From: Roland Hieber <rhi@pengutronix.de>
To: ptxdist@pengutronix.de
Cc: Marc Kleine-Budde <mkl@pengutronix.de>,
Roland Hieber <rhi@pengutronix.de>
Subject: [ptxdist] [PATCH v3 4/5] templates/barebox-imx-habv4: use the 'imx-habv4-srk' role group
Date: Thu, 8 Jul 2021 22:39:40 +0200 [thread overview]
Message-ID: <20210708203941.30212-4-rhi@pengutronix.de> (raw)
In-Reply-To: <20210708203941.30212-1-rhi@pengutronix.de>
From: Marc Kleine-Budde <mkl@pengutronix.de>
The previous patch taught new code signing providers to set up the
'imx-habv4-srk' role group. This patch uses it for the barebox-imx-habv4
recipe.
Keep backwards compatibility with the old way of using indexed role
names in the library part, so existing recipes can still work with
ptxd_make_imx_habv4_gen_table() if their code signing provider sets up
the roles appropriately.
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Roland Hieber <rhi@pengutronix.de>
---
PATCH v3:
- no changes
PATCH v2 (rhi): https://lore.ptxdist.org/ptxdist/20210627231121.28313-4-rhi@pengutronix.de
- split up code signing provider template changes (see previous patch)
from lib and consumer changes
- fix ptxd_make_imx_habv4_gen_table() documentation comments
PATCH v1 (mkl): https://lore.ptxdist.org/ptxdist/20210412161900.2376802-2-mkl@pengutronix.de
---
.../templates/template-barebox-imx-habv4-make | 2 +-
scripts/lib/ptxd_lib_imx_hab.sh | 49 ++++++++++++++-----
2 files changed, 37 insertions(+), 14 deletions(-)
diff --git a/rules/templates/template-barebox-imx-habv4-make b/rules/templates/template-barebox-imx-habv4-make
index eb752c8349d9..cc825dc90292 100644
--- a/rules/templates/template-barebox-imx-habv4-make
+++ b/rules/templates/template-barebox-imx-habv4-make
@@ -74,7 +74,7 @@ $(STATEDIR)/barebox-@package@.compile:
@$(call targetinfo)
@$(call world/env, BAREBOX_@PACKAGE@) \
- ptxd_make_imx_habv4_gen_table "imx-habv4-srk%d" 4
+ ptxd_make_imx_habv4_gen_table imx-habv4-srk
@$(call world/compile, BAREBOX_@PACKAGE@)
diff --git a/scripts/lib/ptxd_lib_imx_hab.sh b/scripts/lib/ptxd_lib_imx_hab.sh
index d1e2aba99fab..fa5b3e2c1439 100644
--- a/scripts/lib/ptxd_lib_imx_hab.sh
+++ b/scripts/lib/ptxd_lib_imx_hab.sh
@@ -9,12 +9,14 @@
#
# ptxd_make_imx_habv4_gen_table - generate the srk fuse file and srk table for i.MX HABv4
#
-# usage: ptxd_make_imx_habv4_gen_table <template> [<srk_count>]
+# usage: ptxd_make_imx_habv4_gen_table <role group>
+# ptxd_make_imx_habv4_gen_table <template> [<srk_count>]
#
+# role group: the group that specifies all roles to access the keys
# template: the role template to access the keys. Must contain a "%d" which is
# used as index
-# srk_count: the number of keys (keys with index 1..srk_count will be used),
-# defaults to 4
+# srk_count: only when using <template>: the number of keys (keys with index
+# 1..srk_count will be used), defaults to 4
#
# The output files are generated in the package build dir:
#
@@ -25,25 +27,46 @@
# This will contain the srk hash which must be written to the fuses
#
ptxd_make_imx_habv4_gen_table_impl() {
+ local group="${1}"
local template="${1}"
local srk_count="${2}"
local table_bin="${pkg_build_dir}/imx-srk-table.bin"
local srk_fuse_bin="${pkg_build_dir}/imx-srk-fuse.bin"
local -a certs
+ local i
- if [ -z "${srk_count}" ]; then
- srk_count=4
- fi
+ case "${template}" in
+ *%d*) # <template> [<srk_count>]
+ if [ -z "${srk_count}" ]; then
+ srk_count=4
+ fi
- if [ "${srk_count}" -gt 4 ]; then
- ptxd_bailout "HABv4 allows only 4 certificates"
- fi
+ if [ "${srk_count}" -gt 4 ]; then
+ ptxd_bailout "HABv4 allows only 4 certificates"
+ fi
- echo -e "generating $(basename ${table_bin}) and $(basename ${srk_fuse_bin})\n"
+ for i in $(seq ${srk_count}); do
+ certs[${#certs[*]}]="$(cs_get_ca "$(printf "${template}" ${i})")"
+ done
+ ;;
+
+ *) # <role group>
+ local -a roles=( $(cs_group_get_roles "${group}") )
+
+ if [ "${#roles[@]}" -eq 0 ]; then
+ ptxd_bailout "Failed to get roles for group '${group}'"
+ fi
- for i in $(seq ${srk_count}); do
- certs[${#certs[*]}]="$(cs_get_ca "$(printf "${template}" ${i})")"
- done
+ if [ "${#roles[@]}" -gt 4 ]; then
+ ptxd_bailout "HABv4 allows only 4 certificates"
+ fi
+
+ for i in "${roles[@]}"; do
+ certs[${#certs[*]}]="$(cs_get_ca "${i}")"
+ done
+ esac
+
+ echo -e "generating $(basename ${table_bin}) and $(basename ${srk_fuse_bin})\n"
local orig_IFS="${IFS}"
IFS=","
--
2.30.2
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
next prev parent reply other threads:[~2021-07-08 20:40 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-08 20:39 [ptxdist] [PATCH v3 1/5] ptxd_lib_code_signing: cs_get_ca(): improve error handling Roland Hieber
2021-07-08 20:39 ` [ptxdist] [PATCH v3 2/5] ptxd_lib_code_signing: introduce role groups Roland Hieber
2021-07-20 11:48 ` [ptxdist] [APPLIED] " Michael Olbrich
2021-07-08 20:39 ` [ptxdist] [PATCH v3 3/5] templates/code-signing-provider: set up the 'imx-habv4-srk' role group Roland Hieber
2021-07-20 11:48 ` [ptxdist] [APPLIED] " Michael Olbrich
2021-07-08 20:39 ` Roland Hieber [this message]
2021-07-20 11:48 ` [ptxdist] [APPLIED] templates/barebox-imx-habv4: use " Michael Olbrich
2021-07-08 20:39 ` [ptxdist] [PATCH v3 5/5] host-ptx-code-signing-dev: version bump 0.4 -> 0.5 Roland Hieber
2021-07-20 11:48 ` [ptxdist] [APPLIED] " Michael Olbrich
2021-07-09 13:36 ` [ptxdist] [PATCH v3 1/5] ptxd_lib_code_signing: cs_get_ca(): improve error handling Michael Olbrich
2021-07-12 8:42 ` Marc Kleine-Budde
2021-07-13 11:51 ` [ptxdist] [PATCH v4] " Roland Hieber
2021-07-14 6:21 ` Michael Olbrich
2021-07-15 13:42 ` [ptxdist] [PATCH v5] " Roland Hieber
2021-07-20 11:49 ` [ptxdist] [APPLIED] " Michael Olbrich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210708203941.30212-4-rhi@pengutronix.de \
--to=rhi@pengutronix.de \
--cc=mkl@pengutronix.de \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox