From: Bastian Krause <bst@pengutronix.de>
To: ptxdist@pengutronix.de
Cc: Bastian Krause <bst@pengutronix.de>
Subject: [ptxdist] [PATCH v3 2/6] package templates: add code-signing-provider template
Date: Wed, 17 Jun 2020 16:31:21 +0200 [thread overview]
Message-ID: <20200617143125.23999-3-bst@pengutronix.de> (raw)
In-Reply-To: <20200617143125.23999-1-bst@pengutronix.de>
A ptxdist code signing provider is a package which selects the required
host tools needed for the code signing helpers to work. A shell script
is needed to define roles, set PKCS#11 URIs and import keys if SoftHSM
is used. In order to simplify its creation provide a template along with
an example script.
Signed-off-by: Bastian Krause <bst@pengutronix.de>
---
Changes since v2:
- rename srk object name for consistency reasons
- ask user about HSM type
- split HSM/SoftHSM ptxdist-set-keys.sh cases into separate files
- introduce wizard.sh to generate ptxdist-set-keys.sh HSM case specific
- set dependencies HSM case specific
- introduce pre rule template to extend CODE_SIGNING_ENV HSM case
specific
---
.../ptxdist-set-keys-hsm.sh | 42 ++++++++++++++
.../ptxdist-set-keys-softhsm.sh | 58 +++++++++++++++++++
.../templates/code-signing-provider/wizard.sh | 10 ++++
.../template-code-signing-provider-choice-in | 5 ++
.../template-code-signing-provider-in | 14 +++++
.../template-code-signing-provider-make | 41 +++++++++++++
.../template-code-signing-provider-pre-make | 15 +++++
scripts/lib/ptxd_lib_template.sh | 31 ++++++++++
8 files changed, 216 insertions(+)
create mode 100755 rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh
create mode 100755 rules/templates/code-signing-provider/ptxdist-set-keys-softhsm.sh
create mode 100644 rules/templates/code-signing-provider/wizard.sh
create mode 100644 rules/templates/template-code-signing-provider-choice-in
create mode 100644 rules/templates/template-code-signing-provider-in
create mode 100644 rules/templates/template-code-signing-provider-make
create mode 100644 rules/templates/template-code-signing-provider-pre-make
diff --git a/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh b/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh
new file mode 100755
index 000000000..6bbe830f2
--- /dev/null
+++ b/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+set -e
+
+set_fit_keys() {
+ local r="image-kernel-fit"
+ cs_define_role "${r}"
+
+ # HSM use case
+ cs_set_uri "${r}" "pkcs11:token=foo;object=kernel-fit"
+}
+
+set_rauc_keys() {
+ local r="update"
+ cs_define_role "${r}"
+ cs_set_uri "${r}" "pkcs11:token=foo;object=rauc"
+ cs_append_ca_from_uri "${r}"
+}
+
+set_imx_habv4_keys() {
+ # HSM use case, assuming it contains only 1st CSF/IMG key
+ for i in 1 2 3 4; do
+ r="imx-habv4-srk${i}"
+ cs_define_role "${r}"
+ cs_set_uri "${r}" "pkcs11:token=foo;object=srk${i}"
+ cs_append_ca_from_uri "${r}"
+ done
+
+ r="imx-habv4-csf1"
+ cs_define_role ${r}
+ cs_set_uri "${r}" "pkcs11:token=foo;object=csf1"
+
+ r="imx-habv4-img1"
+ cs_define_role ${r}
+ cs_set_uri "${r}" "pkcs11:token=foo;object=img1"
+}
+
+
+# HSM use case
+set_fit_keys
+set_rauc_keys
+set_imx_habv4_keys
