From patchwork Sat May 31 11:32:47 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Schneider X-Patchwork-Id: 63964 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E1BCC5B55A for ; Sat, 31 May 2025 11:33:05 +0000 (UTC) Received: from DUZPR83CU001.outbound.protection.outlook.com (DUZPR83CU001.outbound.protection.outlook.com [52.101.66.34]) by mx.groups.io with SMTP id smtpd.web10.4121.1748691180659516902 for ; Sat, 31 May 2025 04:33:00 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@leica-geosystems.com header.s=selector1 header.b=oARfSnLs; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: leica-geosystems.com, ip: 52.101.66.34, mailfrom: johannes.schneider@leica-geosystems.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=PSkoKb90rsewhRi0OC4jFxPYpDHoQucYIBddng511BkSp23OL3LtssUYgp6KOdlysmkLsUlfADqNIckSZJGHs+o5xQs3x9zdIt7iKvEC40ApRlTgDA4T+Eg43OE6L6mBpSpHpJIKTofTbTh+XjmNeu5Wyeo8EGte46A3d8s4Aga6P4whFUrsyuPQHEqpZPLqmR8pSzcdBrS+nwY778L5DnxeipBIWsnifeE2ketXIrbmdpAEhkBt95V95nJtwfWZAobiU00/9EJGAIrNo1Ack4a4tiq73TojiqGmIZbaYkSEmFdhVkq/QpOTjMzxjEeUjk1OfpoghP+5r3iBaGk5uA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=IPI+ZJ/CRMcDvG/+RAJ10Vl0iKkBfP02I/VGJtMRayw=; b=EuYNqWLugKqvDbZX1f4C8vJKD8hBjPgtJniidUj6dFS4HYZmCyBIaAOTTqQ/DKFicnxmKx62McbV6EyTmSp0uNA2ImxiLalAVvSNCcPZ+rdPOqZo1mH2Kv4RTJFhbTaZEHb6Mzh0zB/rMMOkNHVt0EsWXqFYWQNBNXd3FEpBt542rBW+idDgf0sfFCuVxYd+OUhewTywL3JLemulztJDW9LHNBwCyOzJ3xg6uJ6YFPYzXVJuaqMydF0mIs0wpkNfka77IZ3F3ObrhpF+TH6POLLxa++prUj54xH2tFEkCgo4AmxVKYXg7vS8cV08ZQY83b6PeS64hTtXg7LOH+1xYQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 193.8.40.94) smtp.rcpttodomain=lists.openembedded.org smtp.mailfrom=leica-geosystems.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=leica-geosystems.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=leica-geosystems.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IPI+ZJ/CRMcDvG/+RAJ10Vl0iKkBfP02I/VGJtMRayw=; b=oARfSnLsFf5ymuIhqG2mxJRmxi90E/H2PMJuUZUYNhOtZLXNOhVUx+gRCvz8Vu42pU6S9JBvb6Hw5P26p8TsgrzxDtBqZbqutAVSCPeZyteJ+36mYSEMU1XFd8IaHKbS8Z1pQCsnjBVFkY9F7NZPCVV8xa9NOirzF/zzJcqsySM= Received: from PR2PR09CA0018.eurprd09.prod.outlook.com (2603:10a6:101:16::30) by AM7PR06MB6424.eurprd06.prod.outlook.com (2603:10a6:20b:118::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8769.27; Sat, 31 May 2025 11:32:54 +0000 Received: from AMS0EPF000001B5.eurprd05.prod.outlook.com (2603:10a6:101:16:cafe::18) by PR2PR09CA0018.outlook.office365.com (2603:10a6:101:16::30) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8769.27 via Frontend Transport; Sat, 31 May 2025 11:32:54 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 193.8.40.94) smtp.mailfrom=leica-geosystems.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=leica-geosystems.com; Received-SPF: Pass (protection.outlook.com: domain of leica-geosystems.com designates 193.8.40.94 as permitted sender) receiver=protection.outlook.com; client-ip=193.8.40.94; helo=hexagon.com; pr=C Received: from hexagon.com (193.8.40.94) by AMS0EPF000001B5.mail.protection.outlook.com (10.167.16.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8792.29 via Frontend Transport; Sat, 31 May 2025 11:32:54 +0000 Received: from aherlnxbspsrv01.lgs-net.com ([10.60.34.116]) by hexagon.com with Microsoft SMTPSVC(10.0.17763.1697); Sat, 31 May 2025 13:32:53 +0200 From: Johannes Schneider To: openembedded-devel@lists.openembedded.org, raj.khem@gmail.com, jlu@pengutronix.de CC: bsp-development.geo@leica-geosystems.com, customers.leicageo@pengutronix.de, Johannes Schneider Subject: [meta-oe][PATCH v2 1/6] signing.bbclass: refactor signing_import_cert_from_* Date: Sat, 31 May 2025 13:32:47 +0200 Message-ID: <20250531113252.3889951-2-johannes.schneider@leica-geosystems.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> References: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> MIME-Version: 1.0 X-OriginalArrivalTime: 31 May 2025 11:32:53.0825 (UTC) FILETIME=[BF9F0310:01DBD21F] X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMS0EPF000001B5:EE_|AM7PR06MB6424:EE_ X-MS-Office365-Filtering-Correlation-Id: 7f23b3df-460a-440c-62dc-08dda036e2aa X-SET-LOWER-SCL-SCANNER: YES X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|376014|1800799024|36860700013; X-Microsoft-Antispam-Message-Info: jUGcVjdkJZecU7LI1Ow379spebRGckLEJkirru+rQeR/BXC0QA1Ih4aKPhVHeW4RsHJJt2YuxeCmF007EoQFYS1DfN5XiMw0cRtzcA8XkAeuKIi0vdoX9PEZKfBhvf2WKaFsAywgk0mEi//1u3FmXgoUKsWG8iWJNtSkjtnVnuGDbPCKz5MApZ1EVszDXU/ZgE3RSjWjfG6jOXmeQBYLDYodty2Dw4qfijsAR1UOBlq1YCs5wLEPfQwleGvePfrk6KcYrZDwT/tPYY7xHUARV26oChW8Kpi+c/8oqir5fIg17Nkt7OONtR1BlK62Se15EVRm45hAn01CjIvrQ3rc6m+Tz6Zqfv47EwyPQXTFEmHKE3z6WpvYfuw8IdZr/cPmOXd3nZHpXzGvE69SnYYXbwTPTQJwM4Qj7dTDIfUYbX8efHIG+gu/tkFhPCO+xW9daCE4+VNoOQzHy95LGP5JAoeebEIpI64XHvGUMBgF5ZT7VFjkZcIRL6KfDC9aXI4CzOPXBSsFCgLaWkdSduqYtablx/lxOhNwA8PPGIuMsWU1RaxvxYZ6fWJ8ozpH3yI83tQO7sIQ1d5xuEpSV4BRY7Gka71etHBYLTWdwS5malmWppB/FeoKa09hgbRP9qk9/J63diIY59EwKonKpNFV1DTzOI0fC0hrXr/bATXmavM4704XWzQ3xNSqgeZDHjKZ6BAukvC54dEWgejGSHzXEZEoglztN1w//erP6TPgoyFJJ/1+U7aUx9F30kBdymUyGaonV4dIbaa/15fDC2F3qwJcgdCY5hKBFGlCvyO3bZGvhbROh4d47qad4UP3FM3ouUxeweR5SIv0nRjTBMAYQ2p72MCmCcFHlqtSszhcweWKz8566uZZGlSuseJHs/D+0la5jSR2OkWbLfxNOidQqArNLOq+mdm0PHfQvXzvbYx9q9LBl+qy+281cSowvSgOdaqcUtroPnEpDWiOm5KmhxoJWr68WCUD1++rjvaCGk1MGoAM2igDPeqwe/uvcvLcOY44iYpEDGrckVvEYbIaktTuoCwts9+9mGkFP03lGl9P2nvxQnl8ZL9vy/6tEhagsmjGrC8DKNPk4SkPLuvv+OG+57dsJQVU+7hYQujRtoB3HZgXqWTk+wI8S6OvLdpfi1ggvnge3wP+deMHdKAa4SHt4ocNw3LRt/XVRjoMTKu/mmetyx9pGTdxrI2d1lefVuPsReVyMaeMO6J9XpFnsrGmgMkorS8Gz11rnH9Yc1uJ56+s0JtGVdbwwKsePzmOmN26IQoK+HN8Ca4cXXN2CVEg0fVyAjQ5/jaZVBKXeip2f6DIJmYTWGfU0BINxXGvula5WUpU+gyLALuYd1w8Y6p5W4IHIOLQIjH7ZLCFWf/Q9SHZHSX3wzFHQTkXgb1gbpBTwo0D8W3gIyiguRVpacIabCIUAy7Yrvl7ryRBSnWnlYmykbNRBiPkJhi1JEsMK8BZTV9XDlbtPi58dE8v19I3o7x/0EJbLXNTOUKJ/USxNfj0Rfk0Hf1a15Xbjiiv