summaryrefslogtreecommitdiffstats
path: root/recipes-sota/aktualizr/aktualizr-ca-implicit-prov.bb
diff options
context:
space:
mode:
authorAnton Gerasimov <anton@advancedtelematic.com>2018-02-15 18:17:36 +0100
committerAnton Gerasimov <anton@advancedtelematic.com>2018-02-26 18:27:57 +0100
commit793f7c8baa1b8b232311d04d7eb1e604fdd82716 (patch)
treee83d73b758e0965d4c8788adccea7a22e7ce411b /recipes-sota/aktualizr/aktualizr-ca-implicit-prov.bb
parent4edf70ff05fd5c1d980d9ebf1fdec4c5ab86f429 (diff)
downloadmeta-updater-793f7c8baa1b8b232311d04d7eb1e604fdd82716.tar.gz
Add provisioning with CA
Diffstat (limited to 'recipes-sota/aktualizr/aktualizr-ca-implicit-prov.bb')
-rw-r--r--recipes-sota/aktualizr/aktualizr-ca-implicit-prov.bb72
1 files changed, 72 insertions, 0 deletions
diff --git a/recipes-sota/aktualizr/aktualizr-ca-implicit-prov.bb b/recipes-sota/aktualizr/aktualizr-ca-implicit-prov.bb
new file mode 100644
index 0000000..51e313d
--- /dev/null
+++ b/recipes-sota/aktualizr/aktualizr-ca-implicit-prov.bb
@@ -0,0 +1,72 @@
1SUMMARY = "Aktualizr configuration for implicit provisioning with CA"
2DESCRIPTION = "Systemd service and configurations for implicitly provisioning Aktualizr using externally provided or generated CA"
3
4# WARNING: it is NOT a production solution. The secure way to provision devices is to create certificate request directly on the device
5# (either with HSM/TPM or with software) and then sign it with a CA stored on a disconnected machine
6
7HOMEPAGE = "https://github.com/advancedtelematic/aktualizr"
8SECTION = "base"
9LICENSE = "MPL-2.0"
10LIC_FILES_CHKSUM = "file://${WORKDIR}/LICENSE;md5=9741c346eef56131163e13b9db1241b3"
11
12DEPENDS = "aktualizr-native openssl-native"
13RDEPENDS_${PN} = "aktualizr"
14
15SRC_URI = " \
16 file://LICENSE \
17 file://ca.cnf \
18 "
19PV = "1.0"
20PR = "1"
21
22require environment.inc
23require credentials.inc
24
25export SOTA_CACERT_PATH
26export SOTA_CAKEY_PATH
27
28do_install() {
29 install -d ${D}${libdir}/sota
30
31 if [ -z "${SOTA_PACKED_CREDENTIALS}" ]; then
32 bberror "SOTA_PACKED_CREDENTIALS are required for implicit provisioning"
33 fi
34
35 if [ -z ${SOTA_CACERT_PATH} ]; then
36 SOTA_CACERT_PATH=${DEPLOY_DIR_IMAGE}/CA/cacert.pem
37 SOTA_CAKEY_PATH=${DEPLOY_DIR_IMAGE}/CA/ca.private.pem
38 mkdir -p ${DEPLOY_DIR_IMAGE}/CA
39 bbwarn "SOTA_CACERT_PATH is not specified, use default one at $SOTA_CACERT_PATH"
40
41 if [ ! -f ${SOTA_CACERT_PATH} ]; then
42 bbwarn "${SOTA_CACERT_PATH} does not exist, generate a new CA"
43 SOTA_CACERT_DIR_PATH="$(dirname "$SOTA_CACERT_PATH")"
44 openssl genrsa -out ${SOTA_CACERT_DIR_PATH}/ca.private.pem 4096
45 openssl req -key ${SOTA_CACERT_DIR_PATH}/ca.private.pem -new -x509 -days 7300 -out ${SOTA_CACERT_PATH} -subj "/C=DE/ST=Berlin/O=Reis und Kichererbsen e.V/commonName=meta-updater" -batch -config ${WORKDIR}/ca.cnf -extensions cacert
46 bbwarn "${SOTA_CACERT_PATH} has been created, you'll need to upload it to the server"
47 fi
48 fi
49
50 if [ -z ${SOTA_CAKEY_PATH} ]; then
51 bberror "SOTA_CAKEY_PATH should be set when using implicit provisioning"
52 fi
53
54 install -d ${D}${libdir}/sota
55 install -d ${D}${localstatedir}/sota
56 install -m 0644 ${STAGING_DIR_NATIVE}${libdir}/sota/sota_implicit_prov_ca.toml ${D}${libdir}/sota/sota.toml
57 aktualizr_cert_provider --credentials ${SOTA_PACKED_CREDENTIALS} \
58 --device-ca ${SOTA_CACERT_PATH} \
59 --device-ca-key ${SOTA_CAKEY_PATH} \
60 --root-ca \
61 --server-url \
62 --local ${D}${localstatedir}/sota \
63 --config ${D}${libdir}/sota/sota.toml
64}
65
66FILES_${PN} = " \
67 ${localstatedir}/sota/* \
68 ${libdir}/sota/sota.toml \
69 ${libdir}/sota/root.crt \
70 "
71
72# vim:set ts=4 sw=4 sts=4 expandtab: