From: Marc Kleine-Budde <[email protected]> This patch changes cs_get_ca() to only output the CA if it actually exists, so that this function can be used even if a signing provider does not provide a CA for a role.
Additionally improve robustness against premature evaluation by printing an error code if the signing provider was not set up yet. If the error message is used as part of a URI, the user can at least get a hint about the fact that an error happened. Co-authored-by: Roland Hieber <[email protected]> Signed-off-by: Marc Kleine-Budde <[email protected]> Signed-off-by: Roland Hieber <[email protected]> --- PATCH v5: - print error if keydir doesn't exist; and only print CA if it was set (feedback from Michael Olbrich) - update docs, and add example PATCH v4: https://lore.ptxdist.org/ptxdist/[email protected] - revert to [ -e "${ca}" ] test (feeback from Michael Olbrich and Marc Kleine-Budde) - add documentation too PATCH v3: https://lore.ptxdist.org/ptxdist/[email protected] - correctly check for existence of ${keydir} instead of ${ca} (feedback from Michael Olbrich) - drop controversial re-indentation patches 6/7 and 7/7 from the series PATCH v2 (rhi): https://lore.ptxdist.org/ptxdist/[email protected] - reorder from PATCH 3/n to PATCH 1/n - echo "ERROR_CA_NOT_YET_SET" in case of error (feedback from Michael Olbrich) and also return 1 PATCH v1 (mkl): https://lore.ptxdist.org/ptxdist/[email protected] --- doc/ref_code_signing_helpers.rst | 22 +++++++++++++++++++--- scripts/lib/ptxd_lib_code_signing.sh | 11 ++++++++++- 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/doc/ref_code_signing_helpers.rst b/doc/ref_code_signing_helpers.rst index 99a395b287c9..fd16ca763557 100644 --- a/doc/ref_code_signing_helpers.rst +++ b/doc/ref_code_signing_helpers.rst @@ -330,8 +330,24 @@ Usage: Get path to the CA keyring in PEM format for role. +If the provider does not set a CA for this role (see :ref:`cs_append_ca_from_pem`, +:ref:`cs_append_ca_from_der`, :ref:`cs_append_ca_from_uri`), this function will print an empty +string. + Preconditions: -- a certificate must have been appended to the CA keyring - (see :ref:`cs_append_ca_from_pem`, :ref:`cs_append_ca_from_der`, - :ref:`cs_append_ca_from_uri`) +- The role must have been defined by the provider (see :ref:`cs_define_role`). + Otherwise, this function will print ``ERROR_CA_NOT_YET_SET`` and return 1. + This can happen if the function is evaluated by a variable expansion in make + with ``:=`` instead of ``=`` before the code signing provider is set up. + +Example: + +.. code-block:: make + + # set up kernel module signing, and add a trusted CA if the provider set one + KERNEL_SIGN_OPT = + CONFIG_MODULE_SIG_KEY='"$(shell cs_get_uri kernel-modules)"' \ + CONFIG_MODULE_SIG_ALL=y \ + $(if $(shell cs_get_ca kernel-trusted), \ + CONFIG_SYSTEM_TRUSTED_KEYS=$(shell cs_get_ca kernel-trusted)) diff --git a/scripts/lib/ptxd_lib_code_signing.sh b/scripts/lib/ptxd_lib_code_signing.sh index 5fa62d8372f9..5ba1a4666af4 100644 --- a/scripts/lib/ptxd_lib_code_signing.sh +++ b/scripts/lib/ptxd_lib_code_signing.sh @@ -288,7 +288,16 @@ cs_get_ca() { local role="${1}" cs_init_variables - echo "${keydir}/${role}/ca.pem" + local ca="${keydir}/${role}/ca.pem" + + if [ ! -d "${keydir}" ]; then + echo "ERROR_CA_NOT_YET_SET" + return 1 + fi + + if [ -e "${ca}" ]; then + echo "${ca}" + fi } export -f cs_get_ca -- 2.30.2 _______________________________________________ ptxdist mailing list [email protected] To unsubscribe, send a mail with subject "unsubscribe" to [email protected]
