Hi Rasmus,
On 2026-07-10T12:36:12, Rasmus Villemoes <[email protected]> wrote:
> binman: x509: fix CN emitted for basic x509 certificates
>
> I'm pretty sure it was never the intention to emit the output
> filename (cert_fname) as the value of the CN distinguished name.
>
> The cert-ca property was parsed from the dts node, stored in
> ._cert_ca, passed on as the cn argument to x509_cert(), but then not
> used at all.
>
> Now that we always read a distinguished-name subnode if present, use
> that method instead.
>
> Signed-off-by: Rasmus Villemoes <[email protected]>
>
> tools/binman/btool/openssl.py | 7 +++----
> tools/binman/etype/x509_cert.py | 3 +--
> tools/binman/test/security/x509_cert.dts | 5 ++++-
> 3 files changed, 8 insertions(+), 7 deletions(-)
> diff --git a/tools/binman/btool/openssl.py b/tools/binman/btool/openssl.py
> @@ -68,8 +68,7 @@ x509_extensions = v3_ca
> -[ req_distinguished_name ]
> -CN = {cert_fname}
> +{self.dict_to_config_section('req_distinguished_name', req_dist_name_dict)}
If the entry has no distinguished-name subnode, req_dist_name_dict is
None here (the ti-secure types fall back to their hardcoded defaults,
but the plain x509-cert type has no fallback).
dict_to_config_section() then returns an empty string, so the config
still says 'distinguished_name = req_distinguished_name' but the
section does not exist. I tried this and openssl fails with:
Unable to get 'req_distinguished_name' section
Error making certificate request
So this patch silently makes the subnode mandatory for the generic
type, with a rather cryptic build failure for anyone using x509-cert
without it (previously it worked, emitting the filename as CN).
Please can you either keep a fallback (e.g. CN = cert_fname as
before), or raise a proper error from the etype when the subnode is
missing, so the user gets a helpful message pointing at the node? A
test for the missing-subnode case would cover the 'if not d' branch
added in patch 1 too.
> diff --git a/tools/binman/btool/openssl.py b/tools/binman/btool/openssl.py
> @@ -44,8 +44,8 @@ class Bintoolopenssl(bintool.Bintool):
> - def x509_cert(self, cert_fname, input_fname, key_fname, cn, revision,
> - config_fname):
> + def x509_cert(self, cert_fname, input_fname, key_fname,
> req_dist_name_dict,
> + revision, config_fname):
The Args docstring below still documents 'cn (str): Common name' but
the parameter is now req_dist_name_dict, so please can you update it
to match, as done for the other functions in patch 1?
Regards,
Simon
