base: efitools: sign the UnLock efi at install phase

We can't change files of ${D} in the do_deploy task and so
we need to move it to the do_install task.

This new UnLock efi is only required in the target and this
is the reason of the class-target override.
Before it don't fail on the class native because the do_deploy
only runs for the class target.

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>

meta-lmp-base/recipes-bsp/efitools/efitools.inc

@@ -58,4 +58,18 @@ do_install() {
     oe_runmake install DESTDIR='${D}${base_prefix}'
 }
 
+do_install:append:class-target() {
+    if ! sbsign --key ${UEFI_SIGN_KEYDIR}/DB.key \
+                --cert ${UEFI_SIGN_KEYDIR}/DB.crt \
+                --output ${D}${datadir}/efitools/efi/UnLock-signed.efi \
+                ${D}${datadir}/efitools/efi/UnLock.efi; then
+        bbfatal "Failed to sign UnLock.efi"
+    fi
+
+    if ! sbverify --cert ${UEFI_SIGN_KEYDIR}/DB.crt \
+                   ${D}${datadir}/efitools/efi/UnLock-signed.efi; then
+        bbfatal "Failed to verify UnLock-signed.efi"
+    fi
+}
+
 SSTATE_ALLOW_OVERLAP_FILES += "${DEPLOY_DIR_IMAGE}/LockDown.efi ${DEPLOY_DIR_IMAGE}/UnLock-signed.efi"

meta-lmp-base/recipes-bsp/efitools/efitools_git.bb

@@ -55,19 +55,6 @@ do_deploy() {
     install -d ${DEPLOYDIR}
     install -m 0600 ${D}${datadir}/efitools/efi/LockDown.efi ${DEPLOYDIR}
     install -m 0600 ${WORKDIR}/lockdown.conf ${DEPLOYDIR}
-
-    if ! sbsign --key ${UEFI_SIGN_KEYDIR}/DB.key \
-                --cert ${UEFI_SIGN_KEYDIR}/DB.crt \
-		--output ${D}${datadir}/efitools/efi/UnLock-signed.efi \
-		${D}${datadir}/efitools/efi/UnLock.efi; then
-        bbfatal "Failed to sign UnLock.efi"
-    fi
-
-    if ! sbverify --cert ${UEFI_SIGN_KEYDIR}/DB.crt \
-                   ${D}${datadir}/efitools/efi/UnLock-signed.efi; then
-        bbfatal "Failed to verify UnLock-signed.efi"
-    fi
-
     install -m 0600 ${D}${datadir}/efitools/efi/UnLock-signed.efi ${DEPLOYDIR}
     install -m 0600 ${WORKDIR}/unlock.conf ${DEPLOYDIR}
 }