Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

workflows: yocto-build-deploy: add PKI signing key ID #474

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

workflows: yocto-build-deploy: add PKI signing key ID #474

wants to merge 4 commits into from
+16 −2

Conversation

alexgg
Copy link
Collaborator

@alexgg alexgg commented Dec 18, 2024

Change-type: patch

@alexgg alexgg marked this pull request as draft December 18, 2024 12:59
@alexgg alexgg temporarily deployed to balena-staging.com December 18, 2024 12:59 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 18, 2024 13:32 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 18, 2024 13:32 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 18, 2024 13:32 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-staging.com December 18, 2024 15:18 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 18, 2024 15:51 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 18, 2024 15:51 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 18, 2024 15:51 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-staging.com December 19, 2024 11:12 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 19, 2024 11:45 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 19, 2024 11:45 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-staging.com December 20, 2024 10:27 — with GitHub Actions Inactive
@alexgg alexgg marked this pull request as ready for review December 20, 2024 10:39
@alexgg alexgg temporarily deployed to balena-cloud.com December 20, 2024 11:31 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 20, 2024 11:31 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 20, 2024 11:31 — with GitHub Actions Inactive
@klutchell
Copy link
Contributor

klutchell commented Dec 20, 2024 •
edited
Loading

Before merging this, we should probably define the variable in the repository for safe-settings to apply.

So you'll need a top-level variables property here or here.

I guess you have the default in place, so we don't have to wait. Is that default meant to apply to all device repos?

@alexgg alexgg temporarily deployed to balena-staging.com December 23, 2024 09:30 — with GitHub Actions Inactive
@alexgg alexgg requested a review from klutchell December 23, 2024 09:31
@alexgg alexgg temporarily deployed to balena-cloud.com December 23, 2024 10:33 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 23, 2024 10:33 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 23, 2024 10:33 — with GitHub Actions Inactive
@alexgg alexgg had a problem deploying to balena-staging.com December 23, 2024 14:29 — with GitHub Actions Failure
@alexgg
workflows: yocto-build-deploy: add SSH key to environment
5f575f6 
This allows the build step to access private repositories via SSH.

Change-type: patch
Signed-off-by: Alex Gonzalez <[email protected]>
@alexgg
workflows: yocto-build-deploy: add PKI signing key ID
ff4be4d 
Change-type: patch
Signed-off-by: Alex Gonzalez <[email protected]>
@alexgg
workflows: yocto-build-deploy: allow to override SIGN_GRUB_KEY_ID
650c0c1 
This allows to set specific environments for custom secrets support.

Change-type: patch
Signed-off-by: Alex Gonzalez <[email protected]>
@alexgg
yocto-build-env: remove no cache argument
4bd128c 
Secure boots builds used to end up with a mismatch between the kernel
and modules signatures because of the use of cache - to avoid this we
temporarily forced builds without cache.

With the fix in meta-balena 389054e84c0b1fd382d737c39fb2bb02c2b3e9b2,
kernel modules are always set not to use cache and this problem should
no longer happen.

At least during the i.MX secure boot local builds with cache never hit
the problem.

Remove the setting not to use cache.

Change-type: revert to building secure boot with cache
Signed-off-by: Alex Gonzalez <[email protected]>
@alexgg alexgg temporarily deployed to balena-staging.com December 23, 2024 15:50 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 23, 2024 16:22 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 23, 2024 16:22 — with GitHub Actions Inactive
@alexgg alexgg temporarily deployed to balena-cloud.com December 23, 2024 16:22 — with GitHub Actions Inactive
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jakogut jakogut Awaiting requested review from jakogut

@mtoman mtoman Awaiting requested review from mtoman

@rcooke-warwick rcooke-warwick Awaiting requested review from rcooke-warwick

@klutchell klutchell Awaiting requested review from klutchell

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@alexgg @klutchell