Instead of manually expanding the req_dist_name_dict, create a helper function for creating a config section from any dict. That will also automatically allow other fields to be emitted.
Eventually, we could allow the values to not necesssarily be a single string, but a list of strings, e.g. "OU" -> ["First OU", "Secound OU"], and encode that in the config file using 1.OU = First OU 2.OU = Second OU as documented in 'man 5 config'. Signed-off-by: Rasmus Villemoes <[email protected]> --- tools/binman/btool/openssl.py | 44 +++++++++++------------------------ 1 file changed, 14 insertions(+), 30 deletions(-) diff --git a/tools/binman/btool/openssl.py b/tools/binman/btool/openssl.py index b26f087c447..370760ccaa5 100644 --- a/tools/binman/btool/openssl.py +++ b/tools/binman/btool/openssl.py @@ -36,6 +36,14 @@ class Bintoolopenssl(bintool.Bintool): name, 'openssl cryptography toolkit', version_regex=r'OpenSSL (.*) \(', version_args='version') + def dict_to_config_section(self, section_name, d): + if not d: + return '' + s = f'[ {section_name} ]\n' + for field, value in d.items(): + s += f'{field:22s} = {value}\n' + return s + def x509_cert(self, cert_fname, input_fname, key_fname, cn, revision, config_fname): """Create a certificate @@ -92,8 +100,7 @@ imageSize = INTEGER:{len(indata)} sw_rev (int): Software revision config_fname (str): Filename to write fconfig into req_dist_name_dict (dict): Dictionary containing key-value pairs of - req_distinguished_name section extensions, must contain extensions for - C, ST, L, O, OU, CN and emailAddress + req_distinguished_name section extensions firewall_cert_data (dict): - auth_in_place (int): The Priv ID for copying as the specific host in firewall protected region @@ -114,14 +121,7 @@ x509_extensions = v3_ca prompt = no dirstring_type = nobmp -[ req_distinguished_name ] -C = {req_dist_name_dict['C']} -ST = {req_dist_name_dict['ST']} -L = {req_dist_name_dict['L']} -O = {req_dist_name_dict['O']} -OU = {req_dist_name_dict['OU']} -CN = {req_dist_name_dict['CN']} -emailAddress = {req_dist_name_dict['emailAddress']} +{self.dict_to_config_section('req_distinguished_name', req_dist_name_dict)} [ v3_ca ] basicConstraints = CA:true @@ -163,8 +163,7 @@ numFirewallRegions = INTEGER:{firewall_cert_data['num_firewalls']} sw_rev (int): Software revision config_fname (str): Filename to write fconfig into req_dist_name_dict (dict): Dictionary containing key-value pairs of - req_distinguished_name section extensions, must contain extensions for - C, ST, L, O, OU, CN and emailAddress + req_distinguished_name section extensions cert_type (int): Certification type bootcore (int): Booting core bootcore_opts(int): Booting core option, lockstep (0) or split (2) mode @@ -184,14 +183,7 @@ numFirewallRegions = INTEGER:{firewall_cert_data['num_firewalls']} prompt = no dirstring_type = nobmp - [ req_distinguished_name ] -C = {req_dist_name_dict['C']} -ST = {req_dist_name_dict['ST']} -L = {req_dist_name_dict['L']} -O = {req_dist_name_dict['O']} -OU = {req_dist_name_dict['OU']} -CN = {req_dist_name_dict['CN']} -emailAddress = {req_dist_name_dict['emailAddress']} +{self.dict_to_config_section('req_distinguished_name', req_dist_name_dict)} [ v3_ca ] basicConstraints = CA:true @@ -252,8 +244,7 @@ emailAddress = {req_dist_name_dict['emailAddress']} sw_rev (int): Software revision config_fname (str): Filename to write fconfig into req_dist_name_dict (dict): Dictionary containing key-value pairs of - req_distinguished_name section extensions, must contain extensions for - C, ST, L, O, OU, CN and emailAddress + req_distinguished_name section extensions cert_type (int): Certification type bootcore (int): Booting core load_addr (int): Load address of image @@ -274,14 +265,7 @@ x509_extensions = v3_ca prompt = no dirstring_type = nobmp -[ req_distinguished_name ] -C = {req_dist_name_dict['C']} -ST = {req_dist_name_dict['ST']} -L = {req_dist_name_dict['L']} -O = {req_dist_name_dict['O']} -OU = {req_dist_name_dict['OU']} -CN = {req_dist_name_dict['CN']} -emailAddress = {req_dist_name_dict['emailAddress']} +{self.dict_to_config_section('req_distinguished_name', req_dist_name_dict)} [ v3_ca ] basicConstraints = CA:true -- 2.55.0
