diff mbox series

Add Yocto instructions for encryption

Message ID 20250505155840.13444-1-perezmeyer@gmail.com
State Changes Requested
Headers show
Series Add Yocto instructions for encryption | expand

Commit Message

Lisandro Pérez Meyer May 5, 2025, 3:56 p.m. UTC 
From: Lisandro Perez Meyer <lpmeyer@ics.com>

Signed-off-by: Lisandro Perez Meyer <lpmeyer@ics.com>
---
 doc/source/building-with-yocto.rst | 60 ++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

Comments

Lisandro Pérez Meyer May 5, 2025, 4:21 p.m. UTC | #1 
On Mon, May 5, 2025 at 12:58 PM Lisandro Damián Nicanor Pérez Meyer <
lpmeyer@ics.com> wrote:

> From: Lisandro Perez Meyer <lpmeyer@ics.com>
>
> Signed-off-by: Lisandro Perez Meyer <lpmeyer@ics.com>
> ---
>  doc/source/building-with-yocto.rst | 60 ++++++++++++++++++++++++++++++
>  1 file changed, 60 insertions(+)
>
> diff --git a/doc/source/building-with-yocto.rst
> b/doc/source/building-with-yocto.rst
> index f55b83ad..33b57b39 100644
> --- a/doc/source/building-with-yocto.rst
> +++ b/doc/source/building-with-yocto.rst
> @@ -265,6 +265,66 @@ In the simple way, your recipe looks like
>          SWUPDATE_IMAGES_FSTYPES[<name of your image>] = <fstype to be put
> into SWU>
>          inherit swupdate-image
>

Please give me some extra time: I think I can improve this a little bit
more. Also: apologies about not properly handling patches via email. Even
if I have been around open source for 15+ years I never got to deal with
email workflows (except on Debian, but that is a totally different thing).
diff mbox series

Patch

diff --git a/doc/source/building-with-yocto.rst b/doc/source/building-with-yocto.rst
index f55b83ad..33b57b39 100644
--- a/doc/source/building-with-yocto.rst
+++ b/doc/source/building-with-yocto.rst
@@ -265,6 +265,66 @@  In the simple way, your recipe looks like
         SWUPDATE_IMAGES_FSTYPES[<name of your image>] = <fstype to be put into SWU>
         inherit swupdate-image
 
+
+SWU image content's encryption
+-----------------------------
+
+The swupdate class is able to encrypt the contents of the SWU image. In order to do
+so, set `SWUPDATE_AES_FILE` to the full path of the key. Then, for each content
+you want to encrypt, on your SWU image recipe, add:
+
+::
+
+
+        SWUPDATE_IMAGES_ENCRYPTED[content] = "1"
+
+
+Where `content` matches the files described on `sw-description`.
+
+If you want to encrypt sw-description just set:
+
+::
+
+
+        SWUPDATE_ENCRYPT_SWDESC = "1"
+
+
+Do not forget to add ``encrypted = true;`` on each of the contents that will require
+decryption on the ``sw-description`` file.
+
+Expanding on the previous example:
+
+::
+
+        DESCRIPTION = "Example recipe generating SWU image"
+        SECTION = ""
+
+        LICENSE = ""
+
+        # Add all local files to be added to the SWU
+        # sw-description must always be in the list.
+        # You can extend with scripts or whatever you need
+        SRC_URI = " \
+            file://sw-description \
+            "
+
+        # images to build before building swupdate image
+        IMAGE_DEPENDS = "core-image-full-cmdline virtual/kernel"
+
+        # images and files that will be included in the .swu image
+        SWUPDATE_IMAGES = "core-image-full-cmdline uImage"
+
+        # a deployable image can have multiple format, choose one
+        SWUPDATE_IMAGES_FSTYPES[core-image-full-cmdline] = ".ubifs"
+        SWUPDATE_IMAGES_FSTYPES[uImage] = ".bin"
+
+        SWUPDATE_IMAGES_ENCRYPTED[core-image-full-cmdline.ubifs] = "1"
+        SWUPDATE_IMAGES_ENCRYPTED[uImage] = "1"
+        SWUPDATE_ENCRYPT_SWDESC = "1"
+
+        inherit swupdate
+
+
 What about grub ?
 =================
 In order to use swupdate with grub, swupdate needs to be configured to use grub. Some of