On Mon, Apr 12, 2021 at 06:18:59PM +0200, Marc Kleine-Budde wrote:
> This patch converts barebox and the barebox template to make use of code
> signing groups as introduced in the previous patch.
>
> Signed-off-by: Marc Kleine-Budde <[email protected]>
> ---
> .../ptxdist-set-keys-hsm.sh | 6 ++-
> .../templates/template-barebox-imx-habv4-make | 2 +-
> scripts/lib/ptxd_lib_imx_hab.sh | 44 ++++++++++++++-----
> 3 files changed, 39 insertions(+), 13 deletions(-)
>
> diff --git a/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh
> b/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh
> index bcd531d69572..b94eff049eac 100755
> --- a/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh
> +++ b/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh
> @@ -18,7 +18,7 @@ set_rauc_keys() {
> }
>
> set_imx_habv4_keys() {
> - local r
> + local r g
>
> # HSM use case, assuming it contains only 1st CSF/IMG key
> for i in 1 2 3 4; do
> @@ -28,6 +28,10 @@ set_imx_habv4_keys() {
> cs_append_ca_from_uri "${r}"
> done
>
> + g="imx-habv4-srk"
> + cs_define_group "${g}"
> + cs_group_add_roles "${g}" "imx-habv4-srk1" "imx-habv4-srk2"
> "imx-habv4-srk3" "imx-habv4-srk4"
> +
> r="imx-habv4-csf1"
> cs_define_role ${r}
> cs_set_uri "${r}" "pkcs11:token=foo;object=csf1"
> diff --git a/rules/templates/template-barebox-imx-habv4-make
> b/rules/templates/template-barebox-imx-habv4-make
> index eb752c8349d9..cc825dc90292 100644
> --- a/rules/templates/template-barebox-imx-habv4-make
> +++ b/rules/templates/template-barebox-imx-habv4-make
> @@ -74,7 +74,7 @@ $(STATEDIR)/barebox-@[email protected]:
> @$(call targetinfo)
>
> @$(call world/env, BAREBOX_@PACKAGE@) \
> - ptxd_make_imx_habv4_gen_table "imx-habv4-srk%d" 4
> + ptxd_make_imx_habv4_gen_table imx-habv4-srk
For this to work with the devel provider, host-ptx-code-signing-dev must be
updated to create this group. I needs the same changes that you made to the
code-signing-provider template above, right?
Can you please add that and provide a new version for the PTXdist package?
Michael
>
> @$(call world/compile, BAREBOX_@PACKAGE@)
>
> diff --git a/scripts/lib/ptxd_lib_imx_hab.sh b/scripts/lib/ptxd_lib_imx_hab.sh
> index d1e2aba99fab..f6f81834d0e7 100644
> --- a/scripts/lib/ptxd_lib_imx_hab.sh
> +++ b/scripts/lib/ptxd_lib_imx_hab.sh
> @@ -9,7 +9,9 @@
> #
> # ptxd_make_imx_habv4_gen_table - generate the srk fuse file and srk table
> for i.MX HABv4
> #
> -# usage: ptxd_make_imx_habv4_gen_table <template> [<srk_count>]
> +# usage: ptxd_make_imx_habv4_gen_table <role group>|<template> [<srk_count>]
> +#
> +# role group: the group that specified all roles to access the keys
> #
> # template: the role template to access the keys. Must contain a "%d" which
> is
> # used as index
> @@ -25,25 +27,45 @@
> # This will contain the srk hash which must be written to the fuses
> #
> ptxd_make_imx_habv4_gen_table_impl() {
> + local group="${1}"
> local template="${1}"
> local srk_count="${2}"
> local table_bin="${pkg_build_dir}/imx-srk-table.bin"
> local srk_fuse_bin="${pkg_build_dir}/imx-srk-fuse.bin"
> local -a certs
> + local i
>
> - if [ -z "${srk_count}" ]; then
> - srk_count=4
> - fi
> + case "${template}" in
> + *%d*) # <template> [<srk_count>]
> + if [ -z "${srk_count}" ]; then
> + srk_count=4
> + fi
>
> - if [ "${srk_count}" -gt 4 ]; then
> - ptxd_bailout "HABv4 allows only 4 certificates"
> - fi
> + if [ "${srk_count}" -gt 4 ]; then
> + ptxd_bailout "HABv4 allows only 4 certificates"
> + fi
>
> - echo -e "generating $(basename ${table_bin}) and $(basename
> ${srk_fuse_bin})\n"
> + for i in $(seq ${srk_count}); do
> + certs[${#certs[*]}]="$(cs_get_ca "$(printf "${template}"
> ${i})")"
> + done
> + ;;
> + *) # <role group>
> + local -a roles=( $(cs_group_get_roles "${group}") )
> +
> + if [ "${#roles[@]}" -eq 0 ]; then
> + ptxd_bailout "Failed to get roles for group '${group}'"
> + fi
>
> - for i in $(seq ${srk_count}); do
> - certs[${#certs[*]}]="$(cs_get_ca "$(printf "${template}" ${i})")"
> - done
> + if [ "${#roles[@]}" -gt 4 ]; then
> + ptxd_bailout "HABv4 allows only 4 certificates"
> + fi
> +
> + for i in "${roles[@]}"; do
> + certs[${#certs[*]}]="$(cs_get_ca "${i}")"
> + done
> + esac
> +
> + echo -e "generating $(basename ${table_bin}) and $(basename
> ${srk_fuse_bin})\n"
>
> local orig_IFS="${IFS}"
> IFS=","
> --
> 2.30.2
>
>
>
> _______________________________________________
> ptxdist mailing list
> [email protected]
> To unsubscribe, send a mail with subject "unsubscribe" to
> [email protected]
>
_______________________________________________
ptxdist mailing list
[email protected]
To unsubscribe, send a mail with subject "unsubscribe" to
[email protected]