X-Forefront-Antispam-Report: CIP:193.8.40.94;CTRY:CH;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:hexagon.com;PTR:ahersrvdom50.leica-geosystems.com;CAT:NONE;SFS:(13230040)(82310400026)(376014)(1800799024)(36860700013);DIR:OUT;SFP:1101; X-OriginatorOrg: leica-geosystems.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2025 11:32:54.7573 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 7f23b3df-460a-440c-62dc-08dda036e2aa X-MS-Exchange-CrossTenant-Id: 1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a;Ip=[193.8.40.94];Helo=[hexagon.com] X-MS-Exchange-CrossTenant-AuthSource: AMS0EPF000001B5.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PR06MB6424 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 31 May 2025 11:33:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/117687 Refactor the two methods to import certificates from PEM/DER to be usable independently from keymaterial that is linked to a role. By having the import_cert_from methods create a storage location (aka role) in the softhsm dynamically. This way certificates can - but don't have to - be linked to a key, or can stand on their own if chain of certificates from a PKI has to be managed. Signed-off-by: Johannes Schneider Reviewed-by: Jan Luebbe --- meta-oe/classes/signing.bbclass | 42 +++++++++++++++++++++++++-------- 1 file changed, 32 insertions(+), 10 deletions(-) diff --git a/meta-oe/classes/signing.bbclass b/meta-oe/classes/signing.bbclass index 8af7bbf8e0..c768371151 100644 --- a/meta-oe/classes/signing.bbclass +++ b/meta-oe/classes/signing.bbclass @@ -123,15 +123,26 @@ signing_import_define_role() { echo "_SIGNING_PKCS11_MODULE_${role}_=\"softhsm\"" >> $_SIGNING_ENV_FILE_ } -# signing_import_cert_from_der +# signing_import_cert_from_der # -# Import a certificate from DER file to a role. To be used -# with SoftHSM. +# Import a certificate from DER file to a cert_name. +# Where the can either be a previously setup +# signing_import_define_role linking the certificate to a signing key, +# or a new identifier when dealing with a standalone certificate. +# +# To be used with SoftHSM. signing_import_cert_from_der() { - local role="${1}" + local cert_name="${1}" local der="${2}" - signing_pkcs11_tool --type cert --write-object "${der}" --label "${role}" + # check wether the cert_name/role needs to be defined first, + # or do so otherwise + local uri=$(siging_get_uri $cert_name) + if [ -z "$uri" ]; then + signing_import_define_role "$cert_name" + fi + + signing_pkcs11_tool --type cert --write-object "${der}" --label "${cert_name}" } # signing_import_cert_chain_from_pem @@ -164,17 +175,28 @@ signing_import_cert_chain_from_pem() { done } -# signing_import_cert_from_pem +# signing_import_cert_from_pem # -# Import a certificate from PEM file to a role. To be used -# with SoftHSM. +# Import a certificate from PEM file to a cert_name. +# Where the can either be a previously setup +# signing_import_define_role linking the certificate to a signing key, +# or a new identifier when dealing with a standalone certificate. +# +# To be used with SoftHSM. signing_import_cert_from_pem() { - local role="${1}" + local cert_name="${1}" local pem="${2}" + # check wether the cert_name/role needs to be defined first, + # or do so otherwise + local uri=$(siging_get_uri $cert_name) + if [ -z "$uri" ]; then + signing_import_define_role "$cert_name" + fi + openssl x509 \ -in "${pem}" -inform pem -outform der | - signing_pkcs11_tool --type cert --write-object /proc/self/fd/0 --label "${role}" + signing_pkcs11_tool --type cert --write-object /proc/self/fd/0 --label "${cert_name}" } # signing_import_pubkey_from_der From patchwork Sat May 31 11:32:48 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Schneider X-Patchwork-Id: 63965 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7DA2AC61CE5 for ; Sat, 31 May 2025 11:33:05 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.34]) by mx.groups.io with SMTP id smtpd.web10.4120.1748691179956723909 for ; Sat, 31 May 2025 04:33:00 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@leica-geosystems.com header.s=selector1 header.b=THY75B0z; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: leica-geosystems.com, ip: 40.107.162.34, mailfrom: johannes.schneider@leica-geosystems.