[v6,0/2] qemuarm64-secureboot: Add UEFI Secure Boot

Hi,

Addressing comments from patch series v5.

Introduce uefi-secureboot.yml as an addon to add UEFI Secure Boot. Most
of changes are backported from meta-ts.

UEFI Secure Boot requirements:

  - Create a UEFI disk partition to copy EFI apps.

  - Add UEFI settings to U-Boot, systemd-boot, and Linux kernel.

  - Set up UEFI keys that are to be stored in U-Boot and used to sign
    systemd-boot and Linux kernel images.

  - Add systemd as Init manager. systemd's modern architecture,
    integrated security features, and enhanced management capabilities
    make it a more suitable choice for systems using UEFI Secure Boot

Introduce uefi-secureboot machine feature.

Build and verification steps:

$ kas build ci/qemuarm64-secureboot.yml:ci/uefi-secureboot.yml:ci/testimage.yml

---

Changes since v5:
- Use uefi-secureboot.yml as an addon, taken out of
  qemuarm64-secureboot.yml.
- Comment Secure Boot keys setup in gen-sbkeys.sh.
- Set up CI to build and test UEFI Secure Boot.

Changes since v4:
- Big refactor to only two commits to add Secure Boot in all required
  recipes and enable it in qemuarm64-secureboot.
- Fix the generation of SB keys in build time.
- Remove the need to pass the keys in each recipe, as all the keys will
  be generated in one directory.
- Introduce uefi-secureboot.yml with all required settings for Secure
  Boot.
- Do several renamings to keep name consistency.
- Explain why systemd is used as the Init Manager.
- Revert the change using core-image-minimal; keep using
  core-image-base.

Changes since v3:
- For image creation, use core-image-minimal instead of core-image-base.

Changes since v2:
- Remove commit "qemuarm64-secureboot.yml: Set branch to scarthgap".

Changes since v1:
- Rework all subject commits to follow OE, Yocto, and meta-arm
  guidelines.
- Add gen-uefi-sb-keys.bb recipe to generate UEFI keys.
- Add an OE test to validate UEFI Secure Boot.
- Simplify gen_uefi_keys.sh to avoid code repetition.
- Replace grub with systemd-boot.
- Simplify signing binary images with sbsign class.
- Set OE branch to Scarthgap.

Changes since the v0:
- Remove u-boot recipe.
- Split the change in several commits.
- Remove sample UEFI keys.
- Validate UEFI keys exist before building.
- Insolate most of changes under uefi-secureboot machine feature.

Javier Tia (2):
  Enable Secure Boot in all required recipes
  qemuarm64-secureboot: Enable UEFI Secure Boot

 .gitlab-ci.yml                                |  1 +
 ci/uefi-secureboot.yml                        | 37 +++++++++++++
 .../u-boot/u-boot-uefi-secureboot.inc         | 17 ++++++
 .../u-boot/u-boot/uefi-secureboot.cfg         | 10 ++++
 .../recipes-bsp/u-boot/u-boot_%.bbappend      |  1 +
 meta-arm-bsp/wic/efi-disk-no-swap.wks.in      |  2 +-
 meta-arm/classes/sbsign.bbclass               | 31 +++++++++++
 .../lib/oeqa/runtime/cases/uefi_secureboot.py | 29 +++++++++++
 meta-arm/recipes-bsp/uefi/gen-sbkeys.bb       | 48 +++++++++++++++++
 .../recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh | 52 +++++++++++++++++++
 .../systemd/systemd-boot-uefi-secureboot.inc  |  7 +++
 .../systemd/systemd-boot_%.bbappend           |  1 +
 meta-arm/recipes-core/systemd/systemd-efi.inc |  1 +
 .../recipes-core/systemd/systemd_%.bbappend   |  1 +
 .../linux/linux-yocto%.bbappend               |  2 +
 .../linux/linux-yocto-uefi-secureboot.inc     | 14 +++++
 16 files changed, 253 insertions(+), 1 deletion(-)
 create mode 100644 ci/uefi-secureboot.yml
 create mode 100644 meta-arm-bsp/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
 create mode 100644 meta-arm-bsp/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
 create mode 100644 meta-arm/classes/sbsign.bbclass
 create mode 100644 meta-arm/lib/oeqa/runtime/cases/uefi_secureboot.py
 create mode 100644 meta-arm/recipes-bsp/uefi/gen-sbkeys.bb
 create mode 100755 meta-arm/recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh
 create mode 100644 meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
 create mode 100644 meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
 create mode 100644 meta-arm/recipes-core/systemd/systemd-efi.inc
 create mode 100644 meta-arm/recipes-core/systemd/systemd_%.bbappend
 create mode 100644 meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc