• [gentoo-dev] [PATCH 4/5]: dist-kernel-utils.eclass: optionally sign the

    From Andrew Ammerlaan@21:1/5 to All on Fri Jul 14 10:50:02 2023
    From e6d996555a460e9082c6b108fa038b84bf88bcd4 Mon Sep 17 00:00:00 2001
    From: Andrew Ammerlaan <andrewammerlaan@gentoo.org>
    Date: Tue, 11 Jul 2023 13:20:12 +0200
    Subject: [PATCH 04/13] dist-kernel-utils.eclass: optionally sign the kernels

    We put this behind a KERNEL_IUSE_SECUREBOOT var so we can enable this
    only if KERNEL_IUSE_MODULES_SIGN is also enabled in kernel-build.eclass

    Signed kernel modules is required for the kernel to actually boot with
    Secure Boot enabled.

    Signed-off-by: Andrew Ammerlaan <andrewammerlaan@gentoo.org>
    ---
    eclass/dist-kernel-utils.eclass | 18 +++++++++++++++++-
    1 file changed, 17 insertions(+), 1 deletion(-)

    diff --git a/eclass/dist-kernel-utils.eclass
    b/eclass/dist-kernel-utils.eclass
    index 1ef3104245c6..cb0021f8b3a7 100644
    --- a/eclass/dist-kernel-utils.eclass
    +++ b/eclass/dist-kernel-utils.eclass
    @@ -12,6 +12,13 @@
    # This eclass provides various utility functions related to Distribution
    # Kernels.

    +# @ECLASS_VARIABLE: KERNEL_IUSE_SECUREBOOT
    +# @PRE_INHERIT
    +# @DEFAULT_UNSET
    +# @DESCRIPTION:
    +# If set to a non-null value, inherits secureboot.eclass
    +# and allows signing of generated kernel images.
    +
    if [[ ! ${_DIST_KERNEL_UTILS} ]]; then

    case ${EAPI} in
    @@ -19,6 +26,10 @@ case ${EAPI} in
    *) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
    esac

    +if [[ ${KERNEL_IUSE_SECUREBOOT} ]]; then
    + inherit secureboot
    +fi
    +
    # @FUNCTION: dist-kernel_build_initramfs
    # @USAGE: <output> <version>
    # @DESCRIPTION:
    @@ -104,7 +115,7 @@ dist-kernel_install_kernel()