boot/efi: Optionally sign our EFI bootloader

* The private keys are in possession of Haiku, Inc. Change-Id: I3b5b004e1dce0102f8a65f6d682f7e428845efe8 Reviewed-on: https://review.haiku-os.org/c/haiku/+/4936 Reviewed-by: Alex von Gluck IV <[email protected]> Reviewed-by: waddlesplash <[email protected]>
2022-02-18 21:32:56 +00:00
parent 9a7906eadb
commit 31f27c4d39
7 changed files with 121 additions and 1 deletions
@@ -1701,6 +1701,9 @@ rule BuildEfiSystemPartition image : efiLoader
 			Exit "Error: Unknown EFI architecture!" ;
 	}

+	# public efi keys for efi bios trust
+	EFIKEYS on $(image) = [ FDirName $(HAIKU_TOP) data boot efi keys ] ;
+
 	BuildEfiSystemPartition1 $(image) : $(fatshell) $(macVolumeIcon) $(efiLoader) ;
 }

@@ -1720,7 +1723,15 @@ actions BuildEfiSystemPartition1

 	${FATFS} --initialize "$(<)" 'Haiku ESP'
 	echo "mkdir myfs/EFI" | ${FATFS} $(<)
+	echo "mkdir myfs/KEYS" | ${FATFS} $(<)
 	echo "mkdir myfs/EFI/BOOT" | ${FATFS} $(<)
+
 	echo "cp :${LOADER} myfs/EFI/BOOT/$(EFINAME)" | ${FATFS} $(<)
 	echo "cp :${EFIICON} myfs/.VolumeIcon.icns" | ${FATFS} $(<)
+
+	# Copy UEFI signing keys and a README for end users
+	echo "cp :$(EFIKEYS)/README.md myfs/KEYS/README.md" | ${FATFS} $(<)
+	for i in auth cer crt; do
+		echo "cp :$(EFIKEYS)/DB.$i myfs/KEYS/DB.$i" | ${FATFS} $(<)
+	done
 }