Re: [ptxdist] [PATCH v2 4/5] ptxd_lib_code_signing: provide consumer functions with some environment

[Roland Hieber <rhi@pengutronix.de>]

On Mon, Aug 09, 2021 at 10:06:07AM +0200, Roland Hieber wrote:
> The code signing consumer functions should be able to retrieve some
> information about the recipe in which they were called in order to make
> additional checks if needed. Refactor the (shell cs_get_*, …) calls into
> macro calls of the form $(call ptx/cs-get-*, <PKG>, …). Let these
> macros look up the package name (for now) from PTX_MAP_TO_package_<PKG>
> before passing it to the shell functions. Using $(call world/env) here
> would be practical, but would also cause make to complain about
> recursive variable dependencies. Therefore variables must be added
> to ptx/cs-consumer-env manually, but additional information can be added
> later if needed.
> 
> Refactor the existing consumers in the code base too, and add an error
> message in case anyone else that still uses the old API.
> 
> Signed-off-by: Roland Hieber <rhi@pengutronix.de>
> ---
> PATCH v2:
>  - define multiline macros using "define"
> 
> PATCH v1: https://lore.ptxdist.org/ptxdist/20210804142330.32739-4-rhi@pengutronix.de
> ---
>  doc/dev_code_signing.rst                      |  2 +-
>  doc/ref_code_signing_helpers.rst              | 25 ++++++-----
>  rules/barebox.make                            |  2 +-
>  rules/image-rauc.make                         |  6 +--
>  rules/kernel.make                             |  6 +--
>  rules/pre/030-code-signing-consumers.make     | 44 +++++++++++++++++++
>  rules/rauc.make                               |  2 +-
>  .../templates/template-barebox-imx-habv4-make |  6 +--
>  scripts/lib/ptxd_lib_code_signing.sh          | 13 ++++++
>  9 files changed, 83 insertions(+), 23 deletions(-)
>  create mode 100644 rules/pre/030-code-signing-consumers.make
> 
[...]
> diff --git a/scripts/lib/ptxd_lib_code_signing.sh b/scripts/lib/ptxd_lib_code_signing.sh
> index 66a2cab81395..24730d3cf742 100644
> --- a/scripts/lib/ptxd_lib_code_signing.sh
> +++ b/scripts/lib/ptxd_lib_code_signing.sh
> @@ -1,6 +1,7 @@
>  #!/bin/bash
>  #
>  # Copyright (C) 2019 Sascha Hauer <s.hauer@pengutronix.de>
> +# Copyright (C) 2021 Roland Hieber, Pengutronix <rhi@pengutronix.de>
>  #
>  # For further information about the PTXdist project and license conditions
>  # see the README file.
> @@ -176,6 +177,12 @@ export -f cs_set_uri
>  # Get the uri from a role
>  #
>  cs_get_uri() {
> +    if [ -z "${pkg_name}" ]; then
> +	    echo ERROR_UNSUPPORTED_CS_API_CALL
> +	    ptxd_bailout '$(shell cs_get_uri, <role>) is no longer supported in make files.' \
> +		'Use $(call ptx/cs-get-uri, <PKG>, <role>) instead.'
> +    fi
> +
>      local role="${1}"
>      cs_init_variables

Mmh, cs_append_ca_* calls cs_get_uri too and now fails because pkg_name
is empty… I did not catch this in my tests because I never re-installed
the code provider. This needs another workaround in v3.

 - Roland

-- 
Roland Hieber, Pengutronix e.K.          | r.hieber@pengutronix.de     |
Steuerwalder Str. 21                     | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686         | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de