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Apfvb/DNTSBk1XrXm5Ms0cjBW85T2Fcy4z5OvmyWuE4Bi5s47V/TaG/pIkx8NoFMEtpSIGDbbsDpcxV9JWtEKhXGJoAt5fJXbzaj4JuriFt7nYF6fnj9L4cV/Rx1UBMy9RpJpTnVY7iYXVa4z8hXWE23BcFJFir5a4rAoLYWl6+f0tiGj+tJf9yNiI/6IdkM8IGBnwOli8BbfZ0qfQnRcmfjIrU4MiJE6TIAtHyeMbDWXW5XhG5SMcc2Y6//LGwLHsGCKtKEErBpiAIDIo3TVEw6KeEVUY64OUHSJwyC7RY9vRU0PSxi/bW2i9AtQxnqxSlT321vDCFw8E2nMKmBUw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BMgSw78zTIaLBUvrxW3C7gosnREPIY1y5xa9U9p5nXI=; b=jdZcZOUkBZJiCZxZ3lW3fKNQioUAJ5PTxvSKTFerEUE4r1cTA09QWT2Fy5Jz6sxD8sBeWPAunfr2oMqzjJcjybYxtlyYunmYQIx7n4nGRs/ZvngJHfPZxt5ezddLssOspwt9JOb3acQUgNe3WiTB67rsUL3Roe6/JA9zWzVPviF0KF/uB0YrRBpspg9kmcMUr6gsaHSgX9ywwKkhFyH1zQj5K4za48KCyMQHCMItCwHgGh11T/mcanZiBDRQ47kiA2lFPIywvwLHBg+aLyiME72c73XhriqHqisE9cTDxhVg5Q+2wplDoKTrMycIRkhN52U8AgUCEhd6OD4hZ9wxYA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 193.8.40.94) smtp.rcpttodomain=lists.openembedded.org smtp.mailfrom=leica-geosystems.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=leica-geosystems.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=leica-geosystems.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BMgSw78zTIaLBUvrxW3C7gosnREPIY1y5xa9U9p5nXI=; b=THY75B0zQk5G4TITtgUu9R8d7kImz3Rkpq+M9kUBxgA4nhyk6i+x+8wvm3NnAtNN/BC7HcqcmDPn/9WcAgx+BzL0z1LYicTeHuSXhOWowFfA/ivjJS13LCm366OY8Q62XphCG0HNbtgYJAOEzy/zM5kyto8ZmMWIHsQ42X92K60= Received: from PR2PR09CA0001.eurprd09.prod.outlook.com (2603:10a6:101:16::13) by GV2PR06MB9875.eurprd06.prod.outlook.com (2603:10a6:150:27a::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8769.30; Sat, 31 May 2025 11:32:55 +0000 Received: from AMS0EPF000001B5.eurprd05.prod.outlook.com (2603:10a6:101:16:cafe::d2) by PR2PR09CA0001.outlook.office365.com (2603:10a6:101:16::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8792.19 via Frontend Transport; Sat, 31 May 2025 11:32:55 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 193.8.40.94) smtp.mailfrom=leica-geosystems.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=leica-geosystems.com; Received-SPF: Pass (protection.outlook.com: domain of leica-geosystems.com designates 193.8.40.94 as permitted sender) receiver=protection.outlook.com; client-ip=193.8.40.94; helo=hexagon.com; pr=C Received: from hexagon.com (193.8.40.94) by AMS0EPF000001B5.mail.protection.outlook.com (10.167.16.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8792.29 via Frontend Transport; Sat, 31 May 2025 11:32:55 +0000 Received: from aherlnxbspsrv01.lgs-net.com ([10.60.34.116]) by hexagon.com with Microsoft SMTPSVC(10.0.17763.1697); Sat, 31 May 2025 13:32:53 +0200 From: Johannes Schneider To: openembedded-devel@lists.openembedded.org, raj.khem@gmail.com, jlu@pengutronix.de CC: bsp-development.geo@leica-geosystems.com, customers.leicageo@pengutronix.de, Johannes Schneider Subject: [meta-oe][PATCH v2 2/6] signing.bbclass: add set|get|has_ca functions Date: Sat, 31 May 2025 13:32:48 +0200 Message-ID: <20250531113252.3889951-3-johannes.schneider@leica-geosystems.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> References: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> MIME-Version: 1.0 X-OriginalArrivalTime: 31 May 2025 11:32:53.0871 (UTC) FILETIME=[BFA607F0:01DBD21F] X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMS0EPF000001B5:EE_|GV2PR06MB9875:EE_ X-MS-Office365-Filtering-Correlation-Id: caed934f-1bac-46c1-8da1-08dda036e2e0 X-SET-LOWER-SCL-SCANNER: YES X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700013|376014|1800799024|82310400026; X-Microsoft-Antispam-Message-Info: khS7VIaPqRPsHXMI9Qn42BSlzQfYsPk9ZO0XBoHNmvwN7Rgb3BF6AAnzbxsDTim3jV+aCVdL07GyHLugLtLqRTzrBtC3l23ni38QPDbg99gFp/AMVdJiZ/XEtiEW5qG51um3tT7xDK20lCvAS3II/fhPG45pRH5zjlZ7RiM4W9ncXT11tgygKYYLfk1f1OaPDAJ/ZMevF2gUVs3EHz2lgcJ0VKhPvTvNIBiBvc+7dogOCwJtevN3L7yickoCbGkdc98SXfDJQY/THaETQ6e8wzH1DsipIImXxiNFHwFnagcupKP7zGLlPYUwBMpts2yZD5Mo606rAKPVBhKppSSicMAa2K9pFwAIcqgbhHQBMmw9d9tC0Cz+XAK4DH77saTv4M5oD0ygq5iYtG3NmEXE3UnztupOgvUQBUCy4nY2B9BmAEgSP+03VfjwLZk98TVSbH4YOLCRMQ+GAFlb6VY+0XcbJLWH7LYet2K5aZEGBmywOPqgKAtW6fDXeypY38+vDw1YX/ppgbuadN6dxvKQxUUmQiQJ3jjv1G13XZ4N8BhPsX96zZuwf2LdBTdPpnLQIxYQOiqzEy0Eo55epxZocSf/gzLTHIOXwa+qXTV18bz9In34XoDmoSB1R3uQ2SH+jdGkIzOQ01eebdQvBDLvlwA7FSqY/+5FKIwnCwOgxTulryfmWlJN3y3hSSij5wAihWnYW4/h/sHI7VuSGudp9BE8OWzCAnKNCDuLM5gn/tYMktHvYshP5eYaVL9VxYBC3RJGwZEoQl+iXjq0MJjgUrqvfzCU5AkxbMPmO7Q+jSlWmoJIO1frsivde8yCebbIVHYjY3IE4IrSW2DoQ495IBXg55eBohb/pRKQVTTTXhAK5Gd249q+LljMV3MXlEs4+oKnn+Cksmq0SFYt+MBrvcTPxXLTgQMD1dD3uJq7RwGmRZzc3dWf6n/BbIN2UpnW8heK11UcQ3VmmRCtOsi5j4JbFvA3f7oLoZgmy/WMIkE6Q2Njb3a/w1FCrw9ecixe0IyaiLf8w++OPaogRUd3XBpcgsAKDTUOSdz9q7W88h4fE5cCs4/y2As2tmAC2JhyHTSL6pA9DJDfBTUSzGxebZqrRtyWpsy4JlAC5uGCi8yuYRKyqAnfENCyBStVzEJHiH4TWU3yJ4aNilD0I+CUHp/h9ul0f/JwxTcwoZPT6/MaY4BXWQXB5b60jcNwhUI7VSVibZdUN5GWTwvDG263RUMe1y7NS9BkvQUS+uALV0OFHEYnEiu8blobENKUDZFfFy0xUicmtysyeOmI7Ktze/zJTaO0ZicRvRNuF3TmJRpskz7JZ1/nRc1AzbnANHJTwTHbzX7VGozQKKKWLH9DMLSqYsCqbN7HWCAWik/YfHYc01tBHDXOAKnLKgLIfN4HhAd/G7Wd9iKOYayWf0gego1AaIaSu4cYs21EZHZ4WBrk0OqW3BLhn+XueuKTPyLDvenw/4mldhSUCh02DOUbFT0mSnSkKWQ1330OccYUalspek880q9H9ti62l2CMOmN X-Forefront-Antispam-Report: CIP:193.8.40.94;CTRY:CH;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:hexagon.com;PTR:ahersrvdom50.leica-geosystems.com;CAT:NONE;SFS:(13230040)(36860700013)(376014)(1800799024)(82310400026);DIR:OUT;SFP:1101; X-OriginatorOrg: leica-geosystems.