpg-error_version) | ||
| libgpg-error_tar := libgpg-error-$(libgpg-error_version).tar.bz2 | ||
| libgpg-error_url := https://gnupg.org/ftp/gcrypt/libgpg-error/$(libgpg-error_tar) | ||
| libgpg-error_hash := c345c5e73cc2332f8d50db84a2280abfb1d8f6d4f1858b9daa30404db44540ca | ||
|
|
||
| libgpg-error_configure := ./configure \ | ||
| $(CROSS_TOOLS) \ | ||
| --prefix "/" \ | ||
| --host=x86_64-linux-musl \ | ||
| --disable-static \ | ||
| --disable-nls \ | ||
| --disable-languages \ | ||
| --disable-doc \ | ||
| --disable-tests \ | ||
| --disable-asm \ | ||
|
|
||
| libgpg-error_target := $(MAKE_JOBS) \ | ||
| DESTDIR="$(INSTALL)" \ | ||
| $(CROSS_TOOLS) \ | ||
| install \ | ||
|
|
||
| libgpg-error_libraries := src/.libs/libgpg-error.so.0 | ||
|
|
||
| libgpg-error_depends := $(musl_dep) |
Oops, something went wrong.