diff mbox series

[v2,4/5] meta/recipes-kernel/linux-module: add option to set default signing profile and dependencies

Message ID 20250416171709.742191-5-gokhan.cetin@siemens.com
State Accepted, archived
Headers show
Series Structure module signing dependencies and providers | expand

Commit Message

Gokhan Cetin April 16, 2025, 5:17 p.m. UTC 
Introduces single control variable (`KERNEL_MODULE_SIGNATURES`) to
set all predefined build profile and dependencies need to be configured
for kernel module signing.

By using this option, downstreams will be able to enable build-wide signing
of kernel modules which include module.inc without appending any additional
configuration into their module recipes.

Signed-off-by: Gokhan Cetin <gokhan.cetin@siemens.com>
---
 meta/recipes-kernel/linux-module/module.inc | 7 +++++++
 1 file changed, 7 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-kernel/linux-module/module.inc b/meta/recipes-kernel/linux-module/module.inc
index 45d88d48..8fe5eed4 100644
--- a/meta/recipes-kernel/linux-module/module.inc
+++ b/meta/recipes-kernel/linux-module/module.inc
@@ -28,6 +28,13 @@  SIGNATURE_CERTFILE ??= "/usr/share/secure-boot-secrets/secure-boot.pem"
 SIGNATURE_HASHFN ??= "sha256"
 SIGNATURE_SIGNWITH ??= "/usr/bin/sign-module.sh"
 
+KERNEL_MODULE_SIGNATURES ??= ""
+
+# Define signing profile and dependencies if KERNEL_MODULE_SIGNATURES is set to "1"
+DEB_BUILD_PROFILES += "${@'pkg.signwith' if bb.utils.to_boolean(d.getVar('KERNEL_MODULE_SIGNATURES')) else ''}"
+DEPENDS += "${@'module-signer secure-boot-secrets' if bb.utils.to_boolean(d.getVar('KERNEL_MODULE_SIGNATURES')) else ''}"
+DEBIAN_BUILD_DEPENDS .= "${@', module-signer, secure-boot-secrets' if bb.utils.to_boolean(d.getVar('KERNEL_MODULE_SIGNATURES')) else ''}"
+
 SRC_URI += "file://debian/"
 
 AUTOLOAD ?= ""