I'm pretty sure it was never the intention to emit the output filename (cert_fname) as the value of the CN distinguished name.
The cert-ca property was parsed from the dts node, stored in ._cert_ca, passed on as the cn argument to x509_cert(), but then not used at all. Now that we always read a distinguished-name subnode if present, use that method instead. Reviewed-by: Simon Glass <[email protected]> Signed-off-by: Rasmus Villemoes <[email protected]> --- tools/binman/btool/openssl.py | 10 +++++----- tools/binman/etype/x509_cert.py | 3 +-- tools/binman/test/security/x509_cert.dts | 5 ++++- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/tools/binman/btool/openssl.py b/tools/binman/btool/openssl.py index 84413428e1e..dd471b4b562 100644 --- a/tools/binman/btool/openssl.py +++ b/tools/binman/btool/openssl.py @@ -58,15 +58,16 @@ class Bintoolopenssl(bintool.Bintool): sec += f'{i+1}.{field:20s} = {s}\n' return sec - def x509_cert(self, cert_fname, input_fname, key_fname, cn, revision, - config_fname): + def x509_cert(self, cert_fname, input_fname, key_fname, req_dist_name_dict, + revision, config_fname): """Create a certificate Args: cert_fname (str): Filename of certificate to create input_fname (str): Filename containing data to sign key_fname (str): Filename of .pem file - cn (str): Common name + req_dist_name_dict (dict): Contents of req_distinguished_name section + in generated openssl config file revision (int): Revision number config_fname (str): Filename to write fconfig into @@ -82,8 +83,7 @@ x509_extensions = v3_ca prompt = no dirstring_type = nobmp -[ req_distinguished_name ] -CN = {cert_fname} +{self.dict_to_config_section('req_distinguished_name', req_dist_name_dict)} [ v3_ca ] basicConstraints = CA:true diff --git a/tools/binman/etype/x509_cert.py b/tools/binman/etype/x509_cert.py index 2d017b81456..ac2752ad640 100644 --- a/tools/binman/etype/x509_cert.py +++ b/tools/binman/etype/x509_cert.py @@ -64,7 +64,6 @@ class Entry_x509_cert(Entry_collection): def ReadNode(self): super().ReadNode() - self._cert_ca = fdt_util.GetString(self._node, 'cert-ca') self._cert_rev = fdt_util.GetInt(self._node, 'cert-revision-int', 0) self.key_fname = self.GetEntryArgsOrProps([ EntryArg('keyfile', str)], required=True)[0] @@ -109,7 +108,7 @@ class Entry_x509_cert(Entry_collection): cert_fname=output_fname, input_fname=input_fname, key_fname=self.key_fname, - cn=self._cert_ca, + req_dist_name_dict=self.req_dist_name, revision=self._cert_rev, config_fname=config_fname) elif type == 'sysfw': diff --git a/tools/binman/test/security/x509_cert.dts b/tools/binman/test/security/x509_cert.dts index 71238172717..ded0c2013c2 100644 --- a/tools/binman/test/security/x509_cert.dts +++ b/tools/binman/test/security/x509_cert.dts @@ -8,9 +8,12 @@ binman { x509-cert { - cert-ca = "IOT2050 Firmware Signature"; cert-revision-int = <0>; content = <&u_boot>; + + distinguished-name { + CN = "IOT2050 Firmware Signature"; + }; }; u_boot: u-boot { -- 2.55.0
