36 lines
2.1 KiB
BlitzBasic
36 lines
2.1 KiB
BlitzBasic
SUMMARY = "Minimal FIPS image with libgcrypt, gnutls, and wolfProvider (replace-default mode)"
|
|
DESCRIPTION = "A minimal Linux image that includes libgcrypt, gnutls, and wolfProvider all configured to use wolfSSL FIPS as the crypto backend. wolfProvider is configured in replace-default mode. This image requires wolfSSL FIPS and does not require wolfssl-image-minimal."
|
|
|
|
inherit wolfssl-compatibility
|
|
|
|
# Validate that wolfssl-fips is the provider
|
|
# Just to be sure that the user has set the correct provider
|
|
python __anonymous() {
|
|
virtual_provider = d.getVar('PREFERRED_PROVIDER_virtual/wolfssl') or ''
|
|
wolfssl_provider = d.getVar('PREFERRED_PROVIDER_wolfssl') or ''
|
|
|
|
valid_fips_providers = ('wolfssl-fips', 'wolfssl-fips-ready')
|
|
|
|
if virtual_provider not in valid_fips_providers:
|
|
bb.fatal("fips-image-minimal requires PREFERRED_PROVIDER_virtual/wolfssl to be one of %s. Current value: '%s'. Please set 'require conf/wolfssl-fips.conf' or 'require conf/wolfssl-fips-ready.conf' in local.conf" % (valid_fips_providers, virtual_provider))
|
|
|
|
if wolfssl_provider not in valid_fips_providers:
|
|
bb.fatal("fips-image-minimal requires PREFERRED_PROVIDER_wolfssl to be one of %s. Current value: '%s'. Please set 'require conf/wolfssl-fips.conf' or 'require conf/wolfssl-fips-ready.conf' in local.conf" % (valid_fips_providers, wolfssl_provider))
|
|
|
|
wolfssl_varAppendNonOverride(d, 'IMAGE_INSTALL', ' wolfssl libgcrypt libgcrypt-ptest gnutls gnutls-dev gnutls-bin gnutls-fips wolfssl-gnutls-wrapper wolfssl-gnutls-wrapper-dev wolfprovider openssl openssl-bin openssh wolfprovidercmd wolfproviderenv pkgconfig ptest-runner bash make glibc-utils binutils ldd curl librelp-ptest')
|
|
}
|
|
|
|
require recipes-core/images/core-image-minimal.bb
|
|
|
|
# This image requires wolfssl-fips
|
|
# Set in local.conf:
|
|
# WOLFSSL_DEMOS = "fips-image-minimal"
|
|
# require conf/wolfssl-fips.conf
|
|
#
|
|
# For early kernel module loading (initramfs), also add to local.conf:
|
|
# INITRAMFS_IMAGE = "fips-initramfs"
|
|
# INITRAMFS_IMAGE_BUNDLE = "1"
|
|
#
|
|
# Note: INITRAMFS_IMAGE must be set in local.conf (not here) because
|
|
# the kernel needs to see it at build time, not just the image.
|