diff --git a/rules/templates/code-signing-provider/ptxdist-set-keys-softhsm.sh b/rules/templates/code-signing-provider/ptxdist-set-keys-softhsm.sh
new file mode 100755
index 000000000..0836d61d1
--- /dev/null
+++ b/rules/templates/code-signing-provider/ptxdist-set-keys-softhsm.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+
+set -e
+
+import_fit_keys() {
+ local fit_cert_dir=fit
+ local r="image-kernel-fit"
+ cs_define_role "${r}"
+
+ cs_import_cert_from_der "${r}" "${fit_cert_dir}/fit-4096-development.crt"
+ cs_import_pubkey_from_pem "${r}" "${fit_cert_dir}/fit-4096-development.key"
+ cs_import_privkey_from_pem "${r}" "${fit_cert_dir}/fit-4096-development.key"
+}
+
+import_rauc_keys() {
+ local rauc_cert_dir=rauc
+ local r="update"
+ cs_define_role "${r}"
+
+ # SoftHSM use case
+ cs_import_cert_from_pem "${r}" "${rauc_cert_dir}/rauc.cert.pem"
+ cs_import_pubkey_from_pem "${r}" "${rauc_cert_dir}/rauc.key.pem"
+ cs_import_privkey_from_pem "${r}" "${rauc_cert_dir}/rauc.key.pem"
+
+ cs_append_ca_from_uri "${r}"
+}
+
+import_imx_habv4_keys() {
+ local imx_habv4_key_dir="habv4"
+ local crts="${imx_habv4_key_dir}/crts"
+ local keys="${imx_habv4_key_dir}/keys"
+ local OPENSSL_KEYPASS="${imx_habv4_key_dir}/keys/key_pass.txt"
+
+ for i in 1 2 3 4; do
+ r="imx-habv4-srk${i}"
+ cs_define_role "${r}"
+ cs_import_cert_from_der "${r}" "${crts}/SRK${i}_sha256_4096_65537_v3_ca_crt.der"
+ cs_import_key_from_pem "${r}" "${keys}/SRK${i}_sha256_4096_65537_v3_ca_key.pem"
+ cs_append_ca_from_uri "${r}"
+
+ r="imx-habv4-csf${i}"
+ cs_define_role "${r}"
+ cs_import_cert_from_der "${r}" "${crts}/CSF${i}_1_sha256_4096_65537_v3_usr_crt.der"
+ cs_import_key_from_pem "${r}" "${keys}/CSF${i}_1_sha256_4096_65537_v3_usr_key.pem"
+
+ r="imx-habv4-img${i}"
+ cs_define_role "${r}"
+ cs_import_cert_from_der "${r}" "${crts}/IMG${i}_1_sha256_4096_65537_v3_usr_crt.der"
+ cs_import_key_from_pem "${r}" "${keys}/IMG${i}_1_sha256_4096_65537_v3_usr_key.pem"
+ done
+}
+
+
+# SoftHSM use case
+cs_init_softhsm
+import_fit_keys
+import_rauc_keys
+import_imx_habv4_keys
diff --git a/rules/templates/code-signing-provider/wizard.sh b/rules/templates/code-signing-provider/wizard.sh
new file mode 100644
index 000000000..83d6d54e3
--- /dev/null
+++ b/rules/templates/code-signing-provider/wizard.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [ "$TYPE" = "SoftHSM" ]; then
+ mv ptxdist-set-keys-softhsm.sh ptxdist-set-keys.sh
+ rm ptxdist-set-keys-hsm.sh
+
+elif [ "$TYPE" = "HSM with OpenSC support" ] || [ "$TYPE" = "other HSM" ]; then
+ mv ptxdist-set-keys-hsm.sh ptxdist-set-keys.sh
+ rm ptxdist-set-keys-softhsm.sh
+fi
diff --git a/rules/templates/template-code-signing-provider-choice-in b/rules/templates/template-code-signing-provider-choice-in
new file mode 100644
index 000000000..e2108f870
--- /dev/null
+++ b/rules/templates/template-code-signing-provider-choice-in
@@ -0,0 +1,5 @@
+## SECTION=code_signing_provider
+
+config CODE_SIGNING_PROVIDER_@PACKAGE@
+ bool
+ prompt "@package@"
diff --git a/rules/templates/template-code-signing-provider-in b/rules/templates/template-code-signing-provider-in
