linux/meta-openembedded.git/meta-oe/classes/signing.bbclass, branch walnascar

signing.bbclass: add label length check

2024-11-01T13:43:15+00:00

Add a (more helpful) error message in case the Package-Name exceeds a certain length which would have the softhsm tools error out. The $PN is used as 'label' in the softhsm, which is a "CK_UTF8CHAR paddedLabel[32]" in softhsm2-util.cpp, so it must not be longer. Signed-off-by: Johannes Schneider Signed-off-by: Khem Raj

signing.bbclass: add certificate ca-chain handling

2024-11-01T13:43:15+00:00

Add handling of ca-chains which can consist of more than one certificate in a .pem file, which need to be split off, processed and stored separately in the softhsm - as the tool-chain signing.bbclass::signing_import_cert* -> softhsm -> 'extract-cert' only supports one-per-file, due to using/expecting "plain" x509 in-/output. The added signing_import_cert_chain_from_pem function takes a basename, and iterates through the input .pem file, creating numbered _1, _2, ... roles as needed. Afterwards the certificates can be used or extracted one-by-one from the softhsm, using the numbered roles; the only precondition - or limitation - is that the PKI structure has to be known beforhand; e.g. how many certificates are between leaf and root. Signed-off-by: Johannes Schneider Signed-off-by: Khem Raj

signing.bbclass: fix typos

2024-03-05T23:09:24+00:00

Signed-off-by: Ulrich Ölmann Signed-off-by: Khem Raj

signing.bbclass: fix wrong function name

2024-02-23T17:17:42+00:00

The function signing_import_pubkey_from_pem is defined twice, one of them should really be named signing_import_pubkey_from_der. Fix this and while at it fix some argument names in the comments above the functions as well. Reported-by: Miklos Toth Fixes: 4a6ac691f ("add signing.bbclass as infrastructure for build artifact signing") Signed-off-by: Sascha Hauer Signed-off-by: Khem Raj

signing.bbclass: make it work with eliptic curve keys

2024-02-13T20:41:23+00:00

"openssl rsa" works with RSA keys only. Use "openssl pkey" instead which is a frontend that picks the right operation automatically and works with RSA keys, eliptic curve keys and also DSA keys. Signed-off-by: Sascha Hauer Signed-off-by: Khem Raj

signing.bbclass: don't export OPENSSL environment variables globally

2023-10-09T16:38:49+00:00

OPENSSL_{MODULES,ENGINES,CONF} and SSL_CERT_{DIR,FILE} are currently exported globally for any recipe that inherits signing. This not only affects the tasks that use the signing infrastructure, but also unrelated tasks like e.g. do_fetch. Avoid this by exporting the variables only for these tasks that actually call signing_prepare. This resolves a breakage I observed on Ubuntu 18.04, where the host tool wget is called with the environment variables set and then fails with a SSL error (exit code 5). Signed-off-by: Ahmad Fatoum Signed-off-by: Khem Raj

add signing.bbclass as infrastructure for build artifact signing

2023-02-15T16:23:49+00:00

This adds common infrastructure to access and used asymmetric keys to sign build artifacts. The approach and implementation was presented at the recent OpenEmbedded Workshop: https://pretalx.com/openembedded-workshop-2023/talk/3C8MFF/ A working demo setup for verified boot based on qemu is available at https://github.com/jluebbe/meta-code-signing. Signed-off-by: Jan Luebbe Signed-off-by: Khem Raj