linux/meta-openembedded.git/meta-oe/classes/signing.bbclass, branch master-next

signing.bbclass: add signing_create_uri_pem helper function

2026-03-05T06:26:02+00:00

The PKCS#11 provider has a mechanism [1] to support older applications which have not yet migrated to the OSSL_STORE API [2]. It works by encoding the 'pkcs11:' URI into a PEM file and passing that to an application as a file. From the application's perspective it loads the private key from a file, but OpenSSL will transparently use select the provider to access it via PKCS#11 instead. Instead of upstream's Python-based tool [3] (which would pull in asn1crypto as a dependency), we just generate the ASN.1 for the PEM using OpenSSL's 'asn1parse -genconf'. It has been tested with RAUC, U-Boot's mkimage (for signed FITs) and NXP's CST. [1] https://github.com/latchset/pkcs11-provider/blob/main/docs/provider-pkcs11.7.md#use-in-older-applications-uris-in-pem-files [2] https://docs.openssl.org/master/man7/ossl_store/ [3] https://github.com/latchset/pkcs11-provider/blob/main/tools/uri2pem.py Signed-off-by: Jan Luebbe Signed-off-by: Fabian Pflug Signed-off-by: Khem Raj

signing.bbclass: add support for OpenSSL PKCS#11 provider

2026-03-05T06:26:02+00:00

OpenSSL 4.0 will drop support for engines and use providers instead. To access SoftHSM and other PKCS#11 modules via the provider API, we rely on https://github.com/latchset/pkcs11-provider, which is already available as via pkcs11-provider recipe. We enable this provider by using a specific OpenSSL config when signing. This means that recipes inheriting this class can decide whether they want to use the engine or provider to access the key. SoftHSM seems to produce broken keys when calling the C_CopyObject, so disable caching in the provider for now. Signed-off-by: Jan Luebbe Signed-off-by: Fabian Pflug Signed-off-by: Khem Raj

signing.bbclass: remove trailing white space

2026-03-05T06:26:02+00:00

Signed-off-by: Jan Luebbe Signed-off-by: Khem Raj

signing.bbclass: create env with 0x600

2025-08-20T14:35:07+00:00

The env file holds the PKCS#11 uris, which include the pin to access the database - in plaintext. Directly create the file (after it has been remove) with the proper 'user RW only' permissions, to give only the build-user access to this somewhat "security sensitive" file. Note that the softhsm/sqlite3.db* is already 0x600. Signed-off-by: Johannes Schneider Signed-off-by: Khem Raj

signing.bbclass: make PEM loading compatible with OpenSC 0.26.0

2025-07-02T16:48:26+00:00

With https://github.com/OpenSC/OpenSC/pull/3174 which is part of 0.26.0, OpenSC does not support reading the (DER-converted) object data from stdin anymore. However, OpenSC/pkcs11-tool also supports reading PEM files directly. This we can use for simply replacing and simplifying the stdin piping in signing_import_cert_from_pem(). Only for password-protected files we still have to use OpenSSL for conversion, since OpenSC/pkcs11-tool currently doesn't have a mechanism for providing passwords. For these cases, we store the converted PEM into a simple temporary file. This handling is sufficient, since SoftHSM import should be used for example keys only and SoftHSM also doesn't protect the keys in any way. Keys which actually need to be protected are stored in HSMs and accessed via their PKCS#11 URIs. Signed-off-by: Enrico Jörns Signed-off-by: Khem Raj

signing.bbclass: remove signing_import_cert_chain_from_pem

2025-06-28T18:04:25+00:00

With the now available set|get|has_ca functions to establish a CA link between roles during their import, the signing_import_cert_chain_from_pem can now be removed. As it had the shortcoming of dynamically creating roles, which are harder to handle then the manually/specifically setup CA roles. This effectively reverts: a825b853634 signing.bbclass: add certificate ca-chain handling Reviewed-by: Jan Luebbe Signed-off-by: Johannes Schneider Signed-off-by: Khem Raj

signing.bbclass: add signing_extract_cert helpers

2025-06-28T18:04:25+00:00

Add extract-cert wrapping helper functions, to easily extract certificates again that had been previously imported into the softhsm. Reviewed-by: Jan Luebbe Signed-off-by: Johannes Schneider Signed-off-by: Khem Raj

signing.bbclass: add signing_get_intermediate_certs

2025-06-28T18:04:24+00:00

Add a method that returns a list of intermediary CA roles. When using a complex PKI structure with for example "openssl cms", these roles can then be iterated over adding in turn a '-certificate'. Pseudo-code example: for intermediate in $(signing_get_intermediate_certs 'FooBaa'); do signing_extract_cert_pem $intermediate $intermediate.pem CMD+=" --certificate=$intermediate.pem" done The typical use-case would be adding these intermediate certificates to the CMS structure so that the relying party can build the chain from the signing leaf certificate to the locally stored trusted CA certificate. Reviewed-by: Jan Luebbe Signed-off-by: Johannes Schneider Signed-off-by: Khem Raj

signing.bbclass: add get_root_cert

2025-06-28T18:04:24+00:00

Add a helper method to retrieve the root CA certificate for a given role, by walking the chain that has been setup with signing_import_set_ca up to the last element - which is the root. Reviewed-by: Jan Luebbe Signed-off-by: Johannes Schneider Signed-off-by: Khem Raj

signing.bbclass: add set|get|has_ca functions

2025-06-28T18:04:24+00:00

Add a mechanism to establish a (metadata) link between roles and signer certificates, in the form of a new 'ca' variable. It must point from one role or cert to the signer certificate to preserve the leaf->intermediary-> root certificate relation. With this additional mechanism, it would be now possible to import a complex PKI tree of certificates and then later during usage of one role, reconstruct the certificate chain from the leaf, through multiple intermediary, and up to the root certificate. Reviewed-by: Jan Luebbe Signed-off-by: Johannes Schneider Signed-off-by: Khem Raj