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2025 11:32:55.1168 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: caed934f-1bac-46c1-8da1-08dda036e2e0 X-MS-Exchange-CrossTenant-Id: 1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a;Ip=[193.8.40.94];Helo=[hexagon.com] X-MS-Exchange-CrossTenant-AuthSource: AMS0EPF000001B5.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV2PR06MB9875 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 31 May 2025 11:33:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/117684 Add a mechanism to establish a (metadata) link between roles, in the form of a new 'ca' variable. Which is intended to point from one role to another, to preserve the leaf->intermediary certificate relation. With this additional mechanism, it would be now possible to import a complex PKI tree of certificates (either just the certificates, or both cert+key where available); and then later during usage of one role, reconstruct the verification chain from the leaf, through multiple intermediary, and up to the root role. Signed-off-by: Johannes Schneider --- meta-oe/classes/signing.bbclass | 36 ++++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-) diff --git a/meta-oe/classes/signing.bbclass b/meta-oe/classes/signing.bbclass index c768371151..5992a75be7 100644 --- a/meta-oe/classes/signing.bbclass +++ b/meta-oe/classes/signing.bbclass @@ -145,9 +145,43 @@ signing_import_cert_from_der() { signing_pkcs11_tool --type cert --write-object "${der}" --label "${cert_name}" } -# signing_import_cert_chain_from_pem +# signing_import_set_ca +# +# Link the certificate from to its issuer stored in +# By walking this linked list a CA-chain can later be +# reconstructed from the involed roles. +signing_import_set_ca() { + local cert_name="${1}" + local ca_cert_name="${2}" + + echo "_SIGNING_CA_${cert_name}_=\"${ca_cert_name}\"" >> $_SIGNING_ENV_FILE_ + echo "added link from ${cert_name} to ${ca_cert_name}" +} + +# signing_get_ca # +# returns the that has been set previously through +# signing_import_set_ca; or the empty string if none was set +signing_get_ca() { + local cert_name="${1}" + eval local ca_cert_name="\$_SIGNING_CA_${cert_name}_" + echo "$ca_cert_name" +} + +# signing_has_ca +# +# check if the cert_name links to another cert_name that is its +# certificate authority/issuer. +signing_has_ca() { + local ca_cert_name="$(signing_get_ca ${1})" + + test -n "$ca_cert_name" + return $? +} + +# signing_import_cert_chain_from_pem +# # Import a certificate *chain* from a PEM file to a role. # (e.g. multiple ones concatenated in one file) # From patchwork Sat May 31 11:32:49 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Schneider X-Patchwork-Id: 63961 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 605F8C5AE59 for ; Sat, 31 May 2025 11:33:05 +0000 (UTC) Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.13]) by mx.groups.io with SMTP id smtpd.web11.4008.1748691180812374804 for ; Sat, 31 May 2025 04:33:01 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@leica-geosystems.com header.s=selector1 header.b=L9JhCvLf; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: leica-geosystems.com, ip: 52.101.72.13, mailfrom: johannes.schneider@leica-geosystems.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=OQkY97AOjvh8is/3N5y0zbnTRFUgd8ZOSg33a9sFFysC9J48IrhTU/SZYilQ5xe1gyoMPgD/AAwvMRnbz2/UPd6yXQq3xdR3Ak42QxJxRqvMpZBMyOaEIa/acoOVFzJvSgTa2+MFAidEVy5z5iNrZ5TtdxMXS2MYYon2Z97BgWKnw9Kk5/VtzD71cvKfaeupKoCc48n+kVegyn8LoxxrhMDj4dlIx+CVW5AH1XyhKF4NYKvYakVjb5PaFEhoxwaps2q2hG3/MKf06+fYyuwSCUVefKQmu+T2UWJfU9oBAOXzC3qcWX/g4n9R1nfDrGCpjZQxH39+ffEeu+IXth0ESw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=SlvLtB2K3pwhNYzH2Xrgbdu4qMF3FZijhBj2GGJNu6Q=; b=NI3vAcqmzo7BQm7+lvapyVrITHzCSkSf8oVORnix2w8v3C0qlcr0zJaoXKtsBZi/07LwETgEvhrwEhxmerT/VPvG/AW/qw/QVjaan1Y6YbYeu7Jy+HB1xPhUg1hUGC58xVYIK3SFSXkbCd5hITRQQVXxFUL1a3lOGrJZ4DAm5xS1vIQp0mO2PGNWvtFvgUdOqOc6K0XOe3wIRC2xOBYwz8HhyIhreVZ1g6MdoAtIPUhM09t5YtRpkCEk3ej/dYgWpygNvrZyTbIZUHB4G+e7aRWXTLxtEH8jf7kDzACF2gF8cyEzhVOWfH4s9pQ9SOPLk9X9OgOw1LUjBW1meCTQBQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 193.8.40.94) smtp.rcpttodomain=lists.openembedded.org smtp.mailfrom=leica-geosystems.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=leica-geosystems.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=leica-geosystems.