From 7198cea534ac197c9047143cb76df267cc42cbf9 Mon Sep 17 00:00:00 2001 From: "Fiona Klute (othermo GmbH)" Date: Sat, 19 Sep 2026 23:35:40 +0200 Subject: [PATCH] fs/common.mk: add optional hook to build a verity hash tree Using dm-verity may be useful for any read-only filesystem read from a block device, the new hook will build the required hash tree if enabled by a per-filesystem config option. To use this hook, the filesystem config must define a boolean option BR2_TARGET_ROOTFS__VERITY, and a string option BR2_TARGET_ROOTFS__VERITY_EXTRA_ARGS. The latter option allows users to override veritysetup defaults, e.g. to set a fixed hash algorithm. In the filesystem .mk file ROOTFS__VERITY_EXTRA_ARGS must be defined as the value of BR2_TARGET_ROOTFS__VERITY_EXTRA_ARGS without surrounding quotes, because utils/check-symbols warns about the _EXTRA_ARGS symbol being unused if fs/common.mk uses $(qstrip $(BR2_TARGET_ROOTFS_$(2)_VERITY_EXTRA_ARGS)) directly. Signed-off-by: Fiona Klute (othermo GmbH) Signed-off-by: Julien Olivain --- fs/common.mk | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/common.mk b/fs/common.mk index 2f3f8bcc7e..4b4a0995df 100644 --- a/fs/common.mk +++ b/fs/common.mk @@ -215,6 +215,15 @@ TARGETS_ROOTFS += rootfs-$(1) PACKAGES += $$(filter-out rootfs-%,$$(ROOTFS_$(2)_FINAL_RECURSIVE_DEPENDENCIES)) endif +ifeq ($$(BR2_TARGET_ROOTFS_$(2)_VERITY),y) +ROOTFS_$(2)_DEPENDENCIES += host-cryptsetup +define ROOTFS_$(2)_VERITY_FORMAT + @$$(call MESSAGE,"Generating verity hash tree $$(@F).verity") + $(HOST_DIR)/sbin/veritysetup format --root-hash-file $$@.verity.root-hash $$(ROOTFS_$(2)_VERITY_EXTRA_ARGS) $$@ $$@.verity +endef +ROOTFS_$(2)_POST_GEN_HOOKS += ROOTFS_$(2)_VERITY_FORMAT +endif + # Check for legacy POST_TARGETS rules ifneq ($$(ROOTFS_$(2)_POST_TARGETS),) $$(error Filesystem $(1) uses post-target rules, which are no longer supported.\