From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: From: Bastian Krause Date: Wed, 24 Jun 2020 18:08:48 +0200 Message-Id: <20200624160849.6966-1-bst@pengutronix.de> MIME-Version: 1.0 Subject: [ptxdist] [PATCH 1/2] doc: ref_code_signing_helpers: clarify CA keyring function usage List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de Cc: Bastian Krause Signed-off-by: Bastian Krause --- doc/ref_code_signing_helpers.rst | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/doc/ref_code_signing_helpers.rst b/doc/ref_code_signing_helpers.rst index c3ffe01cb..f7928f52e 100644 --- a/doc/ref_code_signing_helpers.rst +++ b/doc/ref_code_signing_helpers.rst @@ -7,7 +7,7 @@ PTXdist provides various bash helper functions to be used in :ref:`code signing providers ` and :ref:`code signing consumers `. -PTXdist stores URIs and CAs using these helpers in +PTXdist stores URIs and CA keyrings using these helpers in ``$(PTXDIST_SYSROOT_HOST)/var/lib/keys///{uri,ca.pem}``. SoftHSM Provider Functions @@ -29,6 +29,8 @@ Usage: Initialize SoftHSM, and set the initial pins. +.. _cs_import_cert_from_der: + cs_import_cert_from_der ^^^^^^^^^^^^^^^^^^^^^^^ @@ -46,6 +48,8 @@ Preconditions: - the role must have been defined (see :ref:`cs_define_role`) - SoftHSM must have been initialized (see :ref:`cs_init_softhsm`) +.. _cs_import_cert_from_pem: + cs_import_cert_from_pem ^^^^^^^^^^^^^^^^^^^^^^^ @@ -164,7 +168,9 @@ Usage: cs_append_ca_from_pem -Append certificate from a given PEM file for role. +Append certificate from a given PEM file to the role's CA keyring. +If no CA keyring exists yet it is created as an empty file before. + Preconditions: @@ -181,7 +187,8 @@ Usage: cs_append_ca_from_der -Append certificate from a given DER file for role. +Append certificate from a given DER file to the role's CA keyring. +If no CA keyring exists yet it is created as an empty file before. Preconditions: @@ -198,18 +205,21 @@ Usage: cs_append_ca_from_uri [] -Append certificate from a given PKCS#11 URI for role. +Append certificate from a given PKCS#11 URI to the role's CA keyring. If URI is omitted the already set URI for role is used. +If no CA keyring exists yet it is created as an empty file before. Preconditions: - the role must have been defined (see :ref:`cs_define_role`) +- when used with SoftHSM, certificates must have been imported before + (see :ref:`cs_import_cert_from_der`, :ref:`cs_import_cert_from_pem`) Consumer Functions ~~~~~~~~~~~~~~~~~~ Packages that want to sign something or need access to keys/CAs can retrieve -PKCS#11 URIs and CAs with these helpers. +PKCS#11 URIs and CA keyrings with these helpers. .. _cs_get_uri: @@ -239,10 +249,10 @@ Usage: cs_get_ca -Get path to the CA in PEM format for role. +Get path to the CA keyring in PEM format for role. Preconditions: -- a certificate must have been appended to the CA +- a certificate must have been appended to the CA keyring (see :ref:`cs_append_ca_from_pem`, :ref:`cs_append_ca_from_der`, :ref:`cs_append_ca_from_uri`) -- 2.27.0 _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de