UBUNTU: [Packaging] build canonical-certs.pem from branch/arch certs

Merge common, branch-specific, and arch-specific certs and form
a certs database for inclusion in the kernel keyring.

BugLink: https://bugs.launchpad.net/bugs/1898716
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/debian.master/config/annotations b/debian.master/config/annotations
index 9ab7828ccdd7cee3172dbdb23c4fdd12d79acf7d..7dacf21645314a8040cc448483a30bafa80de2ba 100644 (file)
--- a/debian.master/config/annotations
+++ b/debian.master/config/annotations
@@ -351,7 +351,7 @@ CONFIG_SYSTEM_BLACKLIST_KEYRING                 mark<ENFORCED>
 
 # Menu: Cryptographic API >> Certificates for signature checking >> Provide system-wide ring of trusted keys
 CONFIG_SYSTEM_TRUSTED_KEYRING                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
-CONFIG_SYSTEM_TRUSTED_KEYS                      policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'i386': '""', 'ppc64el': '""', 's390x': '""'}>
+CONFIG_SYSTEM_TRUSTED_KEYS                      policy<{'amd64': '"debian/canonical-certs.pem"', 'arm64': '"debian/canonical-certs.pem"', 'armhf': '"debian/canonical-certs.pem"', 'i386': '"debian/canonical-certs"', 'ppc64el': '"debian/canonical-certs.pem"', 's390x': '"debian/canonical-certs.pem"'}>
 CONFIG_SYSTEM_EXTRA_CERTIFICATE                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE            policy<{'amd64': '4096', 'arm64': '4096', 'armhf': '4096', 'i386': '4096', 'ppc64el': '4096', 's390x': '4096'}>
 CONFIG_SECONDARY_TRUSTED_KEYRING                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'i386': 'y', 'ppc64el': 'y', 's390x': 'y'}>

diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu
index 0d2f337b201008571d36af202e0b95ae5f9133e0..4625768cba781457cf7cb03d47ed49d8216af530 100644 (file)
--- a/debian.master/config/config.common.ubuntu
+++ b/debian.master/config/config.common.ubuntu
@@ -9924,7 +9924,7 @@ CONFIG_SYSTEM_DATA_VERIFICATION=y
 CONFIG_SYSTEM_EXTRA_CERTIFICATE=y
 CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE=4096
 CONFIG_SYSTEM_TRUSTED_KEYRING=y
-CONFIG_SYSTEM_TRUSTED_KEYS=""
+CONFIG_SYSTEM_TRUSTED_KEYS="debian/canonical-certs.pem"
 CONFIG_SYSVIPC=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SYSVIPC_SYSCTL=y

diff --git a/debian/rules b/debian/rules
index e490836b813ddbccafb915853a760498e0eac341..f8d53afa289031a91f1ff1f1a1fb25d671454bda 100755 (executable)
--- a/debian/rules
+++ b/debian/rules
@@ -137,7 +137,7 @@ binary: binary-indep binary-arch
 
 build: build-arch build-indep
 
-clean: debian/control
+clean: debian/control debian/canonical-certs.pem
        dh_testdir
        dh_testroot
        dh_clean
@@ -235,3 +235,15 @@ debian/control: $(DEBIAN)/control.stub
        LANG=C kernel-wedge gen-control $(release)-$(abinum) | \
                perl -f $(DROOT)/scripts/misc/kernel-wedge-arch.pl $(arch) \
                >>$(CURDIR)/debian/control
+
+debian/canonical-certs.pem: $(wildcard $(DROOT)/certs/*-all.pem) $(wildcard $(DROOT)/certs/*-$(arch).pem) $(wildcard $(DEBIAN)/certs/*-all.pem) $(wildcard $(DEBIAN)/certs/*-$(arch).pem)
+       for cert in $(sort $(notdir $^));                                       \
+       do                                                                      \
+               for dir in $(DEBIAN) $(DROOT);                                  \
+               do                                                              \
+                       if [ -f "$$dir/certs/$$cert" ]; then                    \
+                               cat "$$dir/certs/$$cert";                       \
+                               break;                                          \
+                       fi;                                                     \
+               done;                                                           \
+       done >"$@"