Thanks, applied as b1afc61b444742d0baf30cefb6324245ff9d3f1e. Michael
[sent from post-receive hook] On Sat, 20 Jun 2020 00:04:06 +0200, Bastian Krause <[email protected]> wrote: > A ptxdist code signing provider is a package which selects the required > host tools needed for the code signing helpers to work. A shell script > is needed to define roles, set PKCS#11 URIs and import keys if SoftHSM > is used. In order to simplify its creation provide a template along with > an example script. > > Signed-off-by: Bastian Krause <[email protected]> > Message-Id: <[email protected]> > Tested-by: Roland Hieber <[email protected]> > Reviewed-by: Roland Hieber <[email protected]> > Signed-off-by: Michael Olbrich <[email protected]> > > diff --git a/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh > b/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh > new file mode 100755 > index 000000000000..6bbe830f2a2d > --- /dev/null > +++ b/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh > @@ -0,0 +1,42 @@ > +#!/bin/bash > + > +set -e > + > +set_fit_keys() { > + local r="image-kernel-fit" > + cs_define_role "${r}" > + > + # HSM use case > + cs_set_uri "${r}" "pkcs11:token=foo;object=kernel-fit" > +} > + > +set_rauc_keys() { > + local r="update" > + cs_define_role "${r}" > + cs_set_uri "${r}" "pkcs11:token=foo;object=rauc" > + cs_append_ca_from_uri "${r}" > +} > + > +set_imx_habv4_keys() { > + # HSM use case, assuming it contains only 1st CSF/IMG key > + for i in 1 2 3 4; do > + r="imx-habv4-srk${i}" > + cs_define_role "${r}" > + cs_set_uri "${r}" "pkcs11:token=foo;object=srk${i}" > + cs_append_ca_from_uri "${r}" > + done > + > + r="imx-habv4-csf1" > + cs_define_role ${r} > + cs_set_uri "${r}" "pkcs11:token=foo;object=csf1" > + > + r="imx-habv4-img1" > + cs_define_role ${r} > + cs_set_uri "${r}" "pkcs11:token=foo;object=img1" > +} > + > + > +# HSM use case > +set_fit_keys > +set_rauc_keys > +set_imx_habv4_keys > diff --git > a/rules/templates/code-signing-provider/ptxdist-set-keys-softhsm.sh > b/rules/templates/code-signing-provider/ptxdist-set-keys-softhsm.sh > new file mode 100755 > index 000000000000..0836d61d13b7 > --- /dev/null > +++ b/rules/templates/code-signing-provider/ptxdist-set-keys-softhsm.sh > @@ -0,0 +1,58 @@ > +#!/bin/bash > + > +set -e > + > +import_fit_keys() { > + local fit_cert_dir=fit > + local r="image-kernel-fit" > + cs_define_role "${r}" > + > + cs_import_cert_from_der "${r}" > "${fit_cert_dir}/fit-4096-development.crt" > + cs_import_pubkey_from_pem "${r}" > "${fit_cert_dir}/fit-4096-development.key" > + cs_import_privkey_from_pem "${r}" > "${fit_cert_dir}/fit-4096-development.key" > +} > + > +import_rauc_keys() { > + local rauc_cert_dir=rauc > + local r="update" > + cs_define_role "${r}" > + > + # SoftHSM use case > + cs_import_cert_from_pem "${r}" "${rauc_cert_dir}/rauc.cert.pem" > + cs_import_pubkey_from_pem "${r}" "${rauc_cert_dir}/rauc.key.pem" > + cs_import_privkey_from_pem "${r}" "${rauc_cert_dir}/rauc.key.pem" > + > + cs_append_ca_from_uri "${r}" > +} > + > +import_imx_habv4_keys() { > + local imx_habv4_key_dir="habv4" > + local crts="${imx_habv4_key_dir}/crts" > + local keys="${imx_habv4_key_dir}/keys" > + local OPENSSL_KEYPASS="${imx_habv4_key_dir}/keys/key_pass.txt" > + > + for i in 1 2 3 4; do > + r="imx-habv4-srk${i}" > + cs_define_role "${r}" > + cs_import_cert_from_der "${r}" > "${crts}/SRK${i}_sha256_4096_65537_v3_ca_crt.der" > + cs_import_key_from_pem "${r}" > "${keys}/SRK${i}_sha256_4096_65537_v3_ca_key.pem" > + cs_append_ca_from_uri "${r}" > + > + r="imx-habv4-csf${i}" > + cs_define_role "${r}" > + cs_import_cert_from_der "${r}" > "${crts}/CSF${i}_1_sha256_4096_65537_v3_usr_crt.der" > + cs_import_key_from_pem "${r}" > "${keys}/CSF${i}_1_sha256_4096_65537_v3_usr_key.pem" > + > + r="imx-habv4-img${i}" > + cs_define_role "${r}" > + cs_import_cert_from_der "${r}" > "${crts}/IMG${i}_1_sha256_4096_65537_v3_usr_crt.der" > + cs_import_key_from_pem "${r}" > "${keys}/IMG${i}_1_sha256_4096_65537_v3_usr_key.pem" > + done > +} > + > + > +# SoftHSM use case > +cs_init_softhsm > +import_fit_keys > +import_rauc_keys > +import_imx_habv4_keys > diff --git a/rules/templates/code-signing-provider/wizard.sh > b/rules/templates/code-signing-provider/wizard.sh > new file mode 100644 > index 000000000000..83d6d54e3541 > --- /dev/null > +++ b/rules/templates/code-signing-provider/wizard.sh > @@ -0,0 +1,10 @@ > +#!/bin/bash > + > +if [ "$TYPE" = "SoftHSM" ]; then > + mv ptxdist-set-keys-softhsm.sh ptxdist-set-keys.sh > + rm ptxdist-set-keys-hsm.sh > + > +elif [ "$TYPE" = "HSM with OpenSC support" ] || [ "$TYPE" = "other HSM" ]; > then > + mv ptxdist-set-keys-hsm.sh ptxdist-set-keys.sh > + rm ptxdist-set-keys-softhsm.sh > +fi > diff --git a/rules/templates/template-code-signing-provider-choice-in > b/rules/templates/template-code-signing-provider-choice-in > new file mode 100644 > index 000000000000..e2108f870cbf > --- /dev/null > +++ b/rules/templates/template-code-signing-provider-choice-in > @@ -0,0 +1,5 @@ > +## SECTION=code_signing_provider > + > +config CODE_SIGNING_PROVIDER_@PACKAGE@ > + bool > + prompt "@package@" > diff --git a/rules/templates/template-code-signing-provider-in > b/rules/templates/template-code-signing-provider-in > new file mode 100644 > index 000000000000..b84ba839c124 > --- /dev/null > +++ b/rules/templates/template-code-signing-provider-in > @@ -0,0 +1,14 @@ > +## SECTION=code_signing > + > +config CODE_SIGNING > + select HOST_@PACKAGE@_CODE_SIGNING if CODE_SIGNING_PROVIDER_@PACKAGE@ > + > +config CODE_SIGNING_PROVIDER > + default "@package@" if CODE_SIGNING_PROVIDER_@PACKAGE@ > + > +config HOST_@PACKAGE@_CODE_SIGNING > + bool > + select HOST_LIBP11 > + select HOST_OPENSSL > + select HOST_EXTRACT_CERT > + @EXTRA_DEPENDENCIES@ > diff --git a/rules/templates/template-code-signing-provider-make > b/rules/templates/template-code-signing-provider-make > new file mode 100644 > index 000000000000..94830d92e9e7 > --- /dev/null > +++ b/rules/templates/template-code-signing-provider-make > @@ -0,0 +1,41 @@ > +# -*-makefile-*- > +# > +# Copyright (C) @YEAR@ by @AUTHOR@ > +# > +# For further information about the PTXdist project and license conditions > +# see the README file. > +# > + > +# > +# We provide this package > +# > +HOST_PACKAGES-$(PTXCONF_HOST_@PACKAGE@_CODE_SIGNING) += > host-@package@-code-signing > + > +# > +# Paths and names > +# > +HOST_@PACKAGE@_CODE_SIGNING_VERSION := @VERSION@ > +HOST_@PACKAGE@_CODE_SIGNING := > @package@-code-signing-$(HOST_@PACKAGE@_CODE_SIGNING_VERSION) > +HOST_@PACKAGE@_CODE_SIGNING_URL := > file://local_src/@package@-code-signing > +HOST_@PACKAGE@_CODE_SIGNING_DIR := > $(HOST_BUILDDIR)/$(HOST_@PACKAGE@_CODE_SIGNING) > + > +HOST_@PACKAGE@_CODE_SIGNING_CONF_TOOL := NO > + > +# > ---------------------------------------------------------------------------- > +# Compile > +# > ---------------------------------------------------------------------------- > + > +HOST_@PACKAGE@_CODE_SIGNING_MAKE_ENV := \ > + $(CODE_SIGNING_ENV) > + > +$(STATEDIR)/host-@[email protected]: > + @$(call targetinfo) > + @$(call world/execute, HOST_@PACKAGE@_CODE_SIGNING, \ > + ./ptxdist-set-keys.sh) > + @$(call touch) > + > +$(STATEDIR)/host-@[email protected]: > + @$(call targetinfo) > + @$(call touch) > + > +# vim: syntax=make > diff --git a/rules/templates/template-code-signing-provider-pre-make > b/rules/templates/template-code-signing-provider-pre-make > new file mode 100644 > index 000000000000..8f24f650df42 > --- /dev/null > +++ b/rules/templates/template-code-signing-provider-pre-make > @@ -0,0 +1,14 @@ > +# -*-makefile-*- > +# > +# Copyright (C) @YEAR@ by @AUTHOR@ > +# > +# For further information about the PTXdist project and license conditions > +# see the README file. > +# > + > +ifndef PTXCONF_CODE_SIGNING_PROVIDER_@PACKAGE@ > +CODE_SIGNING_ENV += \ > + PKCS11_MODULE_PATH=@MODULE_PATH@ > +endif > + > +# vim: syntax=make > diff --git a/scripts/lib/ptxd_lib_template.sh > b/scripts/lib/ptxd_lib_template.sh > index 9cace6c14a0b..fc55126fac38 100644 > --- a/scripts/lib/ptxd_lib_template.sh > +++ b/scripts/lib/ptxd_lib_template.sh > @@ -489,3 +489,34 @@ ptxd_template_new_blspec_entry() { > export -f ptxd_template_new_blspec_entry > ptxd_template_help_list[${#ptxd_template_help_list[@]}]="blspec-entry" > ptxd_template_help_list[${#ptxd_template_help_list[@]}]="create package for > a bootloader spec entry" > + > +ptxd_template_new_code_signing_provider() { > + export class="host-" > + ptxd_template_read_basic && > + ptxd_template_read_author && > + ptxd_template_read_options "provider type" TYPE "SoftHSM" "HSM with > OpenSC support" "other HSM" > + package_filename="${package_filename}-code-signing" > + local template_file="$(ptxd_template_file "${template}-choice-in")" > + local > filename="${PTXDIST_PLATFORMCONFIGDIR}/platforms/${class}${package_filename}-choice.in" > + ptxd_template_filter "${template_file}" "${filename}" > + template_file="$(ptxd_template_file "${template}-pre-make")" > + > filename="${PTXDIST_PLATFORMCONFIGDIR}/rules/pre/020-${package_filename}-hsm.make" > + if [ "$TYPE" = "SoftHSM" ]; then > + export EXTRA_DEPENDENCIES="select HOST_SOFTHSM" > + elif [ "$TYPE" = "HSM with OpenSC support" ]; then > + export EXTRA_DEPENDENCIES="select HOST_OPENSC > + select HOST_OPENSC_PCSC" > + export > MODULE_PATH="\${PTXDIST_SYSROOT_HOST}/lib/pkcs11/opensc-pkcs11.so" > + ptxd_template_filter "${template_file}" "${filename}" > + elif [ "$TYPE" = "other HSM" ]; then > + export EXTRA_DEPENDENCIES="select FIXME" > + export MODULE_PATH="\${PTXDIST_SYSROOT_HOST}/fix/me" > + ptxd_template_filter "${template_file}" "${filename}" > + fi > + ptxd_template_write_platform_rules > + package="${package}-code-signing" > + ptxd_template_write_src > +} > +export -f ptxd_template_new_code_signing_provider > +ptxd_template_help_list[${#ptxd_template_help_list[@]}]="code-signing-provider" > +ptxd_template_help_list[${#ptxd_template_help_list[@]}]="create package for > a code signing provider" _______________________________________________ ptxdist mailing list [email protected] To unsubscribe, send a mail with subject "unsubscribe" to [email protected]
