From: Roland Hieber <rhi@pengutronix.de> To: ptxdist@pengutronix.de Cc: Marc Kleine-Budde <mkl@pengutronix.de>, Roland Hieber <rhi@pengutronix.de> Subject: [ptxdist] [PATCH v3 4/5] templates/barebox-imx-habv4: use the 'imx-habv4-srk' role group Date: Thu, 8 Jul 2021 22:39:40 +0200 [thread overview] Message-ID: <20210708203941.30212-4-rhi@pengutronix.de> (raw) In-Reply-To: <20210708203941.30212-1-rhi@pengutronix.de> From: Marc Kleine-Budde <mkl@pengutronix.de> The previous patch taught new code signing providers to set up the 'imx-habv4-srk' role group. This patch uses it for the barebox-imx-habv4 recipe. Keep backwards compatibility with the old way of using indexed role names in the library part, so existing recipes can still work with ptxd_make_imx_habv4_gen_table() if their code signing provider sets up the roles appropriately. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Roland Hieber <rhi@pengutronix.de> --- PATCH v3: - no changes PATCH v2 (rhi): https://lore.ptxdist.org/ptxdist/20210627231121.28313-4-rhi@pengutronix.de - split up code signing provider template changes (see previous patch) from lib and consumer changes - fix ptxd_make_imx_habv4_gen_table() documentation comments PATCH v1 (mkl): https://lore.ptxdist.org/ptxdist/20210412161900.2376802-2-mkl@pengutronix.de --- .../templates/template-barebox-imx-habv4-make | 2 +- scripts/lib/ptxd_lib_imx_hab.sh | 49 ++++++++++++++----- 2 files changed, 37 insertions(+), 14 deletions(-) diff --git a/rules/templates/template-barebox-imx-habv4-make b/rules/templates/template-barebox-imx-habv4-make index eb752c8349d9..cc825dc90292 100644 --- a/rules/templates/template-barebox-imx-habv4-make +++ b/rules/templates/template-barebox-imx-habv4-make @@ -74,7 +74,7 @@ $(STATEDIR)/barebox-@package@.compile: @$(call targetinfo) @$(call world/env, BAREBOX_@PACKAGE@) \ - ptxd_make_imx_habv4_gen_table "imx-habv4-srk%d" 4 + ptxd_make_imx_habv4_gen_table imx-habv4-srk @$(call world/compile, BAREBOX_@PACKAGE@) diff --git a/scripts/lib/ptxd_lib_imx_hab.sh b/scripts/lib/ptxd_lib_imx_hab.sh index d1e2aba99fab..fa5b3e2c1439 100644 --- a/scripts/lib/ptxd_lib_imx_hab.sh +++ b/scripts/lib/ptxd_lib_imx_hab.sh @@ -9,12 +9,14 @@ # # ptxd_make_imx_habv4_gen_table - generate the srk fuse file and srk table for i.MX HABv4 # -# usage: ptxd_make_imx_habv4_gen_table <template> [<srk_count>] +# usage: ptxd_make_imx_habv4_gen_table <role group> +# ptxd_make_imx_habv4_gen_table <template> [<srk_count>] # +# role group: the group that specifies all roles to access the keys # template: the role template to access the keys. Must contain a "%d" which is # used as index -# srk_count: the number of keys (keys with index 1..srk_count will be used), -# defaults to 4 +# srk_count: only when using <template>: the number of keys (keys with index +# 1..srk_count will be used), defaults to 4 # # The output files are generated in the package build dir: # @@ -25,25 +27,46 @@ # This will contain the srk hash which must be written to the fuses # ptxd_make_imx_habv4_gen_table_impl() { + local group="${1}" local template="${1}" local srk_count="${2}" local table_bin="${pkg_build_dir}/imx-srk-table.bin" local srk_fuse_bin="${pkg_build_dir}/imx-srk-fuse.bin" local -a certs + local i - if [ -z "${srk_count}" ]; then - srk_count=4 - fi + case "${template}" in + *%d*) # <template> [<srk_count>] + if [ -z "${srk_count}" ]; then + srk_count=4 + fi - if [ "${srk_count}" -gt 4 ]; then - ptxd_bailout "HABv4 allows only 4 certificates" - fi + if [ "${srk_count}" -gt 4 ]; then + ptxd_bailout "HABv4 allows only 4 certificates" + fi - echo -e "generating $(basename ${table_bin}) and $(basename ${srk_fuse_bin})\n" + for i in $(seq ${srk_count}); do + certs[${#certs[*]}]="$(cs_get_ca "$(printf "${template}" ${i})")" + done + ;; + + *) # <role group> + local -a roles=( $(cs_group_get_roles "${group}") ) + + if [ "${#roles[@]}" -eq 0 ]; then + ptxd_bailout "Failed to get roles for group '${group}'" + fi - for i in $(seq ${srk_count}); do - certs[${#certs[*]}]="$(cs_get_ca "$(printf "${template}" ${i})")" - done + if [ "${#roles[@]}" -gt 4 ]; then + ptxd_bailout "HABv4 allows only 4 certificates" + fi + + for i in "${roles[@]}"; do + certs[${#certs[*]}]="$(cs_get_ca "${i}")" + done + esac + + echo -e "generating $(basename ${table_bin}) and $(basename ${srk_fuse_bin})\n" local orig_IFS="${IFS}" IFS="," -- 2.30.2 _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
next prev parent reply other threads:[~2021-07-08 20:40 UTC|newest] Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-07-08 20:39 [ptxdist] [PATCH v3 1/5] ptxd_lib_code_signing: cs_get_ca(): improve error handling Roland Hieber 2021-07-08 20:39 ` [ptxdist] [PATCH v3 2/5] ptxd_lib_code_signing: introduce role groups Roland Hieber 2021-07-20 11:48 ` [ptxdist] [APPLIED] " Michael Olbrich 2021-07-08 20:39 ` [ptxdist] [PATCH v3 3/5] templates/code-signing-provider: set up the 'imx-habv4-srk' role group Roland Hieber 2021-07-20 11:48 ` [ptxdist] [APPLIED] " Michael Olbrich 2021-07-08 20:39 ` Roland Hieber [this message] 2021-07-20 11:48 ` [ptxdist] [APPLIED] templates/barebox-imx-habv4: use " Michael Olbrich 2021-07-08 20:39 ` [ptxdist] [PATCH v3 5/5] host-ptx-code-signing-dev: version bump 0.4 -> 0.5 Roland Hieber 2021-07-20 11:48 ` [ptxdist] [APPLIED] " Michael Olbrich 2021-07-09 13:36 ` [ptxdist] [PATCH v3 1/5] ptxd_lib_code_signing: cs_get_ca(): improve error handling Michael Olbrich 2021-07-12 8:42 ` Marc Kleine-Budde 2021-07-13 11:51 ` [ptxdist] [PATCH v4] " Roland Hieber 2021-07-14 6:21 ` Michael Olbrich 2021-07-15 13:42 ` [ptxdist] [PATCH v5] " Roland Hieber 2021-07-20 11:49 ` [ptxdist] [APPLIED] " Michael Olbrich
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210708203941.30212-4-rhi@pengutronix.de \ --to=rhi@pengutronix.de \ --cc=mkl@pengutronix.de \ --cc=ptxdist@pengutronix.de \ --subject='Re: [ptxdist] [PATCH v3 4/5] templates/barebox-imx-habv4: use the '\''imx-habv4-srk'\'' role group' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox