* [ptxdist] [PATCH 2/3] ptxd_lib_code_signing: refactor cs_check_env for SoftHSM workflow
2021-08-09 14:40 [ptxdist] [PATCH 1/3] ptxd_lib_code_signing: take PKCS#11 PIN from the environment Roland Hieber
@ 2021-08-09 14:40 ` Roland Hieber
2021-08-09 14:40 ` [ptxdist] [PATCH 3/3] ptxd_lib_code_signing: let providers clean up their keys Roland Hieber
1 sibling, 0 replies; 4+ messages in thread
From: Roland Hieber @ 2021-08-09 14:40 UTC (permalink / raw)
To: ptxdist; +Cc: Roland Hieber
Checking for PKCS11_MODULE_PATH etc. is also useful for the non-SoftHSM
workflow, but the other variables are specific to SoftHSM. Split off the
SoftHSM checks up into a separate function.
Signed-off-by: Roland Hieber <rhi@pengutronix.de>
---
scripts/lib/ptxd_lib_code_signing.sh | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/scripts/lib/ptxd_lib_code_signing.sh b/scripts/lib/ptxd_lib_code_signing.sh
index 5579161cd5cf..f012f8e194c7 100644
--- a/scripts/lib/ptxd_lib_code_signing.sh
+++ b/scripts/lib/ptxd_lib_code_signing.sh
@@ -32,13 +32,8 @@ cs_export_pin() {
}
cs_export_pin
+# internal
cs_check_env() {
- if [ -z "${SOFTHSM2_CONF}" ]; then
- ptxd_bailout "SOFTHSM2_CONF is not defined. Maybe \$(CODE_SIGNING_ENV) is not used."
- fi
- if [ ! -e "${SOFTHSM2_CONF}" ]; then
- ptxd_bailout "'${SOFTHSM2_CONF}' is missing."
- fi
if [ -z "${PKCS11_MODULE_PATH}" ]; then
ptxd_bailout "PKCS11_MODULE_PATH is not defined. Maybe \$(CODE_SIGNING_ENV) is not used."
fi
@@ -48,6 +43,18 @@ cs_check_env() {
}
export -f cs_check_env
+# internal
+cs_check_env_softhsm() {
+ cs_check_env
+ if [ -z "${SOFTHSM2_CONF}" ]; then
+ ptxd_bailout "SOFTHSM2_CONF is not defined. Maybe \$(CODE_SIGNING_ENV) is not used."
+ fi
+ if [ ! -e "${SOFTHSM2_CONF}" ]; then
+ ptxd_bailout "'${SOFTHSM2_CONF}' is missing."
+ fi
+}
+export -f cs_check_env_softhsm
+
#
# softhsm_pkcs11_tool_init <args>
#
@@ -88,7 +95,7 @@ export -f cs_init_variables
# Initialize SoftHSM and set the initial pin
#
cs_init_softhsm() {
- cs_check_env
+ cs_check_env_softhsm
cs_init_variables
local shsm_keys="${sysroot}/var/cache/softhsm/${keyprovider}"
--
2.30.2
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
^ permalink raw reply [flat|nested] 4+ messages in thread* [ptxdist] [PATCH 3/3] ptxd_lib_code_signing: let providers clean up their keys
2021-08-09 14:40 [ptxdist] [PATCH 1/3] ptxd_lib_code_signing: take PKCS#11 PIN from the environment Roland Hieber
2021-08-09 14:40 ` [ptxdist] [PATCH 2/3] ptxd_lib_code_signing: refactor cs_check_env for SoftHSM workflow Roland Hieber
@ 2021-08-09 14:40 ` Roland Hieber
2021-08-10 9:58 ` Roland Hieber
1 sibling, 1 reply; 4+ messages in thread
From: Roland Hieber @ 2021-08-09 14:40 UTC (permalink / raw)
To: ptxdist; +Cc: Roland Hieber, Bastian Stender
Currently, sysroot-host/var/lib/keys/${keyprovider} is left over even
when the provider package is cleaned. To help with this, introduce
cs_clean and cs_clean_softhsm shell functions. The latter needs access
to ${shsm_keys}, so move its definition into cs_init_variables (even if
this function is not only meant for the SoftHSM workflow, the additional
variable makes no trouble here). Call the cleanup functions in the clean
stage of the providers, and also at the beginning of the compile stage
to ensure a clean setup. For the latter, introduce cs_init for the
non-SoftHSM use case.
Reported-by: Bastian Stender <bst@pengutronix.de>
Signed-off-by: Roland Hieber <rhi@pengutronix.de>
---
doc/ref_code_signing_helpers.rst | 46 +++++++++++++++++++
rules/host-ptx-code-signing-dev.make | 6 +++
.../ptxdist-set-keys-hsm.sh | 1 +
.../template-code-signing-provider-make | 6 +++
scripts/lib/ptxd_lib_code_signing.sh | 44 ++++++++++++++++--
5 files changed, 99 insertions(+), 4 deletions(-)
diff --git a/doc/ref_code_signing_helpers.rst b/doc/ref_code_signing_helpers.rst
index fd16ca763557..0db35776b9c4 100644
--- a/doc/ref_code_signing_helpers.rst
+++ b/doc/ref_code_signing_helpers.rst
@@ -29,6 +29,20 @@ Usage:
Initialize SoftHSM, and set the initial pins.
+.. _cs_clean_softhsm:
+
+cs_clean_softhsm
+^^^^^^^^^^^^^^^^
+
+Usage:
+
+.. code-block:: bash
+
+ cs_clean_softhsm
+
+Clean up everything that was installed into the host sysroot.