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SlvLtB2K3pwhNYzH2Xrgbdu4qMF3FZijhBj2GGJNu6Q=; b=L9JhCvLf9ThwegIoY1hOiNPX+QM9JAfbM1EMwyHoJe7suohphp5wFpWRyE4lCI6pKPi1YMNCskIteZCO/11W2QfhhLwWS6BTBOt0DZs1xThVMv+h/VnIR/1AN0c+8e2MRrQ35BuNIpCfxKm0Y7scGsS+4MeyCD9GHKTsDAdrqKY= Received: from PR2PR09CA0015.eurprd09.prod.outlook.com (2603:10a6:101:16::27) by AM8PR06MB6914.eurprd06.prod.outlook.com (2603:10a6:20b:1d7::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8769.30; Sat, 31 May 2025 11:32:55 +0000 Received: from AMS0EPF000001B5.eurprd05.prod.outlook.com (2603:10a6:101:16:cafe::e9) by PR2PR09CA0015.outlook.office365.com (2603:10a6:101:16::27) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8792.19 via Frontend Transport; Sat, 31 May 2025 11:32:55 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 193.8.40.94) smtp.mailfrom=leica-geosystems.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=leica-geosystems.com; Received-SPF: Pass (protection.outlook.com: domain of leica-geosystems.com designates 193.8.40.94 as permitted sender) receiver=protection.outlook.com; client-ip=193.8.40.94; helo=hexagon.com; pr=C Received: from hexagon.com (193.8.40.94) by AMS0EPF000001B5.mail.protection.outlook.com (10.167.16.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8792.29 via Frontend Transport; Sat, 31 May 2025 11:32:55 +0000 Received: from aherlnxbspsrv01.lgs-net.com ([10.60.34.116]) by hexagon.com with Microsoft SMTPSVC(10.0.17763.1697); Sat, 31 May 2025 13:32:53 +0200 From: Johannes Schneider To: openembedded-devel@lists.openembedded.org, raj.khem@gmail.com, jlu@pengutronix.de CC: bsp-development.geo@leica-geosystems.com, customers.leicageo@pengutronix.de, Johannes Schneider Subject: [meta-oe][PATCH v2 3/6] signing.bbclass: add get_root_cert Date: Sat, 31 May 2025 13:32:49 +0200 Message-ID: <20250531113252.3889951-4-johannes.schneider@leica-geosystems.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> References: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> MIME-Version: 1.0 X-OriginalArrivalTime: 31 May 2025 11:32:53.0918 (UTC) FILETIME=[BFAD33E0:01DBD21F] X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMS0EPF000001B5:EE_|AM8PR06MB6914:EE_ X-MS-Office365-Filtering-Correlation-Id: 3781d15b-6a43-4cf0-1131-08dda036e342 X-SET-LOWER-SCL-SCANNER: YES X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|36860700013|82310400026|376014; X-Microsoft-Antispam-Message-Info: Dx6eH2NENhOuAsUWr59JAbZ8Lk005jHRlbi364tUZ4xcVQLRStoLPihnyEWaYrhudjxabnQ8UmyTODz70QQqjXbn+AolNpZxE1rUpgxwT30oyZuNWAJqn+UfhcefWE8hp1TtUbGu06rpqp7FucKk1tQ08lOy4ZI2C/MLxnK9J5uMQpPfCw+02iKjBEyjWvBNRclgTYRh4H+vfvCSjUIrTvVLS9fo+YLXguylHHKDqD/khx+ttawZ3FEeujA7h4YHjvJ/OuKAtAvAFj2THEnPjLsLWij6deMkOd1KT9NmDgigLWgt7Df6tbb1h4PQ0mE2Ipzfe2KxfCHXX99xPWBWAVW/8Vqbho2rLUbrrVW3bWjU5uz/7SVO3kwfkLite8u9/bUcDH6zPaObeb0i/55VeNwuB1xKRAtMdRhzlAf/GW1Ickm1y/cyPfFl1mA6uMC9PQHQvPzhvIyziX0K8dDFgnYHj4GStajwbyNG7eqN982mV33/nJCw20V79cpyMq9gMD8xq8fmq0nDu9UGQvivNMSyB/DL/HrJCetwMtB5XsCVlfuWaaQWHgtEtawkJ8CLADBaTzsOIzPvuF1YDPjogfwBBmX2/sgteVh7IdJmXom0MsEv7fpCpWqDz+vgXR3xQDevqmfhk1RWPY/Uw+tPc6A9MyAUimJ42YlZ42SzEk8NRWDPAgNWARIpuABQeLQqyD3T3bu1pKxzP9siAKbw95qf2rHk7VQ6jbhBvLhAkbOm6afrTGFVFa0ygnPTRTcPAE5qWZtyYMROyke2vXQ3tSnEuB00IHa4yDDrhGjaQvUEipcjMXhAFrZ+79hjVUFWAzcz26pb6VmRYuguck68E4stQvRFjdKGLMrdb62e+JTutcKK1ttcMwT9RoHYzyma61CJgSpCKYZzdQP9UDzTC5HepZy2XSRm1v1vdyUbCNUtftsjk5wO1afgnnNvoQj7l5gN5jbYa0oNIuc5sL/6msiGfk59YzHZh9qFQ6aOcoiRBTVXFM1+HkP8eXgcLGMMZuzoVHHcEu+KzZVkSucdx2zeNZ0spapU0bzShtt/irRurHRC2O2vl0Yk7nzJduv/mkfaOzjJimeYEJxWfdwkVJl+x7WXo5ZyKF6bOdLgLqHCAyf7dV8/pLf1eKP/QIxCB3NZ+HYfurBHzMtYPzAxGkadzS38M+YPe23RbBo2UOuFg8NjFPb0OFCqSfYIbXdvvq0c1PhOvHdgzNjYMwhRj4wXAUqlrOjTeBvunV1qOSdYhV+L7DM3o3LvpXtPf/0YSO0mI7S2JhhMl+8EsXxSCI1O9zkaa4j9BISkVauUCHl2alfF5mQa3O0z6vslfjB3cWrIuGVDXpA902erSCovkk+xf7s0Xx7Os+8quoGxiv+lKw7pK1E1DuEEFZfw4U4M5luZ9bdp99FDb7gPHw/75Nql5XiYBjwYUf49L9yawBeBVTWvlAqU1q93hkPC/AQMI2/BvID+OVSWmbarp5a9CDm8O13RhX4HsYXnWwJZlL8VmcO7sXJVpf91xFBYhhYm X-Forefront-Antispam-Report: CIP:193.8.40.94;CTRY:CH;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:hexagon.com;PTR:ahersrvdom50.leica-geosystems.com;CAT:NONE;SFS:(13230040)(1800799024)(36860700013)(82310400026)(376014);DIR:OUT;SFP:1101; X-OriginatorOrg: leica-geosystems.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2025 11:32:55.7573 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 3781d15b-6a43-4cf0-1131-08dda036e342 X-MS-Exchange-CrossTenant-Id: 1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a;Ip=[193.8.40.94];Helo=[hexagon.com] X-MS-Exchange-CrossTenant-AuthSource: AMS0EPF000001B5.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM8PR06MB6914 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 31 May 2025 11:33:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/117688 Add a helper method to retrieve the root CA certificate for a given role, by walking the chain that has been setup with signing_import_set_ca up to the last element - which is the root. Signed-off-by: Johannes Schneider Reviewed-by: Jan Luebbe --- meta-oe/classes/signing.bbclass | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/meta-oe/classes/signing.bbclass b/meta-oe/classes/signing.bbclass index 5992a75be7..ee32cc12f7 100644 --- a/meta-oe/classes/signing.bbclass +++ b/meta-oe/classes/signing.bbclass @@ -180,6 +180,22 @@ signing_has_ca() { return $? } +# signing_get_root_cert +# +# return the role/name of the CA root certificate for a given +# , by walking the chain setup with