From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: In-Reply-To: <20200624160849.6966-1-bst@pengutronix.de> MIME-Version: 1.0 Message-Id: From: Michael Olbrich Date: Fri, 26 Jun 2020 13:00:54 +0200 Subject: Re: [ptxdist] [APPLIED] doc: ref_code_signing_helpers: clarify CA keyring function usage List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de Cc: Bastian Krause Thanks, applied as ea9676b3e7839dc38703a0992b5ec15e75fe83c3. Michael [sent from post-receive hook] On Fri, 26 Jun 2020 13:00:54 +0200, Bastian Krause wrote: > Signed-off-by: Bastian Krause > Message-Id: <20200624160849.6966-1-bst@pengutronix.de> > Signed-off-by: Michael Olbrich > > diff --git a/doc/ref_code_signing_helpers.rst b/doc/ref_code_signing_helpers.rst > index c3ffe01cbdac..f7928f52ebef 100644 > --- a/doc/ref_code_signing_helpers.rst > +++ b/doc/ref_code_signing_helpers.rst > @@ -7,7 +7,7 @@ PTXdist provides various bash helper functions to be used in :ref:`code signing > providers ` and :ref:`code signing consumers > `. > > -PTXdist stores URIs and CAs using these helpers in > +PTXdist stores URIs and CA keyrings using these helpers in > ``$(PTXDIST_SYSROOT_HOST)/var/lib/keys///{uri,ca.pem}``. > > SoftHSM Provider Functions > @@ -29,6 +29,8 @@ Usage: > > Initialize SoftHSM, and set the initial pins. > > +.. _cs_import_cert_from_der: > + > cs_import_cert_from_der > ^^^^^^^^^^^^^^^^^^^^^^^ > > @@ -46,6 +48,8 @@ Preconditions: > - the role must have been defined (see :ref:`cs_define_role`) > - SoftHSM must have been initialized (see :ref:`cs_init_softhsm`) > > +.. _cs_import_cert_from_pem: > + > cs_import_cert_from_pem > ^^^^^^^^^^^^^^^^^^^^^^^ > > @@ -164,7 +168,9 @@ Usage: > > cs_append_ca_from_pem > > -Append certificate from a given PEM file for role. > +Append certificate from a given PEM file to the role's CA keyring. > +If no CA keyring exists yet it is created as an empty file before. > + > > Preconditions: > > @@ -181,7 +187,8 @@ Usage: > > cs_append_ca_from_der > > -Append certificate from a given DER file for role. > +Append certificate from a given DER file to the role's CA keyring. > +If no CA keyring exists yet it is created as an empty file before. > > Preconditions: > > @@ -198,18 +205,21 @@ Usage: > > cs_append_ca_from_uri [] > > -Append certificate from a given PKCS#11 URI for role. > +Append certificate from a given PKCS#11 URI to the role's CA keyring. > If URI is omitted the already set URI for role is used. > +If no CA keyring exists yet it is created as an empty file before. > > Preconditions: > > - the role must have been defined (see :ref:`cs_define_role`) > +- when used with SoftHSM, certificates must have been imported before > + (see :ref:`cs_import_cert_from_der`, :ref:`cs_import_cert_from_pem`) > > Consumer Functions > ~~~~~~~~~~~~~~~~~~ > > Packages that want to sign something or need access to keys/CAs can retrieve > -PKCS#11 URIs and CAs with these helpers. > +PKCS#11 URIs and CA keyrings with these helpers. > > .. _cs_get_uri: > > @@ -239,10 +249,10 @@ Usage: > > cs_get_ca > > -Get path to the CA in PEM format for role. > +Get path to the CA keyring in PEM format for role. > > Preconditions: > > -- a certificate must have been appended to the CA > +- a certificate must have been appended to the CA keyring > (see :ref:`cs_append_ca_from_pem`, :ref:`cs_append_ca_from_der`, > :ref:`cs_append_ca_from_uri`) _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de