[...] > > > FWIW I personally don't think we should even have a config option. But > > > even > > > if we did it certainly must not be dictated by a hardware config. > > > > > > When you install distro packages you accept whatever dependencies the > > > package has. mkeficapsule is a capsule creation and signing tool. I don't > > > see any reason for keeping the creation and signing apart. > > > > My question is, since the U-Boot binary is heavily dependent on the target > > platform, can we split the u-boot.bin creation (may include embedding keys) > > and the capsule file creation (including signing)? > > Building U-Boot and creating a capsule are totally separate. Maybe you > get the first capsule years after you buy your board. But this should > not stop us from building mkeficapsule when building U-Boot. >
Based on what was discussed in the thread waht I think would make more sense is: - Build u-boot and use the script Akashi sent to inject the certificate. Whether we create a single binary (always signed if a config option is there) or 2 binaries (1 signed. 1 unsigned) is an implemetation detail and I am fine with either. - Use mkefi capsule to create the final capsule > If you want to build tools only, you can do so with 'make tools'. The > tools target must include mkeficapsule irrespective of configuration. > > This line in tools/Makefile must be corrected: > > -hostprogs-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += mkeficapsule > +hostprogs-y += mkeficapsule So that's the point exactly. Building the tool is completely disjoint from building a u-boot binary. Also you usually start adding config options to an app, when it starts getting to big and you want discrete functionality. I don't see any reason for making a simple tool, which is supposed to do 2 things (create/sign), require config options and more over config options *for U-Boot*. I also think it's extremely unlikely to get any working distro without libssl. > > Best regards > > Heinrich
