efi: libstub: Remove zboot signing from build options

Browse source

The zboot decompressor series introduced a feature to sign the PE/COFF
kernel image for secure boot as part of the kernel build. This was
necessary because there are actually two images that need to be signed:
the kernel with the EFI stub attached, and the decompressor application.

This is a bit of a burden, because it means that the images must be
signed on the the same system that performs the build, and this is not
realistic for distros.

During the next cycle, we will introduce changes to the zboot code so
that the inner image no longer needs to be signed. This means that the
outer PE/COFF image can be handled as usual, and be signed later in the
release process.

Let's remove the associated Kconfig options now so that they don't end
up in a LTS release while already being deprecated.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>

...

This commit is contained in:

Ard Biesheuvel 2022-10-17 12:48:46 +02:00

parent 9abf2313ad

commit f57fb375a2

2 changed files with 4 additions and 47 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

22

drivers/firmware/efi/Kconfig

View file

29

drivers/firmware/efi/libstub/Makefile.zboot

View file