Skip to content

Commit 4bfa178

Browse files
authored
Change SECURE_UPGRADE_DEV_SIGNING_CERT to SECURE_UPGRADE_SIGNING_CERT (#34)
1 parent 9e56fea commit 4bfa178

File tree

5 files changed

+14
-14
lines changed

5 files changed

+14
-14
lines changed

Makefile.work

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -315,8 +315,8 @@ endif
315315
ifneq ($(SECURE_UPGRADE_DEV_SIGNING_KEY),)
316316
DOCKER_RUN += -v $(SECURE_UPGRADE_DEV_SIGNING_KEY):$(SECURE_UPGRADE_DEV_SIGNING_KEY):ro
317317
endif
318-
ifneq ($(SECURE_UPGRADE_DEV_SIGNING_CERT),)
319-
DOCKER_RUN += -v $(SECURE_UPGRADE_DEV_SIGNING_CERT):$(SECURE_UPGRADE_DEV_SIGNING_CERT):ro
318+
ifneq ($(SECURE_UPGRADE_SIGNING_CERT),)
319+
DOCKER_RUN += -v $(SECURE_UPGRADE_SIGNING_CERT):$(SECURE_UPGRADE_SIGNING_CERT):ro
320320
endif
321321
# Mount the Signing prod tool in the slave container
322322
$(info "SECURE_UPGRADE_PROD_SIGNING_TOOL": "$(SECURE_UPGRADE_PROD_SIGNING_TOOL)")
@@ -545,7 +545,7 @@ SONIC_BUILD_INSTRUCTION := $(MAKE) \
545545
SONIC_ENABLE_SECUREBOOT_SIGNATURE=$(SONIC_ENABLE_SECUREBOOT_SIGNATURE) \
546546
SECURE_UPGRADE_MODE=$(SECURE_UPGRADE_MODE) \
547547
SECURE_UPGRADE_DEV_SIGNING_KEY=$(SECURE_UPGRADE_DEV_SIGNING_KEY) \
548-
SECURE_UPGRADE_DEV_SIGNING_CERT=$(SECURE_UPGRADE_DEV_SIGNING_CERT) \
548+
SECURE_UPGRADE_SIGNING_CERT=$(SECURE_UPGRADE_SIGNING_CERT) \
549549
SECURE_UPGRADE_PROD_SIGNING_TOOL=$(SECURE_UPGRADE_PROD_SIGNING_TOOL) \
550550
SONIC_DEFAULT_CONTAINER_REGISTRY=$(DEFAULT_CONTAINER_REGISTRY) \
551551
ENABLE_HOST_SERVICE_ON_START=$(ENABLE_HOST_SERVICE_ON_START) \

build_debian.sh

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -648,8 +648,8 @@ if [[ $SECURE_UPGRADE_MODE == 'dev' || $SECURE_UPGRADE_MODE == "prod" && $SONIC_
648648
shim-unsigned \
649649
grub-efi
650650

651-
if [ ! -f $SECURE_UPGRADE_DEV_SIGNING_CERT ]; then
652-
echo "Error: SONiC SECURE_UPGRADE_DEV_SIGNING_CERT=$SECURE_UPGRADE_DEV_SIGNING_CERT key missing"
651+
if [ ! -f $SECURE_UPGRADE_SIGNING_CERT ]; then
652+
echo "Error: SONiC SECURE_UPGRADE_SIGNING_CERT=$SECURE_UPGRADE_SIGNING_CERT key missing"
653653
exit 1
654654
fi
655655

@@ -664,7 +664,7 @@ if [[ $SECURE_UPGRADE_MODE == 'dev' || $SECURE_UPGRADE_MODE == "prod" && $SONIC_
664664
sudo ./scripts/signing_secure_boot_dev.sh -a $CONFIGURED_ARCH \
665665
-r $FILESYSTEM_ROOT \
666666
-l $LINUX_KERNEL_VERSION \
667-
-c $SECURE_UPGRADE_DEV_SIGNING_CERT \
667+
-c $SECURE_UPGRADE_SIGNING_CERT \
668668
-p $SECURE_UPGRADE_DEV_SIGNING_KEY
669669
elif [[ $SECURE_UPGRADE_MODE == "prod" ]]; then
670670
# Here Vendor signing should be implemented
@@ -679,12 +679,12 @@ if [[ $SECURE_UPGRADE_MODE == 'dev' || $SECURE_UPGRADE_MODE == "prod" && $SONIC_
679679

680680
# verifying all EFI files and kernel modules in $OUTPUT_SEC_BOOT_DIR
681681
sudo ./scripts/secure_boot_signature_verification.sh -e $OUTPUT_SEC_BOOT_DIR \
682-
-c $SECURE_UPGRADE_DEV_SIGNING_CERT \
682+
-c $SECURE_UPGRADE_SIGNING_CERT \
683683
-k $FILESYSTEM_ROOT
684684

685685
# verifying vmlinuz file.
686686
sudo ./scripts/secure_boot_signature_verification.sh -e $FILESYSTEM_ROOT/boot/vmlinuz-${LINUX_KERNEL_VERSION}-${CONFIGURED_ARCH} \
687-
-c $SECURE_UPGRADE_DEV_SIGNING_CERT \
687+
-c $SECURE_UPGRADE_SIGNING_CERT \
688688
-k $FILESYSTEM_ROOT
689689
fi
690690
echo "Secure Boot support build stage: END."

rules/config

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -223,11 +223,11 @@ SONIC_ENABLE_SECUREBOOT_SIGNATURE ?= n
223223

