I'm pretty sure it was never the intention to emit the output filename (cert_fname) as the value of the CN distinguished name.
The cert-ca property was parsed from the dts node, stored in ._cert_ca, passed on as the cn argument to x509_cert(), but then not used at all. Now that we always read a distinguished-name subnode if present, use that method instead. Signed-off-by: Rasmus Villemoes <[email protected]> --- tools/binman/btool/openssl.py | 7 +++---- tools/binman/etype/x509_cert.py | 3 +-- tools/binman/test/security/x509_cert.dts | 5 ++++- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/tools/binman/btool/openssl.py b/tools/binman/btool/openssl.py index 370760ccaa5..7ad1d7a1aaa 100644 --- a/tools/binman/btool/openssl.py +++ b/tools/binman/btool/openssl.py @@ -44,8 +44,8 @@ class Bintoolopenssl(bintool.Bintool): s += f'{field:22s} = {value}\n' return s - def x509_cert(self, cert_fname, input_fname, key_fname, cn, revision, - config_fname): + def x509_cert(self, cert_fname, input_fname, key_fname, req_dist_name_dict, + revision, config_fname): """Create a certificate Args: @@ -68,8 +68,7 @@ x509_extensions = v3_ca prompt = no dirstring_type = nobmp -[ req_distinguished_name ] -CN = {cert_fname} +{self.dict_to_config_section('req_distinguished_name', req_dist_name_dict)} [ v3_ca ] basicConstraints = CA:true diff --git a/tools/binman/etype/x509_cert.py b/tools/binman/etype/x509_cert.py index ee4c74db6f9..e072414a714 100644 --- a/tools/binman/etype/x509_cert.py +++ b/tools/binman/etype/x509_cert.py @@ -56,7 +56,6 @@ class Entry_x509_cert(Entry_collection): def ReadNode(self): super().ReadNode() - self._cert_ca = fdt_util.GetString(self._node, 'cert-ca') self._cert_rev = fdt_util.GetInt(self._node, 'cert-revision-int', 0) self.key_fname = self.GetEntryArgsOrProps([ EntryArg('keyfile', str)], required=True)[0] @@ -96,7 +95,7 @@ class Entry_x509_cert(Entry_collection): cert_fname=output_fname, input_fname=input_fname, key_fname=self.key_fname, - cn=self._cert_ca, + req_dist_name_dict=self.req_dist_name, revision=self._cert_rev, config_fname=config_fname) elif type == 'sysfw': diff --git a/tools/binman/test/security/x509_cert.dts b/tools/binman/test/security/x509_cert.dts index 71238172717..ded0c2013c2 100644 --- a/tools/binman/test/security/x509_cert.dts +++ b/tools/binman/test/security/x509_cert.dts @@ -8,9 +8,12 @@ binman { x509-cert { - cert-ca = "IOT2050 Firmware Signature"; cert-revision-int = <0>; content = <&u_boot>; + + distinguished-name { + CN = "IOT2050 Firmware Signature"; + }; }; u_boot: u-boot { -- 2.55.0
