[Acked/CMT] [SRU][Xenial][Bionic][PATCH 0/2] UBUNTU: [Packaging] Support building Flattened Image Tree (FIT) kernels

[Andy Whitcroft]

On Mon, Oct 14, 2019 at 06:09:11PM +0800, Shrirang Bagul wrote:
> BugLink: https://bugs.launchpad.net/bugs/1847969
> 
> [Impact]
> Flexible and powerful format based on Flattened Image Tree -- FIT (similar
> to Flattened Device Tree). It allows the use of images with multiple
> components (several kernels, ramdisks, etc.), with contents protected by
> SHA1, MD5 or CRC32, etc.
> More details: https://gitlab.denx.de/u-boot/u-boot/blob/master/doc/uImage.FIT/howto.txt
> 
> The packaging changes will add support for building a FIT kernel binary
> blob which can be subsequently signed. These FIT-signed kernels will be
> consumed by snapcraft recipes to build kernel snaps for platforms with
> U-Boot bootloader enforcing secure boot.
> 
> [Regression Potential]
> Minimal. These patches add new signing logic and build script around
> 'fit_signed' variable. The current build for generic kernels should not be
> affected.
> 
> Alfonso Sánchez-Beato (2):
>   UBUNTU: [Packaging] add rules to build FIT image
>   UBUNTU: [Packaging] force creation of headers directory
> 
>  debian/rules                    |  2 +-
>  debian/rules.d/1-maintainer.mk  |  1 +
>  debian/rules.d/2-binary-arch.mk | 17 +++++++++++++-
>  debian/scripts/build-fit        | 40 +++++++++++++++++++++++++++++++++
>  4 files changed, 58 insertions(+), 2 deletions(-)
>  create mode 100755 debian/scripts/build-fit

These look reasonable.  I am slightly supprised by the second one
needing to exist, but the result looks safe even so.

~sforshee I assume we want to fold this into the latest kernel with s390
signing in it too.

Acked-by: Andy Whitcroft <apw at canonical.com>

-apw