224224
# Full Secure Boot feature flags.
225225
# SECURE_UPGRADE_DEV_SIGNING_KEY - path to development signing key, used for image signing during build
226-
# SECURE_UPGRADE_DEV_SIGNING_CERT - path to development signing certificate, used for image signing during build
226+
# SECURE_UPGRADE_SIGNING_CERT - path to development signing certificate, used for image signing during build
227227
# SECURE_UPGRADE_MODE - enum value for secure upgrade mode, valid options are "dev", "prod" and "no_sign"
228228
# SECURE_UPGRADE_PROD_SIGNING_TOOL - path to a vendor signing tool for production flow.
229229
SECURE_UPGRADE_DEV_SIGNING_KEY ?=
230-
SECURE_UPGRADE_DEV_SIGNING_CERT ?=
230+
SECURE_UPGRADE_SIGNING_CERT ?=
231231
SECURE_UPGRADE_MODE = "no_sign"
232232
SECURE_UPGRADE_PROD_SIGNING_TOOL ?=
233233
# PACKAGE_URL_PREFIX - the package url prefix

rules/linux-kernel.dep

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DEP_FILES := rules/linux-kernel.mk rules/linux-kernel.dep
44
SMDEP_FILES := $(addprefix $(SPATH)/,$(shell cd $(SPATH) && git ls-files))
55

66
DEP_FLAGS := $(SONIC_COMMON_FLAGS_LIST) \
7-
$(KERNEL_PROCURE_METHOD) $(KERNEL_CACHE_PATH) $(SECURE_UPGRADE_MODE) $(SECURE_UPGRADE_DEV_SIGNING_CERT)
7+
$(KERNEL_PROCURE_METHOD) $(KERNEL_CACHE_PATH) $(SECURE_UPGRADE_MODE) $(SECURE_UPGRADE_SIGNING_CERT)
88

99
$(LINUX_HEADERS_COMMON)_CACHE_MODE := GIT_CONTENT_SHA
1010
$(LINUX_HEADERS_COMMON)_DEP_FLAGS := $(DEP_FLAGS)

slave.mk

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -381,7 +381,7 @@ $(info "PASSWORD" : "$(PASSWORD)")
381381
$(info "CHANGE_DEFAULT_PASSWORD" : "$(CHANGE_DEFAULT_PASSWORD)")
382382
$(info "SECURE_UPGRADE_MODE" : "$(SECURE_UPGRADE_MODE)")
383383
$(info "SECURE_UPGRADE_DEV_SIGNING_KEY" : "$(SECURE_UPGRADE_DEV_SIGNING_KEY)")
384-
$(info "SECURE_UPGRADE_DEV_SIGNING_CERT" : "$(SECURE_UPGRADE_DEV_SIGNING_CERT)")
384+
$(info "SECURE_UPGRADE_SIGNING_CERT" : "$(SECURE_UPGRADE_SIGNING_CERT)")
385385
$(info "SECURE_UPGRADE_PROD_SIGNING_TOOL": "$(SECURE_UPGRADE_PROD_SIGNING_TOOL)")
386386
$(info "ENABLE_DHCP_GRAPH_SERVICE" : "$(ENABLE_DHCP_GRAPH_SERVICE)")
387387
$(info "SHUTDOWN_BGP_ON_START" : "$(SHUTDOWN_BGP_ON_START)")
@@ -1267,7 +1267,7 @@ $(addprefix $(TARGET_PATH)/, $(SONIC_INSTALLERS)) : $(TARGET_PATH)/% : \
12671267
export include_teamd="$(INCLUDE_TEAMD)"
12681268
export include_router_advertiser="$(INCLUDE_ROUTER_ADVERTISER)"
12691269
export sonic_su_dev_signing_key="$(SECURE_UPGRADE_DEV_SIGNING_KEY)"
1270-
export sonic_su_dev_signing_cert="$(SECURE_UPGRADE_DEV_SIGNING_CERT)"
1270+
export sonic_su_signing_cert="$(SECURE_UPGRADE_SIGNING_CERT)"
12711271
export sonic_su_mode="$(SECURE_UPGRADE_MODE)"
12721272
export sonic_su_prod_signing_tool="$(SECURE_UPGRADE_PROD_SIGNING_TOOL)"
12731273
export include_system_telemetry="$(INCLUDE_SYSTEM_TELEMETRY)"
@@ -1441,7 +1441,7 @@ $(addprefix $(TARGET_PATH)/, $(SONIC_INSTALLERS)) : $(TARGET_PATH)/% : \
14411441
SONIC_ENABLE_IMAGE_SIGNATURE="$(SONIC_ENABLE_IMAGE_SIGNATURE)" \
14421442
SECURE_UPGRADE_MODE="$(SECURE_UPGRADE_MODE)" \
14431443
SECURE_UPGRADE_DEV_SIGNING_KEY="$(SECURE_UPGRADE_DEV_SIGNING_KEY)" \
1444-
SECURE_UPGRADE_DEV_SIGNING_CERT="$(SECURE_UPGRADE_DEV_SIGNING_CERT)" \
1444+
SECURE_UPGRADE_SIGNING_CERT="$(SECURE_UPGRADE_SIGNING_CERT)" \
14451445
SECURE_UPGRADE_PROD_SIGNING_TOOL="$(SECURE_UPGRADE_PROD_SIGNING_TOOL)" \
14461446
SIGNING_KEY="$(SIGNING_KEY)" \
14471447
SIGNING_CERT="$(SIGNING_CERT)" \

0 commit comments

Comments
 (0)