mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 07:51:59 -09:00
fa32b20b10
Since upstream commit 0c716a157be460006a4b762625de329b5e36dbf9 (first
release: v2026.07) mkeficapsule supports PKCS#11 keys, and in turn
requires GnuTLS with PKCS#11 support.
Without it, building mkeficapsule for the target fails:
HOSTLD tools/mkeficapsule
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: tools/mkeficapsule.o: in function `main':
mkeficapsule.c:(.text.startup+0x530): undefined reference to `gnutls_pkcs11_init'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x544): undefined reference to `gnutls_pkcs11_add_provider'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x5fc): undefined reference to `gnutls_pkcs11_obj_list_import_url4'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x620): undefined reference to `gnutls_x509_crt_import_pkcs11'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x1334): undefined reference to `gnutls_pkcs11_deinit'
collect2: error: ld returned 1 exit status
The error can be reproduced using "utils/test-pkg -c" with the
following config:
BR2_PACKAGE_UBOOT_TOOLS=y
BR2_PACKAGE_UBOOT_TOOLS_MKEFICAPSULE=y
For host-uboot-tools this was solved in Buildroot commit
6597563da7 "package/gnutls: add host
support for pkcs11" by unconditionally enabling PKCS#11 support for
host-gnutls. For the target a more fine-grained approach is desirable,
so instead select BR2_PACKAGE_P11_KIT if
BR2_PACKAGE_UBOOT_TOOLS_MKEFICAPSULE=y and propagate dependencies.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
116 lines
3.6 KiB
Plaintext
116 lines
3.6 KiB
Plaintext
config BR2_PACKAGE_UBOOT_TOOLS
|
|
bool "u-boot tools"
|
|
help
|
|
Companion tools for Das U-Boot bootloader.
|
|
|
|
http://www.denx.de/wiki/U-Boot/WebHome
|
|
|
|
if BR2_PACKAGE_UBOOT_TOOLS
|
|
|
|
config BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT
|
|
bool "Flattened Image Tree (FIT) support"
|
|
depends on !BR2_STATIC_LIBS
|
|
select BR2_PACKAGE_DTC
|
|
select BR2_PACKAGE_DTC_PROGRAMS
|
|
help
|
|
Enables support for Flattened Image Tree (FIT).
|
|
|
|
This option allows to boot the new uImage structure,
|
|
Flattened Image Tree. FIT is formally a FDT, which can include
|
|
images of various types (kernel, FDT blob, ramdisk, etc.)
|
|
in a single blob. To boot this new uImage structure,
|
|
pass the address of the blob to the "bootm" command.
|
|
|
|
comment "u-boot tools FIT support needs a toolchain w/ dynamic library"
|
|
depends on BR2_STATIC_LIBS
|
|
|
|
if BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT
|
|
|
|
config BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT
|
|
bool "FIT signature verification support"
|
|
select BR2_PACKAGE_OPENSSL
|
|
help
|
|
Enables support for FIT Signature Verification.
|
|
|
|
Flat Image Trees (FIT) supports hashing of images so that
|
|
these hashes can be checked on loading. This protects
|
|
against corruption of the image. However it does not prevent
|
|
the substitution of one image for another.
|
|
|
|
The signature feature allows the hash to be signed with a
|
|
private key such that it can be verified using a public key
|
|
later. Provided that the private key is kept secret and the
|
|
public key is stored in a non-volatile place, any image can
|
|
be verified in this way.
|
|
|
|
Enabling this option pulls in a dependency on libssl and
|
|
libcrypto, and possibly GPL/OpenSSL licensing
|
|
incompatibility issues.
|
|
|
|
config BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN
|
|
bool "fit_check_sign"
|
|
depends on BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT
|
|
help
|
|
Install the fit_check_sign tool on the target system
|
|
|
|
The fit_check_sign tool from Das U-Boot bootloader, which
|
|
allows FIT image signature validation on target system.
|
|
|
|
endif
|
|
|
|
config BR2_PACKAGE_UBOOT_TOOLS_MKIMAGE
|
|
bool "mkimage"
|
|
help
|
|
Install the mkimage tool on the target system
|
|
|
|
The mkimage tool from Das U-Boot bootloader, which allows
|
|
generation of U-Boot images in various formats.
|
|
|
|
config BR2_PACKAGE_UBOOT_TOOLS_MKEFICAPSULE
|
|
bool "mkeficapsule"
|
|
depends on !BR2_STATIC_LIBS # gnutls, p11-kit
|
|
depends on BR2_TOOLCHAIN_HAS_THREADS # p11-kit
|
|
depends on BR2_USE_MMU # p11-kit
|
|
depends on BR2_USE_WCHAR # gnutls
|
|
select BR2_PACKAGE_GNUTLS
|
|
select BR2_PACKAGE_P11_KIT
|
|
help
|
|
Install the mkeficapsule tool on the target system
|
|
|
|
The mkeficapsule tool from Das U-Boot bootloader, which allows
|
|
generation of UEFI capsule binaries.
|
|
|
|
comment "mkeficapsule support needs a toolchain w/ wchar, threads, dynamic library"
|
|
depends on BR2_USE_MMU
|
|
depends on !BR2_USE_WCHAR || !BR2_TOOLCHAIN_HAS_THREADS \
|
|
|| BR2_STATIC_LIBS
|
|
|
|
config BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE
|
|
bool "mkenvimage"
|
|
help
|
|
Install the mkenvimage tool on the target system
|
|
|
|
The mkenvimage tool from Das U-Boot bootloader, which allows
|
|
generation of a valid binary environment image from a text
|
|
file describing the key=value pairs of the environment.
|
|
|
|
config BR2_PACKAGE_UBOOT_TOOLS_FWPRINTENV
|
|
bool "fw_printenv"
|
|
default y
|
|
help
|
|
Install the fw_printenv / fw_setenv tools on the target system
|
|
|
|
The fw_printenv and fw_setenv tools from Das U-Boot
|
|
bootloader, which allows access to the U-Boot environment
|
|
from Linux.
|
|
|
|
config BR2_PACKAGE_UBOOT_TOOLS_DUMPIMAGE
|
|
bool "dumpimage"
|
|
help
|
|
Install the dumpimage tool on the target system
|
|
|
|
The dumpimage tool from Das U-Boot bootloader, which allows
|
|
extraction of data from U-Boot images.
|
|
|
|
endif
|