signing_import_set_ca +# all the way to the last in line that doesn't have a CA set - which +# would be the root. +# +# To be used with SoftHSM. +signing_get_root_cert() { + local cert_name="${1}" + while signing_has_ca "${cert_name}"; do + cert_name="$(signing_get_ca ${cert_name})" + done + echo "${cert_name}" +} + # signing_import_cert_chain_from_pem # # Import a certificate *chain* from a PEM file to a role. From patchwork Sat May 31 11:32:50 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Schneider X-Patchwork-Id: 63963 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6FEF2C5B559 for ; Sat, 31 May 2025 11:33:05 +0000 (UTC) Received: from EUR05-DB8-obe.outbound.protection.outlook.com (EUR05-DB8-obe.outbound.protection.outlook.com [40.107.20.86]) by mx.groups.io with SMTP id smtpd.web11.4004.1748691179989056860 for ; Sat, 31 May 2025 04:33:00 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@leica-geosystems.com header.s=selector1 header.b=hl8KfnHK; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: leica-geosystems.com, ip: 40.107.20.86, mailfrom: johannes.schneider@leica-geosystems.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mSUarPOzor2gjTZBdujrJikm2/2vfvVKp3iaKOBsVT0D+EDfXLiMVWXiYKNW5oSmrlrM1GjBpjBGRn6/pX4IikGTJo5FCRzrLLehzac/L818wahK0hnTCuyq8qj67scqil8d1+emxU3Gqx6IT34rU3mA56ifM32MjclA3M22mSxvfleQkjiHf9AgD6yRNUHpDuvagnoKhIXuSnfUG5AXJa03u3y9/4MlW4vpANsUeJt8xbxsk5Dwf1MRWyUHt7ltzeNAuXGwaXLoFoHhrn/Qi0RfRIR3x5tO0ruUzR/IGovjkgf4H5C+yZQicl9/Gje/ZFNTyBdT3IitsNGdE0TEtg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LVT1GAG42P2SNywJNWNDGjnHnDqqbXWWTVVePD7GpKg=; b=qq74kHD/BoQKI0HXDVRdE/4rxkOLJYGFw//R/hEnP6Pi5LroggHFjNY3WQ30ufPKlwo4nvdByD7n8ofEvljWZeYcHWj5ip85cXTPb2Vj4iLCWysH+2rqBFrdPSng1p1O3MvZt6Rc7av6kaHxmI70K+CRfGsUOLyRcr2g2Gu5ymYDkrj3qzeqUUayNg63SXIbrUQbzbg6m4NZyVpoQb1FerL/B8nHSuRQsoymOMfpAnh+JBdCeEaqWEEyhyDYonY6VmOfeZ/8ER2aoivpP/ebBdLYvm++bBw9J1ED7xwNIo4JMkwTPNjT686aqPLKh8rlCWmBwma9+F5Ljt5dpuhfZQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 193.8.40.94) smtp.rcpttodomain=lists.openembedded.org smtp.mailfrom=leica-geosystems.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=leica-geosystems.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=leica-geosystems.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LVT1GAG42P2SNywJNWNDGjnHnDqqbXWWTVVePD7GpKg=; b=hl8KfnHKoJpDnlUSkzEzMLVDIo0/1Vxokgtmsz0FApeCkYGUp4wzDdcxtyi5r0PZRCYAXiCgumM7tDpfJWLtBGt0GcAaLxK/qrC+QJLQdUsns1QJI3jAJjjIWDllgy3uMT0st0+5NCJ7dQ8yXT5KAdFIYbbp8wrsNlStUDeSHv8= Received: from PR2PR09CA0018.eurprd09.prod.outlook.com (2603:10a6:101:16::30) by AS5PR06MB8653.eurprd06.prod.outlook.com (2603:10a6:20b:672::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8746.30; Sat, 31 May 2025 11:32:56 +0000 Received: from AMS0EPF000001B5.eurprd05.prod.outlook.com (2603:10a6:101:16:cafe::18) by PR2PR09CA0018.outlook.office365.com (2603:10a6:101:16::30) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8769.27 via Frontend Transport; Sat, 31 May 2025 11:32:56 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 193.8.40.94) smtp.mailfrom=leica-geosystems.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=leica-geosystems.com; Received-SPF: Pass (protection.outlook.com: domain of leica-geosystems.com designates 193.8.40.94 as permitted sender) receiver=protection.outlook.com; client-ip=193.8.40.94; helo=hexagon.com; pr=C Received: from hexagon.com (193.8.40.94) by AMS0EPF000001B5.mail.protection.outlook.com (10.167.16.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8792.29 via Frontend Transport; Sat, 31 May 2025 11:32:56 +0000 Received: from aherlnxbspsrv01.lgs-net.com ([10.60.34.116]) by hexagon.com with Microsoft SMTPSVC(10.0.17763.1697); Sat, 31 May 2025 13:32:53 +0200 From: Johannes Schneider To: openembedded-devel@lists.openembedded.org, raj.khem@gmail.com, jlu@pengutronix.de CC: bsp-development.geo@leica-geosystems.com, customers.leicageo@pengutronix.de, Johannes Schneider Subject: [meta-oe][PATCH v2 4/6] signing.bbclass: add signing_get_intermediate_certs Date: Sat, 31 May 2025 13:32:50 +0200 Message-ID: <20250531113252.3889951-5-johannes.schneider@leica-geosystems.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> References: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> MIME-Version: 1.0 X-OriginalArrivalTime: 31 May 2025 11:32:53.0918 (UTC) FILETIME=[BFAD33E0:01DBD21F] X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMS0EPF000001B5:EE_|AS5PR06MB8653:EE_ X-MS-Office365-Filtering-Correlation-Id: ed5b8474-6d6b-4092-f9e7-08dda036e378 X-SET-LOWER-SCL-SCANNER: YES X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|82310400026|1800799024|36860700013; X-Microsoft-Antispam-Message-Info: sJlhZBM1YQ09GhpgzZ7XkvELFutbIQbX3hhusLSlTihVf4JLhyTcsBrEDHcR/2jSQe2YkQ7tkyzvoZsPgwj6AYKN9L7mE3XmCmIDuK5f/CPqaEwTglg5W/LiavEkhziJeBHSvwC14PPywm4ZcIcMlVdkheiI9dmvyWlQinQiIAR1Jd4+JGIASVHbRg5Ps9QYAm/Dc5HQNPx5wbkvMb0s1LD5JKe+AVURAvyUBh+emm5dMPPWnv3Kt//1VFKJxuVqS1Smhlg1rzMPrXo4Tzeizws/LBPvepLZbsawa3SX7EONUhivA24SYlpX4ydIwGi6eGQhq/ROpbl9bdYeI6IFpEGoSxaXBqvr8FwkHYqE0hyclcJkI1qlbI8kP3ElLk8B6Y0yc4Uv8zqivMoEHCdycy/D+/J9OBXB/iz4dIcWjNKIMry4E+/KkpjcVzQm5Z2jaUwz7x6yvCvnkhKtdHg1I4GXbPMhZt4IcnMxzTx1osEhUkwB5D+iiLEXQAqbD/mK8hXw0NCy28UeRVPA+KzE6H9IwWxvJLj4z9ZDVkWA8oazbLReGQPotrkwbVBADIZn6prZRXGuOdJ+YUJbwyLiyD4pP2ocTHfTB6V+sdWDEU/H6YgJ7IGq1Z81b9BI9gDNonylF/xgiyUzbwwfoB8WAvu+ra/tNBzudLtABU0LpgRLm0cjfqdtKs+2izKiW3zGIX52Pz2GPf7yz0iGzrLrEbyV/bVQc1dMXsgVhcu+204N8KFIUoywEyFfwgTkIHJ5ce15i5bI1DBtFjY4bnULVNlRhxoJLRl1WqpsoxFM2yNWVAu0Ge08YbqQCubW/GCwzRR4q+P50OQlNVjvDdwSOivyZbfPCO8g0coq75YWUtl+cTdOUC+FEqHzpHh3mFdqsruLdysZS3poBV556amtVFHWngJi44QXvylvwxiEHKQVex23FMmo04WL9Cf+2OTcFlAdt3BcwyTiDJV5p3TJk+Cr81b0Mfa6Qq0RkVjTAhT/eqS6kAkWeKyY5c4r9aNWu5Pxa4UgbvCWqJNTaof3BHoQ0n94Q3b941+ETP1IKYgGDfi+UhyOmmIk1d9lcnIKb1j16uxq7JaPU0uUo6tXCnT+y64BgaC3x3nSf/B77ju0xfXRHzGaVIu4UpG8rV64ofTrjReSLIqiXO0dBixovK4p64NmlT+LZEB+K9CBXcqp21/vUbgAUzMhWg31aUyMDOVWWqNzaFBmnsZsNIt+SB0znw8WxmqfM6bTJRuuq75arHNRG5eHvd7l8VzcLIjx+UeP2NvyRWkZFUTYfGVGSVlYDOrrG2AODTlbFkYKE+NnlE8w6H18pgaFYtx0F+NnihBx/2tvAVnf+9ImZSJ8HyUvlQm2tvUQrrd1LyG01/JW6dmcAX3q3S2zMmeBNnrYirFBfHIS0J2S4mVm0O6buv/bY3unTfmDR6fxZnCfTl9trmb4TsiCDND/2aA5GpOtfsf0vywvevDC32XiuWSe5ZLHWTajNLUX56CQGhuA890viK64wEBHJOK2RAR3ZkuH X-Forefront-Antispam-Report: CIP:193.8.40.94;CTRY:CH;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:hexagon.com;PTR:ahersrvdom50.leica-geosystems.com;CAT:NONE;SFS:(13230040)(376014)(82310400026)(1800799024)(36860700013);DIR:OUT;SFP:1101; X-OriginatorOrg: leica-geosystems.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2025 11:32:56.1168 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ed5b8474-6d6b-4092-f9e7-08dda036e378 X-MS-Exchange-CrossTenant-Id: 1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a;Ip=[193.8.40.94];Helo=[hexagon.com] X-MS-Exchange-CrossTenant-AuthSource: AMS0EPF000001B5.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS5PR06MB8653 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 31 May 2025 11:33:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/117683 Add a method that returns a list of intermediary CA roles. When using a complex PKI structure with for example "openssl cms", these roles can then be iterated over adding in turn a '-certificate'. Pseudo-code example: for intermediate in $(signing_get_intermediate_certs 'FooBaa'); do signing_extract_cert_pem $intermediate $intermediate.pem CMD+=" --certificate=$intermediate.pem" done Signed-off-by: Johannes Schneider Reviewed-by: Jan Luebbe --- meta-oe/classes/signing.bbclass | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/meta-oe/classes/signing.bbclass b/meta-oe/classes/signing.bbclass index ee32cc12f7..7bc3e7cb12 100644 --- a/meta-oe/classes/signing.bbclass +++ b/meta-oe/classes/signing.bbclass @@ -180,6 +180,27 @@ signing_has_ca() { return $? } +# signing_get_intermediate_certs +# +# return a list of role/name intermediary CA certificates for a given +# by walking the chain setup with signing_import_set_ca. +# +# The returned list will not include the the root CA, and can +# potentially be empty. +# +# To be used with SoftHSM. +signing_get_intermediate_certs() { + local cert_name="${1}" + local intermediary="" + while signing_has_ca "${cert_name}"; do + cert_name="$(signing_get_ca ${cert_name})" + if signing_has_ca "${cert_name}"; then + intermediary="${intermediary} ${cert_name}" + fi + done + echo "${intermediary}" +} + # signing_get_root_cert # # return the role/name of the CA root certificate for a given From patchwork Sat May 31 11:32:51 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Schneider X-Patchwork-Id: 63962 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CB12C5B556 for ; Sat, 31 May 2025 11:33:05 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.56]) by mx.groups.io with SMTP id smtpd.web11.4006.1748691180447518251 for ; Sat, 31 May 2025 04:33:00 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@leica-geosystems.com header.s=selector1 header.b=kD+sP4j/; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: leica-geosystems.com, ip: 52.101.69.56, mailfrom: johannes.schneider@leica-geosystems.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=I/BYfKEtQZQAJvTxO+ytxYnvUt/aumEumUnn1IsojLh5O2Z2vLApg6utw23Tix6iceuxxTboZAg9xwdH6UkVm9t5cMgrA1ak9KHiJrz1PLv1tjpANUdJUOqc6nsLoLQvMU2JlfGfOOaVJxYYIyWqu/bTTH7T1k++Kh9vlsB0XezLyAiIJ+J1IPU8oN32jrScSY/X2Wj7xlDb0wJR8XYabnZUeQfxNYRKaFwftqImel53RYZu3+5h/P5uf9WK93ylPeaPwP3wDl7ILawpmRbIgrK9N+T28xdaYhMIlNlKDTjFXggqCSBFnAscZIUx14A+ymHHV2+hyQglV0FxJ240WQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=TtHvIPVSI/9iWvHBejzLOrXPhITknPxEIcf9amQeDGM=; b=WJLrb6yAd89dNnE2vKU6buQN2klHXUjk1iyyCFPkXiewmWeqgBpmjELO07q5coezCYxt2SifyzNO7ADZQG/UexKABNHqhc4ER5tddwUb0gYgP4kfPR7gxQnT4JoLs1XF9SE2J6D0w60tiJO6DlSBLaMPVJNSAYKA9U/+vN9aggFJZAg10thsSb7NPDYEO0W/k0QPL8Pop2+VFbytoh0X8auDW6USH2JTSg0cksy5cKcHl7lx5SKM3NkWW2HfF2NSTWqo3wi9IsLG45UeRWbUziNcwxn7uVAhwo6VkDoYc+ZKB8wweZVhQP0Zt+0CiGhZXT0tNk7HPC0u4Ee+RY0TFA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 193.8.40.94) smtp.rcpttodomain=lists.openembedded.org smtp.mailfrom=leica-geosystems.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=leica-geosystems.