mbox series

[meta-oe,v3,0/6] signing.bbclass: add certificate chain handling

Message ID 20250618-signing-set-ca-v3-0-4ba014735f0e@leica-geosystems.com
Headers show
Series signing.bbclass: add certificate chain handling | expand

Message

Johannes Schneider June 18, 2025, 2:35 p.m. UTC 
Adding support for handling a complex PKI setup to the signing.bbclass

Since a (soft)HSM can only store a single certificate in one slot, the
relation between a leaf certificate, and it's signing intermediary (or
root) certificate has to be stored outside of the HSM, in the form of
some additional metadata.  This additional data is stored in an
environment variable, which is setup and manipulated by a set of
helper functions: signing_{get,set,has}_ca.

This patch-stack also does some cleanup of now superfluous code parts.

---
V3:
- reword commit message and comments following review suggestions
- forsee local.conf overrides for the CA

---
Johannes Schneider (6):
      signing.bbclass: refactor signing_import_cert_from_*
      signing.bbclass: add set|get|has_ca functions
      signing.bbclass: add get_root_cert
      signing.bbclass: add signing_get_intermediate_certs
      signing.bbclass: add signing_extract_cert helpers
      signing.bbclass: remove signing_import_cert_chain_from_pem

 meta-oe/classes/signing.bbclass | 172 ++++++++++++++++++++++++++++++++--------
 1 file changed, 137 insertions(+), 35 deletions(-)
---
base-commit: 3f77bb395c332b12135889bb6b57caee0801b43e
change-id: 20250618-signing-set-ca-f398259222f5

Best regards,