Hi all, I’m working on updating our old Yocto image to from Honnister all the way to Scarthgap. My troubles are with getting meta-mender and meta-secure-core to play nice. I have resolved numerous issues (and fixed several bugs in meta-secure-core in the process), but mender’s grubenv is being p…

Well, i finally got it. Turns out my primary mistake was inheriting mender-full in my image rather than local.conf. That lead to MENDER_FEATURES being empty for anything other than my image recipe, and thus everything went haywire. A second problem, was mender setting the wrong root device. To fi…

Ok, after some more digging I might have narrowed this down: GRUB_ENV_LOCATION is composed of, in part, MENDER_BOOT_PART_MOUNT_LOCATION MENDER_BOOT_PART_MOUNT_LOCATION is set by meta-mender/meta-mender-core/classes/mender-setup-image.inc:28 to /boot/efi grub-mender-grubenv:do_compile and grub-mend…

Alright, so i did go ahead an debugged that collision further, turns out the PROVIDES and RPROVIDES weren’t being set. Some injected debug outputs show MENDER_FEATURES and MENDER_FEATURES_ENABLE to be empty as fas as the grub-mender-grubenv recipe is concerned, causing @mender_feature_is_enabled ch…

Hi @Adrian , Thanks for the heads up! Unfortunately my experience with secure boot in this context is very limited. I’ll try to replicate this, right from top of my head nothing that hits me immediately. Maybe @annalenamarx ? I think you have used x86 with secure boot + Mender already successfully. …

Hi @adrian and @TheYoctoJester , I’m still not sure on your actual approach, but I think it went on a hard to solve track right from the beginning. May you can use Mender and efi-secure-boot on intel-corei7-64 - #12 by esscrb as an inspiration, this is where I oriented myself while implementing and…

Hi @annalenamarx , thank you for your reply! My approach was just supposed to be meta-efi-secure-boot for secure boot and later on IMA, and mender for OTA updates (USB-only is, unfortunately, not an option for us). As far as i know, the only non standard thing I did on the secure boot side was to …

Hi @adrian , we have OTA running with this approach including custom Mender state scripts to handle the signed kernel gets updated in /boot/efi. Works fine! Even without initramfs :smiley: I think MENDER_BOOT_PART_MOUNT_LOCATION is a question for @TheYoctoJester , I’m not aware of this issue with k…

[image] adrian: I was trying to structure my code logically, and isolate sections as much as possible to avoid the bloat to local.conf, but BitBake has other ideas it seems. Hi @Adrian , ah indeed, that’s a sometimes unexpected effect. Let me explain, there’s actually a good reason for it. I…

Hi @TheYoctoJester , thanks for that explainer. I have a strong philosophical problem with the way Yocto overuses local.conf, but that is something I’d have to take up with the Yocto mailing list. I marked my last post as an answer for anyone running into this in the future. However, I’m not quit…

[image] adrian: thanks for that explainer. I have a strong philosophical problem with the way Yocto overuses local.conf, but that is something I’d have to take up with the Yocto mailing list. Hi @Adrian , hehe, no, it’s not local.conf. The key wording is “configuration file”, not “local.conf”…

Error: grub-mender-grubenv:do_sign failed

General Discussions

annalenamarx August 20, 2024, 9:26am 12

I think I had the same issue, this is how I solved it Mender and efi-secure-boot on intel-corei7-64 - #13 by annalenamarx

Topic		Replies	Views
Simple configuration (dunfell) General Discussions	29	2944	March 9, 2021
Boot device not found after integration mender into yocto General Discussions yocto , intel , thud	23	4395	September 6, 2019
Info on mender integration Yocto Project dunfell , imx8mm	16	3474	February 16, 2023
Mender from scratch Other	8	10078	September 14, 2021
Debian EFI cold boot fails, msdos vs gpt partition confusion Debian family	6	960	November 4, 2023

Error: grub-mender-grubenv:do_sign failed

Related topics