Hi Ayoub,
On 2026-10-28T10:31:01+11:00, Ayoub Zaki <[email protected]> wrote:
> lib: rsa: Accept .pem private key files as a fallback
>
> Allow mkimage -k to use a .pem file when the RSA .key file is absent.
> Keep .key precedence so existing key selection is preserved.
>
> Signed-off-by: Ayoub Zaki <[email protected]>
>
> lib/rsa/rsa-sign.c | 16 ++++++++++++++--
> 1 file changed, 14 insertions(+), 2 deletions(-)
> diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
> @@ -176,10 +176,11 @@ static int rsa_get_pub_key(const char *keydir, const
> char *name,
> * @keydir: Directory containing the key
> - * @name Name of key file (will have a .key extension)
> + * @name Name of key file (.key, falling back to .pem if absent)
> + * @keyfile: Explicit key filename, used if keydir or name is absent
> * @evpp Returns EVP_PKEY object, or NULL on failure
Since you are rewriting this, please can you add the missing colons
after @name and @evpp so that kernel-doc parses them properly.
> diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
> @@ -202,6 +203,17 @@ static int rsa_pem_get_priv_key(const char *keydir,
> const char *name,
> f = fopen(path, "r");
> + if (!f && errno == ENOENT && keydir && name) {
> + snprintf(path, sizeof(path), "%s/%s.pem", keydir, name);
> + f = fopen(path, "r");
> + if (!f) {
> + ret = -errno;
> + fprintf(stderr,
> + "Couldn't open RSA private key: '%s/%s.key' or
> '%s': %s\n",
> + keydir, name, path, strerror(-ret));
> + return ret;
> + }
> + }
> if (!f) {
> ret = -errno;
> fprintf(stderr, "Couldn't open RSA private key: '%s': %s\n",
As with patch 3, this adds a second error path next to the existing
one. If the fallback fopen() fails, the code could fall through to the
existing 'if (!f)' block, which already reports the path and errno;
you could print the '.key' name there if a fallback was tried. Also,
if the .pem file fails with something like EACCES, the combined
message attaches that error to both files, even though the .key file
was simply missing.
Regards,
Simon