new file mode 100644
index 000000000..b84ba839c
--- /dev/null
+++ b/rules/templates/template-code-signing-provider-in
@@ -0,0 +1,14 @@
+## SECTION=code_signing
+
+config CODE_SIGNING
+ select HOST_@PACKAGE@_CODE_SIGNING if CODE_SIGNING_PROVIDER_@PACKAGE@
+
+config CODE_SIGNING_PROVIDER
+ default "@package@" if CODE_SIGNING_PROVIDER_@PACKAGE@
+
+config HOST_@PACKAGE@_CODE_SIGNING
+ bool
+ select HOST_LIBP11
+ select HOST_OPENSSL
+ select HOST_EXTRACT_CERT
+ @EXTRA_DEPENDENCIES@
diff --git a/rules/templates/template-code-signing-provider-make b/rules/templates/template-code-signing-provider-make
new file mode 100644
index 000000000..94830d92e
--- /dev/null
+++ b/rules/templates/template-code-signing-provider-make
@@ -0,0 +1,41 @@
+# -*-makefile-*-
+#
+# Copyright (C) @YEAR@ by @AUTHOR@
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+HOST_PACKAGES-$(PTXCONF_HOST_@PACKAGE@_CODE_SIGNING) += host-@package@-code-signing
+
+#
+# Paths and names
+#
+HOST_@PACKAGE@_CODE_SIGNING_VERSION := @VERSION@
+HOST_@PACKAGE@_CODE_SIGNING := @package@-code-signing-$(HOST_@PACKAGE@_CODE_SIGNING_VERSION)
+HOST_@PACKAGE@_CODE_SIGNING_URL := file://local_src/@package@-code-signing
+HOST_@PACKAGE@_CODE_SIGNING_DIR := $(HOST_BUILDDIR)/$(HOST_@PACKAGE@_CODE_SIGNING)
+
+HOST_@PACKAGE@_CODE_SIGNING_CONF_TOOL := NO
+
+# ----------------------------------------------------------------------------
+# Compile
+# ----------------------------------------------------------------------------
+
+HOST_@PACKAGE@_CODE_SIGNING_MAKE_ENV := \
+ $(CODE_SIGNING_ENV)
+
+$(STATEDIR)/host-@package@-code-signing.compile:
+ @$(call targetinfo)
+ @$(call world/execute, HOST_@PACKAGE@_CODE_SIGNING, \
+ ./ptxdist-set-keys.sh)
+ @$(call touch)
+
+$(STATEDIR)/host-@package@-code-signing.install:
+ @$(call targetinfo)
+ @$(call touch)
+
+# vim: syntax=make
diff --git a/rules/templates/template-code-signing-provider-pre-make b/rules/templates/template-code-signing-provider-pre-make
new file mode 100644
index 000000000..28cac750c
--- /dev/null
+++ b/rules/templates/template-code-signing-provider-pre-make
@@ -0,0 +1,15 @@
+# -*-makefile-*-
+#
+# Copyright (C) @YEAR@ by @AUTHOR@
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+ifndef PTXCONF_CODE_SIGNING_PROVIDER_@PACKAGE@
+CODE_SIGNING_ENV += \
+ PKCS11_MODULE_PATH=@MODULE_PATH@
+ $(HSM_CODE_SIGNING_ENV)
+endif
+
+# vim: syntax=make
diff --git a/scripts/lib/ptxd_lib_template.sh b/scripts/lib/ptxd_lib_template.sh
index 6b405763b..805d8d9d3 100644
--- a/scripts/lib/ptxd_lib_template.sh
+++ b/scripts/lib/ptxd_lib_template.sh
@@ -486,3 +486,34 @@ ptxd_template_new_blspec_entry() {
export -f ptxd_template_new_blspec_entry
ptxd_template_help_list[${#ptxd_template_help_list[@]}]="blspec-entry"
ptxd_template_help_list[${#ptxd_template_help_list[@]}]="create package for a bootloader spec entry"
+
+ptxd_template_new_code_signing_provider() {
+ export class="host-"
+ ptxd_template_read_basic &&
+ ptxd_template_read_author &&
+ ptxd_template_read_options "provider type" TYPE "SoftHSM" "HSM with OpenSC support" "other HSM"
+ package_filename="${package_filename}-code-signing"
