<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 10.03.20 23:02, Bartosz Golaszewski
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAMRc=MdizEv6uB_Z+zyCYjtZuoYVWK5LP9jBAGBazkWoCXr4EA@mail.gmail.com">
<pre class="moz-quote-pre" wrap="">wt., 10 mar 2020 o 22:33 Ayoub Zaki <a class="moz-txt-link-rfc2396E" href="mailto:ayoub.zaki@embexus.com"><ayoub.zaki@embexus.com></a> napisał(a):
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">
Do I implement do_install in image.bbclass so that initramfs can
depend on core-image-full-cmdline:do_populate_sysroot and have the
artifacts installed locally? But this would mean that the initramfs
recipe deploys the main image artifact. Should we deploy the images
earlier (before do_image_complete) for the initramfs recipe to fetch
from DEPLOY_DIR_IMAGE? Any other ideas?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
I think that best thing is to implement the dm-verity stuffs as a wic
plugin, check this example:
<a class="moz-txt-link-freetext" href="https://github.com/intel/intel-iot-refkit/blob/master/meta-refkit-core/scripts/lib/wic/plugins/source/dm-verity.py">https://github.com/intel/intel-iot-refkit/blob/master/meta-refkit-core/scripts/lib/wic/plugins/source/dm-verity.py</a>
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
This doesn't look like a correct solution. For starters: not every
platform uses wic. The platform I'm aiming this at uses fastboot and
requires separate images for each partition.</pre>
</blockquote>
<p><br>
</p>
My proposition was refering to your example :<br>
<br>
<br>
<a class="moz-txt-link-freetext" href="https://github.com/brgl/meta-security/commit/83c8e8fba6988249c9d351aa2ad6e02a71b010df#diff-33f7c29b373860ec45379a5f2dc42a75">https://github.com/brgl/meta-security/commit/83c8e8fba6988249c9d351aa2ad6e02a71b010df#diff-33f7c29b373860ec45379a5f2dc42a75</a><br>
<br>
<br>
your are trying to include the dm-verity conversion output to your
wic wks using the following:<br>
<br>
<br>
part / --source rawcopy --ondisk mmcblk
--sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}.${DM_VERITY_TYPE}"<br>
<br>
<br>
In this case you will definitely stuck in a circular dependency
unless using a Wic plugin.<br>
<p><span class="blob-code-inner blob-code-marker" data-code-marker="+" style="box-sizing: border-box; overflow: visible; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; color: rgb(36, 41, 46); overflow-wrap: normal; white-space: pre;">
</span></p>
<blockquote type="cite"
cite="mid:CAMRc=MdizEv6uB_Z+zyCYjtZuoYVWK5LP9jBAGBazkWoCXr4EA@mail.gmail.com">
<pre class="moz-quote-pre" wrap="">
This plugin also seems to be unnecessarily complicated with additional
signature for the verity hash tree. This is not needed as long as the
root hash comes from a secure place - which it does in my case: the
fitImage containing the initramfs is signed and the key is appended to
u-boot's DTB. When do_image_wic starts, u-boot and initramfs assembly
are long completed - another reason for not using a wic plugin.</pre>
</blockquote>
<p><br>
</p>
<p>I was referring to the plugin not the implementation which does
not work anyway...<br>
</p>
<p><br>
</p>
<pre class="moz-signature" cols="72">Mit freundlichen Grüßen / Kind regards
--
Ayoub Zaki
Embedded Systems Consultant
Vaihinger Straße 2/1
D-71634 Ludwigsburg
Mobile : +4917662901545
Email : <a class="moz-txt-link-abbreviated" href="mailto:ayoub.zaki@embexus.com">ayoub.zaki@embexus.com</a>
Homepage : <a class="moz-txt-link-freetext" href="https://embexus.com">https://embexus.com</a>
VAT No. : DE313902634</pre>
</body>
</html>