diff options
| author | Peter Jones <pjones@redhat.com> | 2017-08-02 18:20:20 -0400 |
|---|---|---|
| committer | Peter Jones <pjones@redhat.com> | 2017-08-11 15:18:39 -0400 |
| commit | 207dd7dc60df15f4b1d0c794b30c1aedcf8150c4 (patch) | |
| tree | e444e45f5c788df9d9431fe49c2ef7c02bb5426b /Makefile | |
| parent | 17cfebffc1186c2185023f9b4df363dd49185a26 (diff) | |
| download | efi-boot-shim-207dd7dc60df15f4b1d0c794b30c1aedcf8150c4.tar.gz efi-boot-shim-207dd7dc60df15f4b1d0c794b30c1aedcf8150c4.zip | |
Add ENABLE_SHIM_CERT to make MokManager/fallback signing optional.
This makes shim not create its own keyring and sign MokManager and
fallback by default.
Signed-off-by: Peter Jones <pjones@redhat.com>
Diffstat (limited to 'Makefile')
| -rw-r--r-- | Makefile | 12 |
1 files changed, 12 insertions, 0 deletions
@@ -127,8 +127,12 @@ endif LDFLAGS = --hash-style=sysv -nostdlib -znocombreloc -T $(EFI_LDS) -shared -Bsymbolic -L$(EFI_PATH) -L$(LIBDIR) -LCryptlib -LCryptlib/OpenSSL $(EFI_CRT_OBJS) --build-id=sha1 TARGETS = $(SHIMNAME) +ifneq ($(origin ENABLE_SHIM_CERT),undefined) TARGETS += $(MMNAME).signed $(FBNAME).signed +CFLAGS += -DENABLE_SHIM_CERT +else TARGETS += $(MMNAME) $(FBNAME) +endif OBJS = shim.o netboot.o cert.o replacements.o tpm.o version.o KEYS = shim_cert.h ocsp.* ca.* shim.crt shim.csr shim.p12 shim.pem shim.key shim.cer ORIG_SOURCES = shim.c shim.h netboot.c include/PeImage.h include/wincert.h include/console.h replacements.c replacements.h tpm.c tpm.h version.h @@ -171,7 +175,9 @@ certdb/secmod.db: shim.crt $(CERTUTIL) -d certdb/ -A -i shim.crt -n shim -t u shim.o: $(SOURCES) +ifneq ($(origin ENABLE_SHIM_CERT),undefined) shim.o: shim_cert.h +endif shim.o: $(wildcard $(TOPDIR)/*.h) cert.o : $(TOPDIR)/cert.S @@ -230,20 +236,26 @@ install : install-deps $(INSTALL) -m 0644 $(SHIMNAME) $(DESTDIR)/$(EFIBOOTDIR)/$(BOOTEFINAME) $(INSTALL) -m 0644 $(SHIMNAME) $(DESTDIR)/$(TARGETDIR)/ $(INSTALL) -m 0644 $(BOOTCSVNAME) $(DESTDIR)/$(TARGETDIR)/ +ifneq ($(origin ENABLE_SHIM_CERT),undefined) $(INSTALL) -m 0644 $(FBNAME).signed $(DESTDIR)/$(EFIBOOTDIR)/$(FBNAME) $(INSTALL) -m 0644 $(MMNAME).signed $(DESTDIR)/$(EFIBOOTDIR)/$(MMNAME) $(INSTALL) -m 0644 $(MMNAME).signed $(DESTDIR)/$(TARGETDIR)/$(MMNAME) +else $(INSTALL) -m 0644 $(FBNAME) $(DESTDIR)/$(EFIBOOTDIR)/ $(INSTALL) -m 0644 $(MMNAME) $(DESTDIR)/$(EFIBOOTDIR)/ $(INSTALL) -m 0644 $(MMNAME) $(DESTDIR)/$(TARGETDIR)/ +endif install-as-data : install-deps $(INSTALL) -d -m 0755 $(DESTDIR)/$(DATATARGETDIR) $(INSTALL) -m 0644 $(SHIMNAME) $(DESTDIR)/$(DATATARGETDIR)/ +ifneq ($(origin ENABLE_SHIM_CERT),undefined) $(INSTALL) -m 0644 $(MMNAME).signed $(DESTDIR)/$(DATATARGETDIR)/$(MMNAME) $(INSTALL) -m 0644 $(FBNAME).signed $(DESTDIR)/$(DATATARGETDIR)/$(FBNAME) +else $(INSTALL) -m 0644 $(MMNAME) $(DESTDIR)/$(DATATARGETDIR)/$(MMNAME) $(INSTALL) -m 0644 $(FBNAME) $(DESTDIR)/$(DATATARGETDIR)/$(FBNAME) +endif %.efi: %.so ifneq ($(OBJCOPY_GTE224),1) |