+ local template_file="$(ptxd_template_file "${template}-choice-in")"
+ local filename="${PTXDIST_PLATFORMCONFIGDIR}/platforms/${class}${package_filename}-choice.in"
+ ptxd_template_filter "${template_file}" "${filename}"
+ template_file="$(ptxd_template_file "${template}-pre-make")"
+ filename="${PTXDIST_PLATFORMCONFIGDIR}/rules/pre/020-${package_filename}-hsm.make"
+ if [ "$TYPE" = "SoftHSM" ]; then
+ export EXTRA_DEPENDENCIES="select HOST_SOFTHSM"
+ elif [ "$TYPE" = "HSM with OpenSC support" ]; then
+ export EXTRA_DEPENDENCIES="select HOST_OPENSC
+ select HOST_OPENSC_PCSC"
+ export MODULE_PATH="\${PTXDIST_SYSROOT_HOST}/lib/pkcs11/opensc-pkcs11.so"
+ ptxd_template_filter "${template_file}" "${filename}"
+ elif [ "$TYPE" = "other HSM" ]; then
+ export EXTRA_DEPENDENCIES="select FIXME"
+ export MODULE_PATH="\${PTXDIST_SYSROOT_HOST}/fix/me"
+ ptxd_template_filter "${template_file}" "${filename}"
+ fi
+ ptxd_template_write_platform_rules
+ package="${package}-code-signing"
+ ptxd_template_write_src
+}
+export -f ptxd_template_new_code_signing_provider
+ptxd_template_help_list[${#ptxd_template_help_list[@]}]="code-signing-provider"
+ptxd_template_help_list[${#ptxd_template_help_list[@]}]="create package for a code signing provider"
--
2.27.0
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
next prev parent reply other threads:[~2020-06-17 14:31 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-17 14:31 [ptxdist] [PATCH v3 0/6] Add code-signing-provider template, add code signing docs Bastian Krause
2020-06-17 14:31 ` [ptxdist] [PATCH v3 1/6] ptxd_lib_template: add ptxd_template_read_options Bastian Krause
2020-06-19 6:24 ` Michael Olbrich
2020-06-19 8:13 ` Bastian Krause
2020-06-19 22:04 ` [ptxdist] [APPLIED] " Michael Olbrich
2020-06-17 14:31 ` Bastian Krause [this message]
2020-06-18 11:40 ` [ptxdist] [PATCH v3 2/6] package templates: add code-signing-provider template Roland Hieber
2020-06-18 11:50 ` Bastian Krause
2020-06-19 6:12 ` Michael Olbrich
2020-06-19 6:28 ` Michael Olbrich
2020-06-19 7:52 ` Bastian Krause
2020-06-19 22:04 ` [ptxdist] [APPLIED] " Michael Olbrich
2020-09-24 10:04 ` [ptxdist] [PATCH v3 2/6] " Ladislav Michl
2020-09-24 11:05 ` Bastian Krause
2020-09-24 11:15 ` Ladislav Michl
2020-09-24 12:23 ` Bastian Krause
2020-06-17 14:31 ` [ptxdist] [PATCH v3 3/6] doc: dev_manual: split up into multiple files Bastian Krause
2020-06-19 22:04 ` [ptxdist] [APPLIED] " Michael Olbrich
2020-06-17 14:31 ` [ptxdist] [PATCH v3 4/6] doc: move code signing docs from scripts/ into doc/ Bastian Krause
2020-06-19 22:04 ` [ptxdist] [APPLIED] " Michael Olbrich
2020-06-17 14:31 ` [ptxdist] [PATCH v3 5/6] doc: dev_code_signing: rework and extend code signing section Bastian Krause
2020-06-19 22:04 ` [ptxdist] [APPLIED] " Michael Olbrich
2020-06-17 14:31 ` [ptxdist] [PATCH v3 6/6] doc: introduce ref_code_signing_helpers Bastian Krause
2020-06-19 22:04 ` [ptxdist] [APPLIED] " Michael Olbrich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200617143125.23999-3-bst@pengutronix.de \
--to=bst@pengutronix.de \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox