dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-05 15:40:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

ukify: automatically infer --signtool from the parameters given

Browse Source 
--signtool is actually useless: it can be inferred depending on if
--secureboot-certificate-name (pesign) is given, or
--secureboot-private-key and --secureboot-certificate (sbsign) is given.

Leave the option just for backwards compatibility.
This commit is contained in:
Emanuele Giuseppe Esposito
2023-09-26 12:04:01 -04:00
parent 5808300c44
commit 5c52078162
1 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/ukify/ukify.py
View File

@@ -1277,8 +1277,9 @@ CONFIG_ITEMS = [
'--signtool',
choices = ('sbsign', 'pesign'),
dest = 'signtool',
default = 'sbsign',
help = 'whether to use sbsign or pesign. Default is sbsign.',
help = 'whether to use sbsign or pesign. It will also be inferred by the other \
parameters given: when using --secureboot-{private-key/certificate}, sbsign \
will be used, otherwise pesign will be used',
config_key = 'UKI/SecureBootSigningTool',
),
ConfigItem(
@@ -1571,12 +1572,19 @@ def finalize_options(opts):
if opts.sb_cert:
opts.sb_cert = pathlib.Path(opts.sb_cert)
if opts.signtool == 'sbsign':
if bool(opts.sb_key) ^ bool(opts.sb_cert):
raise ValueError('--secureboot-private-key= and --secureboot-certificate= must be specified together when using --signtool=sbsign')
else:
if not bool(opts.sb_cert_name):
raise ValueError('--secureboot-certificate-name must be specified when using --signtool=pesign')
if bool(opts.sb_key) ^ bool(opts.sb_cert):
# one param only given, sbsign need boths
raise ValueError('--secureboot-private-key= and --secureboot-certificate= must be specified together')
elif bool(opts.sb_key) and bool(opts.sb_cert):
# both param given, infer sbsign and in case it was given, ensure signtool=sbsign
if opts.signtool and opts.signtool != 'sbsign':
raise ValueError(f'Cannot provide --signtool={opts.signtool} with --secureboot-private-key= and --secureboot-certificate=')
opts.signtool = 'sbsign'
elif bool(opts.sb_cert_name):
# sb_cert_name given, infer pesign and in case it was given, ensure signtool=pesign
if opts.signtool and opts.signtool != 'pesign':
raise ValueError(f'Cannot provide --signtool={opts.signtool} with --secureboot-certificate-name=')
opts.signtool = 'pesign'
if opts.sign_kernel and not opts.sb_key and not opts.sb_cert_name:
raise ValueError('--sign-kernel requires either --secureboot-private-key= and --secureboot-certificate= (for sbsign) or --secureboot-certificate-name= (for pesign) to be specified')