+This function should be called by the provider during the ``clean`` stage.
+
.. _cs_import_cert_from_der:
cs_import_cert_from_der
@@ -125,6 +139,38 @@ These helpers allow to define roles, set PKCS#11 URIs and handle certificate
authorities (CAs).
HSM as well as SoftHSM code signing providers should use them.
+.. _cs_init:
+
+cs_init
+^^^^^^^
+
+Usage:
+
+.. code-block:: bash
+
+ cs_init
+
+Initialize the provider.
+This function should be called at the start of the ``compile`` stage.
+For the SoftHSM workflow, call :ref:`cs_init_softhsm` instead.
+
+This function also calls cs_clean.
+
+.. _cs_clean:
+
+cs_clean
+^^^^^^^^
+
+Usage:
+
+.. code-block:: bash
+
+ cs_clean
+
+Clean up everything that was installed into the host sysroot.
+This function should be called by the provider during the ``clean`` stage,
+For the SoftHSM workflow, call :ref:`cs_clean_softhsm` instead.
+
.. _cs_define_role:
cs_define_role
diff --git a/rules/host-ptx-code-signing-dev.make b/rules/host-ptx-code-signing-dev.make
index b242d65fc1be..d09049eaa71b 100644
--- a/rules/host-ptx-code-signing-dev.make
+++ b/rules/host-ptx-code-signing-dev.make
@@ -44,4 +44,10 @@ $(STATEDIR)/host-ptx-code-signing-dev.install:
@$(call targetinfo)
@$(call touch)
+$(STATEDIR)/host-ptx-code-signing-dev.clean:
+ @$(call targetinfo)
+ @$(call clean_pkg, HOST_PTX_CODE_SIGNING_DEV)
+ @$(HOST_PTX_CODE_SIGNING_DEV_MAKE_ENV) \
+ cs_clean_softhsm
+
# vim: syntax=make
diff --git a/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh b/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh
index b94eff049eac..b627541e30c1 100755
--- a/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh
+++ b/rules/templates/code-signing-provider/ptxdist-set-keys-hsm.sh
@@ -43,6 +43,7 @@ set_imx_habv4_keys() {
# HSM use case
+cs_init
set_fit_keys
set_rauc_keys
set_imx_habv4_keys
diff --git a/rules/templates/template-code-signing-provider-make b/rules/templates/template-code-signing-provider-make
index 4cf9cac358cf..a4bd4a1e74c5 100644
--- a/rules/templates/template-code-signing-provider-make
+++ b/rules/templates/template-code-signing-provider-make
@@ -39,4 +39,10 @@ $(STATEDIR)/host-@package@-code-signing.install:
@$(call targetinfo)
@$(call touch)
+$(STATEDIR)/host-@package@-code-signing.clean:
+ @$(call targetinfo)
+ @$(call clean_pkg, HOST_@PACKAGE@_CODE_SIGNING)
+ @$(HOST_@PACKAGE@_CODE_SIGNING_MAKE_ENV) \
+ cs_clean # FIXME: alternatively, call cs_clean_softhsm
+
# vim: syntax=make
diff --git a/scripts/lib/ptxd_lib_code_signing.sh b/scripts/lib/ptxd_lib_code_signing.sh
index f012f8e194c7..e052fa3506b2 100644
--- a/scripts/lib/ptxd_lib_code_signing.sh
+++ b/scripts/lib/ptxd_lib_code_signing.sh
@@ -86,9 +86,21 @@ cs_init_variables() {
sysroot="$(ptxd_get_ptxconf PTXCONF_SYSROOT_HOST)"
keyprovider="$(ptxd_get_ptxconf PTXCONF_CODE_SIGNING_PROVIDER)"
keydir="${sysroot}/var/lib/keys/${keyprovider}"
+
+ shsm_keys="${sysroot}/var/cache/softhsm/${keyprovider}"
}
export -f cs_init_variables
+#
+# cs_init
+#
+# Initialize the provider
+#
+cs_init() {
+ cs_clean
+}
+export -f cs_init
+
#
# cs_init_softhsm
#
@@ -97,10 +109,7 @@ export -f cs_init_variables
cs_init_softhsm() {
cs_check_env_softhsm
cs_init_variables
- local shsm_keys="${sysroot}/var/cache/softhsm/${keyprovider}"
-
- rm -rf "${shsm_keys}" &&
- rm -rf "${keydir}" &&
+ cs_clean_softhsm &&
sed -i "s^directories.tokendir =.*^directories.tokendir = ${shsm_keys}^" \
${SOFTHSM2_CONF} &&
@@ -112,6 +121,33 @@ cs_init_softhsm() {
}
export -f cs_init_softhsm
+#
+# cs_clean
+#
+# Clean up all files that were installed to the sysroot (generic variant)
+#
+cs_clean() {
+ cs_check_env &&
+ cs_init_variables &&
+ echo "Cleaning up ${keydir}" &&
+ rm -rf "${keydir}"
+}
+export -f cs_clean
+
+#
+# cs_clean
+#
+# Clean up all files that were installed to the sysroot (SoftHSM variant).
+#
+cs_clean_softhsm() {
+ cs_check_env_softhsm &&
+ cs_init_variables &&
+ cs_clean &&
+ echo "Cleaning up ${shsm_keys}" &&
+ rm -rf "${shsm_keys}"
+}
+export -f cs_clean_softhsm
+
#
# cs_define_role <role>
#
--
2.30.2
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
^ permalink raw reply [flat|nested] 4+ messages in thread