u-boot/tools/Kconfig

102 lines
2.3 KiB
Text
Raw Normal View History

menu "Tools options"
config MKIMAGE_DTC_PATH
string "Path to dtc binary for use within mkimage"
default "dtc"
help
The mkimage host tool will, in order to generate FIT images make
calls to the dtc application in order to create the output. In
some cases the system dtc may not support all required features
and the path to a different version should be given here.
config TOOLS_CRC32
def_bool y
help
Enable CRC32 support in the tools builds
tools: Use a single target-independent config to enable OpenSSL Host tool features, such as mkimage's ability to sign FIT images were enabled or disabled based on the target configuration. However, this misses the point of a target-agnostic host tool. A target's ability to verify FIT signatures is independent of mkimage's ability to create those signatures. In fact, u-boot's build system doesn't sign images. The target code can be successfully built without relying on any ability to sign such code. Conversely, mkimage's ability to sign images does not require that those images will only work on targets which support FIT verification. Linking mkimage cryptographic features to target support for FIT verification is misguided. Without loss of generality, we can say that host features are and should be independent of target features. While we prefer that a host tool always supports the same feature set, we recognize the following - some users prefer to build u-boot without a dependency on OpenSSL. - some distros prefer to ship mkimage without linking to OpenSSL To allow these use cases, introduce a host-only Kconfig which is used to select or deselect libcrypto support. Some mkimage features or some host tools might not be available, but this shouldn't affect the u-boot build. I also considered setting the default of this config based on FIT_SIGNATURE. While it would preserve the old behaviour it's also contrary to the goals of this change. I decided to enable it by default, so that the default build yields the most feature-complete mkimage. Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
2021-07-14 22:05:47 +00:00
config TOOLS_LIBCRYPTO
bool "Use OpenSSL's libcrypto library for host tools"
default y
help
Cryptographic signature, verification, and encryption of images is
provided by host tools using OpenSSL's libcrypto. Select 'n' here if
you wish to build host tools without OpenSSL. mkimage will not have
the ability to sign images.
This selection does not affect target features, such as runtime FIT
signature verification.
config TOOLS_FIT
def_bool y
help
Enable FIT support in the tools builds.
config TOOLS_FIT_FULL_CHECK
def_bool y
help
Do a full check of the FIT before using it in the tools builds
config TOOLS_FIT_PRINT
def_bool y
help
Print the content of the FIT verbosely in the tools builds
config TOOLS_FIT_RSASSA_PSS
def_bool y
help
Support the rsassa-pss signature scheme in the tools builds
config TOOLS_FIT_SIGNATURE
def_bool y
help
Enable signature verification of FIT uImages in the tools builds
config TOOLS_FIT_SIGNATURE_MAX_SIZE
hex
depends on TOOLS_FIT_SIGNATURE
default 0x10000000
config TOOLS_FIT_VERBOSE
def_bool y
help
Support verbose FIT output in the tools builds
config TOOLS_MD5
def_bool y
help
Enable MD5 support in the tools builds
config TOOLS_OF_LIBFDT
def_bool y
help
Enable libfdt support in the tools builds
config TOOLS_SHA1
def_bool y
help
Enable SHA1 support in the tools builds
config TOOLS_SHA256
def_bool y
help
Enable SHA256 support in the tools builds
config TOOLS_SHA384
def_bool y
help
Enable SHA384 support in the tools builds
config TOOLS_SHA512
def_bool y
help
Enable SHA512 support in the tools builds
config TOOLS_MKEFICAPSULE
bool "Build efimkcapsule command"
default y if EFI_CAPSULE_ON_DISK
help
This command allows users to create a UEFI capsule file and,
optionally sign that file. If you want to enable UEFI capsule
update feature on your target, you certainly need this.
endmenu