From: Kazuhiro Hayashi <kazuhiro3.hayashi@...> Identified security packages are added to the target image and that will be used for IEC-62443-4-2 evaluation Signed-off-by: Kazuhiro Hayashi

From: Venkata Pyla <venkata.pyla@...> Patch series for Security changes for IEC-62443-4-2 evaluation Kazuhiro Hayashi (1): cip-security: Add packages for IEC-62443-4-2

Daniel, Pavel: Thanks for the feedback. Is tlsdate a better alternative (https://github.com/ioerror/tlsdate/)? The only caveat if using tlsdate (or any sort of time mechanism that relies on a

FYI Kind regards, Chris

Hello, During the last CIP Core meeting we discussed about license compliance for CIP core image releases. In particular, we talked about how to make sure that users can get exactly the same source

Hi Jan, Patches give you greater visibility (all cip-dev members), but I can see some benefits in using MRs as well: * merge when the pipeline succeeds * map issues with the patches that close them *

Hi Pavel, *I renamed the subject and added cip-security to Cc

Hi, CIP kernel team has released Linux kernel v4.19.134-cip31. The linux-4.19.y-cip tree has been updated base version from v4.19.132 to v4.19.134, In addition, the rcar-du and display features have

Hi! v4.4.231-cip47-rt30 should be available at kernel.org. Trees are available

The conflict was due to a missing rename back in 4.4: e4a81bfcaae1 ("x86/fpu: Rename fpu::fpstate_active to fpu::initialized"). I've fixed up the patch and queued it for 4.4, thanks for pointing

You are asking about something we did back in 2018. I can't remember what I did last week :) If you provide a backport that works, I'll be glad to take it. The current patch does not apply cleanly

Any reason why the backport stopped back than at 4.9? I just debugged this out of a 4.4 kernel, and it is needed there as well. I'm happy to propose a backport, would just appreciate a hint if the BH

From: Quirin Gylstorff <quirin.gylstorff@...> Signed-off-by: Quirin Gylstorff <quirin.gylstorff@...> --- doc/README.secureboot.md | 229 +++++++++++++++++++++++++++++++++++++++ 1

From: Quirin Gylstorff <quirin.gylstorff@...> Use the Debian snakeoil keys to have a demo case available without the OVMF setup. Copy the used keys from the build to the deploy directory to

From: Quirin Gylstorff <quirin.gylstorff@...> A unified kernel image contains the os-release, kernel, kernel commandline, initramfs and efi-stub in one binary. This binary can be boot by

From: Quirin Gylstorff <quirin.gylstorff@...> As the usage of a unified kernel image freeze the kernel commmandline during build time the rootfs selection for swupdate can no longer be done

From: Quirin Gylstorff <quirin.gylstorff@...> This patchset adds secureboot with efibootguard to cip-core. The image build signs the efibootguard bootloader (bootx64.efi) and generates a

From: Quirin Gylstorff <quirin.gylstorff@...> Adapt the initramfs generation to set for example the root device in the initramfs Signed-off-by: Quirin Gylstorff

From: Quirin Gylstorff <quirin.gylstorff@...> Add a fat configuration to access FAT Partitions on the qemu-amd64 target. Signed-off-by: Quirin Gylstorff <quirin.gylstorff@...> ---

From: Quirin Gylstorff <quirin.gylstorff@...> Add swupdate for A/B software updates. Currently the Round Robin handler in lua supports efibootguard as bootloader. The u-boot implementation is