witherspoon: Enable BMC signature verification
Enable signature verification in the phosphor-software-manager code
for witherspoon. This causes an error to be logged if updating to
an unsigned image, or image signed with a different key than the one
on the system, and if field mode is set, it'll stop the activation
process.
Tested: Signature verification is enforced on witherspoon,
verified error is logged with and without field mode enabled, and
activation is prevented with field mode enabled.
Change-Id: Ifc8f8054f8d852cc16942af9cbf58d60aff3fc33
Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>
diff --git a/meta-openbmc-machines/meta-openpower/meta-ibm/meta-witherspoon/recipes-phosphor/flash/phosphor-software-manager.bbappend b/meta-openbmc-machines/meta-openpower/meta-ibm/meta-witherspoon/recipes-phosphor/flash/phosphor-software-manager.bbappend
index feab2c1..21ee4da 100644
--- a/meta-openbmc-machines/meta-openpower/meta-ibm/meta-witherspoon/recipes-phosphor/flash/phosphor-software-manager.bbappend
+++ b/meta-openbmc-machines/meta-openpower/meta-ibm/meta-witherspoon/recipes-phosphor/flash/phosphor-software-manager.bbappend
@@ -2,3 +2,6 @@
BMC_RO_MTD = "alt-bmc+bmc"
BMC_KERNEL_MTD = "bmc"
BMC_RW_SIZE = "0x600000"
+
+# Enable signature verification by DISTRO_FEATURE obmc-ubi-fs
+PACKAGECONFIG_append_df-obmc-ubi-fs = " verify_signature"
diff --git a/meta-phosphor/common/recipes-phosphor/flash/phosphor-software-manager.bb b/meta-phosphor/common/recipes-phosphor/flash/phosphor-software-manager.bb
index 43e363b..43e5aba 100644
--- a/meta-phosphor/common/recipes-phosphor/flash/phosphor-software-manager.bb
+++ b/meta-phosphor/common/recipes-phosphor/flash/phosphor-software-manager.bb
@@ -23,6 +23,8 @@
# handles the rest.
SYSTEMD_PACKAGES = ""
+PACKAGECONFIG[verify_signature] = "--enable-verify_signature,--disable-verify_signature"
+
inherit autotools pkgconfig
inherit obmc-phosphor-dbus-service
inherit pythonnative