openSUSE Build Service

Overview Repositories Revisions Requests Users Attributes Meta

File uki.spec of Package uki (Revision ff50db2527c97a6192ba1209c1fb9774)

Currently displaying revision ff50db2527c97a6192ba1209c1fb9774 , Show latest

#
# spec file for package uki
#
# Copyright (c) 2023 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
# needsrootforbuild
# needssslcertforbuild

%global debug_package %{nil}

# Kernel name
# -------------------------
%ifarch %ix86 x86_64
%define ker_name vmlinuz
%endif
%ifarch ppc ppc64 ppc64le
%define ker_name vmlinux
%endif
%ifarch s390 s390x
%define ker_name image
%endif
%ifarch %arm
%define ker_name zImage
%endif
%ifarch aarch64 riscv64
%define ker_name Image
%endif
# -------------------------
# usefull variables
# -------------------------
%define ker_flavor default
%global uname %(ls /lib/modules | head -n 1)
%global kernel_version %(echo "%{uname}" | cut -d '-' -f1)
%global initrd_version %(rpm -q --queryformat '%{VERSION}' static-initrd-generic-unsigned | sed 's|_k.*||')
%define etf /boot/efi
%define distro opensuse
%define efi_path %{etf}/EFI/%{distro}
%define efi_name uki-%{initrd_version}
%define certs_name uki
%define url https://uapi-group.org/specifications/specs/unified_kernel_image
%define uki_install_dir %{kernel_module_directory}/%{uname}
%define uki_extra_dir %{kernel_module_directory}/uki.extra.d/
%define cert_install_dir %{_datarootdir}/unified/certs
# -------------------------

# Includes macros
# -------------------------
%include %_sourcedir/kernel-spec-macros
# -------------------------

Name:           uki
Version:        %{initrd_version}_k%{kernel_version}
Release:        0
Summary:        Signed Ugnified Kernel Image
License:        Apache-2.0
URL:            %{url}
Group:          System/Base
Source1:        openSUSE-UEFI-CA-Certificate.crt
ExclusiveArch:  x86_64
BuildRequires:  pesign-obs-integration
# -------------------------
# Needed to have the ukify tool
# -------------------------
BuildRequires:  systemd, systemd-experimental
BuildRequires:  %{python_module pefile}
BuildRequires:  %{python_module cryptography}
# -------------------------
BuildRequires:  static-initrd-generic-unsigned
BuildRequires:  kernel-%{ker_flavor}
BuildRequires:  udev, systemd-boot
BuildRequires:  uki-tool >= 0.3.0+15
BuildRequires:  pesign
BuildRequires:  openssl
BuildRequires:  tpm2.0-tools
BuildRequires:  gptfdisk
BuildRoot:      %{_tmppath}/%{name}-%{version}-build

Requires:       uki-tool >= 0.3.0+15
# Needed in post to change the type of the partition
Requires:       gptfdisk
Requires:       shim >= 11
# Needed by systemd-pcrphase at boot
Requires:       pkgconfig(tss2-tcti-device)
# Install the UKI with the correct kernel version
Requires:       kernel-%{ker_flavor} = %{kernel_version}

%description
Generic signed Unified Kernel Image

%prep
# Get the certificates used to sign
if test -e %{_sourcedir}/_projectcert.crt ; then
    cp %{_sourcedir}/_projectcert.crt ./%{certs_name}.crt    
else
    echo "No _projectcert file in sources"
    # To be able to have a success localbuild
    cp %{SOURCE1} ./%{certs_name}.crt
fi
openssl x509 -in ./%{certs_name}.crt -outform DER -out ./%{certs_name}.der

%build
ukit create \
    -k %{uname} \
    -i /usr/share/initrd/static-initrd-generic-%{uname}.unsigned \
    -n %{efi_name}.efi \
    -o .

%install
export BRP_PESIGN_FILES="%{uki_install_dir}/%{efi_name}.efi"
install -d -m 0700 %{buildroot}%{uki_install_dir}/
install -m 0755 ./%{efi_name}.efi \
    %{buildroot}%{uki_install_dir}/%{efi_name}.efi
install -d -m 0700 %{buildroot}%{uki_install_dir}/%{efi_name}.efi.extra.d
install -d -m 0700 %{buildroot}%{uki_extra_dir}

install -d -m 0700 %{buildroot}%{cert_install_dir}
fpr=$(openssl x509 -sha1 -fingerprint -inform DER -noout -in ./%{certs_name}.der \
        | cut -c 18- | cut -d ":" -f 1,2,3,4 | sed 's/://g')
install -m 644 ./%{certs_name}.der \
    %{buildroot}%{cert_install_dir}/%{efi_name}-${fpr}.crt

%post
# Change type of the file system partition from 8300 to 8304
dev_name=$(df -h / | tail -1 | cut -d ' ' -f1)
dev_part=${dev_name::-1}
dev_no=${dev_name: -1}
if [[ $dev_no && $dev_part ]] &&\
   [[ -b "${dev_part}${dev_no}" ]]; then
    echo "Change partition type of ${dev_part}${dev_no} in 8304"
    sgdisk -t $dev_no:8304 $dev_part || true
fi
# Add menuentry to bootloaders
efi_file=$(basename %{uki_install_dir}/%{efi_name}.efi)
cert_file=$(basename %{cert_install_dir}/%{efi_name}-*.crt)
uname=$(ls /lib/modules | head -n 1)
entry_added=0
if (command -v grub2-mkconfig > /dev/null 2>&1); then
  if ukit grub2 \
    --add-entry \
    -k %{uname} \
    -u %{uki_install_dir}/${efi_file}; then
      echo "Entry for UKI has been added to Grub"
      entry_added=1
  fi
fi
if (command -v sdbootutil > /dev/null 2>&1); then
  if ukit sdboot \
    --add \
    --image ${efi_file} \
    -k %{uname}; then
    echo "Entry for UKI has been added to sdboot"
    entry_added=1
  fi
fi
if [ $entry_added -eq 1 ]; then
    echo -e "\033[0;32mTo enroll the uki certificate key please run:\033[0m"
    echo -e "\033[0;32mmokutil \
--import %{cert_install_dir}/${cert_file}\033[0m"
fi

%preun
efi_file=$(basename %{uki_install_dir}/%{efi_name}.efi)
if (command -v grub2-mkconfig > /dev/null 2>&1); then
  if ukit grub2 \
     --remove-entry \
     -u %{uki_install_dir}/${efi_file}; then
      echo "Entry for UKI has been removed from grub2"
      [ -f %{efi_path}/${efi_file} ] && rm %{efi_path}/${efi_file}
  fi
fi
if (command -v sdbootutil > /dev/null 2>&1); then
  if ukit sdboot \
    --remove \
    --image ${efi_file} \
    -k %{uname}; then
    echo "Entry for UKI has been removed from sdboot"
  fi
fi

%files
%defattr(-,root,root)
%{kernel_module_directory}/*/%{efi_name}.efi*
%dir %{uki_extra_dir}
%dir %{_datarootdir}/unified
%dir %{_datarootdir}/unified/certs
%{cert_install_dir}/%{efi_name}-*.crt

%changelog

Places

File uki.spec of Package uki (Revision ff50db2527c97a6192ba1209c1fb9774)

Places