github/acrn-hypervisor
1
0
Fork 0
mirror of https://github.com/projectacrn/acrn-hypervisor.git synced 2025-09-24 10:17:28 +00:00
Code Issues Projects Releases Wiki Activity

doc: Add tutorial to learn to sign binaries of a Clear Linux image.

Browse Source 
This tutorial will describe steps to sign binaries of
a Clear Linux image that allows user to launch VM
throught the secure boot enabled OVMF.

Signed-off-by: lirui34 <ruix.li@intel.com>
This commit is contained in:
lirui34
2019-07-18 15:10:14 +08:00
committed by David Kinder
parent be44e138fd
commit ffa7f80544
2 changed files with 107 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
doc/tutorials/sign_clear_linux_image.rst Normal file
View File

@@ -0,0 +1,38 @@
.. _sign_clear_linux_image:
How to sign binaries of the Clear Linux image
#############################################
In this tutorial, you will see how to sign the binaries of a Clear Linux image so that you can
boot it through a secure boot enabled OVMF.
Prerequisites
*************
* Install **sbsigntool** on Ubuntu (Verified on 18.04)::
$ sudo apt install sbsigntool
* Download and extract the Clear Linux image from the `release <https://cdn.download.clearlinux.org/releases/>`_::
$ export https_proxy=<your https proxy>:<port>
$ wget https://cdn.download.clearlinux.org/releases/29880/clear/clear-29880-kvm.img.xz
$ unxz clear-29880-kvm.img.xz
* Download script `sign_image.sh
<https://raw.githubusercontent.com/projectacrn/acrn-hypervisor/master/doc/scripts/>`_ on Ubuntu.
Steps to sign the binaries of the Clear Linux image
***************************************************
#. Follow the `KeyGeneration <https://wiki.ubuntu.com/UEFI/SecureBoot/KeyManagement/KeyGeneration>`_ to generate
the key and certification which will be used to sign the binaries.
#. Get these files from the previous step:
* archive-subkey-private.key
* archive-subkey-public.crt
#. Use the script to sign binaries in the Clear Linux image::
$ sudo sh sign_image.sh $PATH_TO_CLEAR_IMAGE $PATH_TO_KEY $PATH_TO_CERT
#. **clear-xxx-kvm.img.signed** will be generated in the same folder as the original clear-xxx-kvm.img.