On 25-08-05, Sascha Hauer wrote:
> +Cc Basti
>
> On Thu, Jul 24, 2025 at 03:50:56PM +0200, Marco Felsch wrote:
> > Currently the env provided keyspec is resolved during the gen_key() step
> > by making use of the try_resolve_env(). This is wrong because it will
> > set the complete <hint>:<key> keyspec string for the 'keyname' and 'path'.
> >
> > To fix this the resolve step must happen during the main-loop as first step
> > because the main-loop is doing the 'keyname' and 'path' split already.
> >
> > Signed-off-by: Marco Felsch <m.fel...@pengutronix.de>
> > ---
> > scripts/keytoc.c | 13 +++++--------
> > 1 file changed, 5 insertions(+), 8 deletions(-)
> >
> > diff --git a/scripts/keytoc.c b/scripts/keytoc.c
> > index 617317d6607e..105fa4b5413d 100644
> > --- a/scripts/keytoc.c
> > +++ b/scripts/keytoc.c
> > @@ -615,10 +615,6 @@ static int gen_key(const char *keyname, const char
> > *path)
> > char *tmp, *key_name_c;
> >
> > /* key name handling */
> > - keyname = try_resolve_env(keyname);
> > - if (!keyname)
> > - exit(1);
> > -
> > tmp = key_name_c = strdup(keyname);
> >
> > while (*tmp) {
> > @@ -628,10 +624,6 @@ static int gen_key(const char *keyname, const char
> > *path)
> > }
> >
> > /* path/URI handling */
> > - path = try_resolve_env(path);
> > - if (!path)
> > - exit(1);
> > -
>
> This was introduced by Basti in 685cc602e0ad ("keytoc: allow __ENV__
> lookup for keyname hint") to support:
>
> CONFIG_CRYPTO_PUBLIC_KEYS="__ENV__FIT_KEY_NAME_HINT:__ENV__FIT_KEY"
Right, albeit I don't see why there should be two separate environment
variables for specifying one keyspec entry.
> I believe this patch breaks this usecase.
Of course :-/ but at the moment the simple use-case:
__ENV__FITKEY -> FITKEY="hint:<key>"
is broken. IMHO having two separate ENV variables is rather counter
intuitive. I also found myself in the following situation:
__ENV__FITKEYS -> FITKEYS="hint:<key> hint-2:<key-2> <key-3>"
This is not supported as well. So we should really define and document
the ENV behavior.
Regards,
Marco
>
> Sascha
>
> > if (!strncmp(path, "pkcs11:", 7)) {
> > ret = engine_get_pub_key(path, &key);
> > if (ret)
> > @@ -737,6 +729,11 @@ int main(int argc, char *argv[])
> > char *keyname = NULL;
> > char *path = NULL;
> >
> > + /* Check if the keyspec is provided by the ENV first */
> > + keyspec = try_resolve_env(keyspec);
> > + if (!keyspec)
> > + exit(1);
> > +
> > if (!strncmp(keyspec, "pkcs11:", 7))
> > path = strdup(keyspec);
> > else
> > --
> > 2.39.5
> >
> >
> >
>
> --
> Pengutronix e.K. | |
> Steuerwalder Str. 21 | http://www.pengutronix.de/ |
> 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
> Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
>