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=leica-geosystems.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=TtHvIPVSI/9iWvHBejzLOrXPhITknPxEIcf9amQeDGM=; b=kD+sP4j/fGglw/Wr2+W1pR7LycJSEZ8jHo93odTEmO5QBZWYn7lQADbMMk/bmhtHPLpFVBd8uRCfGe1IFwJECQNIaefXoecDocNpSawxoM14OSiZjCi7pKT+RhHpyEc5cXmqa4EP1dMso3XMRisDjDgtFtvRyJpBeBIaP/ce+e8= Received: from PR2PR09CA0012.eurprd09.prod.outlook.com (2603:10a6:101:16::24) by PAXPR06MB8160.eurprd06.prod.outlook.com (2603:10a6:102:199::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8769.34; Sat, 31 May 2025 11:32:56 +0000 Received: from AMS0EPF000001B5.eurprd05.prod.outlook.com (2603:10a6:101:16:cafe::bd) by PR2PR09CA0012.outlook.office365.com (2603:10a6:101:16::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8769.27 via Frontend Transport; Sat, 31 May 2025 11:32:56 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 193.8.40.94) smtp.mailfrom=leica-geosystems.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=leica-geosystems.com; Received-SPF: Pass (protection.outlook.com: domain of leica-geosystems.com designates 193.8.40.94 as permitted sender) receiver=protection.outlook.com; client-ip=193.8.40.94; helo=hexagon.com; pr=C Received: from hexagon.com (193.8.40.94) by AMS0EPF000001B5.mail.protection.outlook.com (10.167.16.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8792.29 via Frontend Transport; Sat, 31 May 2025 11:32:56 +0000 Received: from aherlnxbspsrv01.lgs-net.com ([10.60.34.116]) by hexagon.com with Microsoft SMTPSVC(10.0.17763.1697); Sat, 31 May 2025 13:32:53 +0200 From: Johannes Schneider To: openembedded-devel@lists.openembedded.org, raj.khem@gmail.com, jlu@pengutronix.de CC: bsp-development.geo@leica-geosystems.com, customers.leicageo@pengutronix.de, Johannes Schneider Subject: [meta-oe][PATCH v2 5/6] signing.bbclass: add signing_extract_cert helpers Date: Sat, 31 May 2025 13:32:51 +0200 Message-ID: <20250531113252.3889951-6-johannes.schneider@leica-geosystems.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> References: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> MIME-Version: 1.0 X-OriginalArrivalTime: 31 May 2025 11:32:53.0965 (UTC) FILETIME=[BFB45FD0:01DBD21F] X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMS0EPF000001B5:EE_|PAXPR06MB8160:EE_ X-MS-Office365-Filtering-Correlation-Id: 049685a6-5e6d-4f74-b0c8-08dda036e3bb X-SET-LOWER-SCL-SCANNER: YES X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|376014|36860700013|1800799024; X-Microsoft-Antispam-Message-Info: iwPMUtHo17LBXZ40aBZGKRypahd0x9bms1lMOeyEj1tVRNntL+YnI9pML609Ao4SpsVE7JMa2ZT6z03h7XwoFTw1KrOdqKjVqjeIWBfqkx0lf30hikdzdImIQorQ3luv3j/DDGb975roo6C6g215qaj0ZCd4ZF0BJD4Cle5QbZJlWKH+fHmRQRzLgoScohyiidwCFFRRH4ihStsL7HNDhScL+0INNRgu7Gs1yi22HxquD/HL4DWST7DAL7xaxdE9z8tihO6fab7OFG4avssgBUfvLaB1mY+yUd4I/NIEUzPi03GAg8/cZDzg41YooaT/4RuJpII98sjP8SWmcAJHMO6abYXKaGciMPMba1/IHYlhH07WA3/hRxfc43lnJucu8ZWkyTNtFsCHCJ8p+tk8lM9ad2hDapzXC9NlAzeAUiwE8fUbi9U5feP55ckfB/48QEAzC1LEjYokgCgPcdIB3FzRRcJ7hkkRzyPMvU0ovRln+zMH8rzLRl/uyUkvQQc66fLyvRfvh5fa3zOTqoR2uT/HKHtOIOSu+wmfcpEOoeEpwL/obiphIe0+lh5ty5GrLheV8WCAnLsdE9KfEmL/wTs8O5etlhpXhyggM04LybqCYLMQ2unkzQLfU0xm/c8IVOHO7L+JgKidYGH2uetcl75UYFizRgQDcDaJCNqnff/Y39I0i1HZE5U51SekJwTGASog2LiEuV+TF4GwG+jTv3nW5dEjgfI9rRX+/juy9U/WvHqyILSO9VrN10Ju2fqcAY1sC0zhaQ06+w5wX3ae6il/VETLmWjhityi8hA9Wk6fYtjJgCxg+8MBpABDcXs7wpSjPuXYKAVumEBiPHLRStGGzmNAiyQwoHo7z8Tj8Eip3IYBoruJh63pUt2ZxLJafGcx/D6N6iVquErzpLQobOAXeuXsowu1TZV2jL3Iko2g+UPJ03Eyg+2mnIfAWsLs9zhvGKlWhCL3JqeShnIt1dyOD1j40L9jRW8DJyQEqFbvthLGT4Bz+0LTHfE1U/G9Cqj3+HK4PEZqeYehXnkNMHNHnnGYvr8+0TjJjxRy0dZ/oe5RN62eejvG5F8A2uTz2qusRg+T9NNuPEgcL8uBrTR3DkNXs1lndzz2jcjHwy+fsc6S8mHBCdSpin0sCiLOJfjeejT8KT/uZ/Q15vput1dwnLmaUywjEoVOsqZ/hKniuXz3QnQTSMPFSGFX1WHrustA/1U8nOccgN6ijz/VPkO72Wn+g7jYyf4LjB54tuvG1MO+9elEx4kObMV9+0p2ey44Ig8sUgv67OJrI+ozm5dYqUjF1IRGhmEgUAHqPA0CHwjNmaXBQmFMSP6kjPCc0ZA+4uDn2TYLLI0zmxqBE6mD24Mc+gC/g8UWHMSfxjsmsI2vAunOLwcL+Q1VwZFYao7WK6ldv4NZBuaYfbMeKBg1nEP0ctTSuxtKdUUByOpo0FQsWBbh2y2dE9i5sQcjhkC4fJ4KPIy+KqpOlptfeiPKe/cRSzc5wTksrdHaLMAVVE4XH3wED8+l+2MsLoPa X-Forefront-Antispam-Report: CIP:193.8.40.94;CTRY:CH;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:hexagon.com;PTR:ahersrvdom50.leica-geosystems.com;CAT:NONE;SFS:(13230040)(82310400026)(376014)(36860700013)(1800799024);DIR:OUT;SFP:1101; X-OriginatorOrg: leica-geosystems.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2025 11:32:56.5542 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 049685a6-5e6d-4f74-b0c8-08dda036e3bb X-MS-Exchange-CrossTenant-Id: 1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a;Ip=[193.8.40.94];Helo=[hexagon.com] X-MS-Exchange-CrossTenant-AuthSource: AMS0EPF000001B5.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXPR06MB8160 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 31 May 2025 11:33:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/117685 Add extract-cert wrapping helper functions, to easily extract certificates again that had been previously imported into the softhsm. Signed-off-by: Johannes Schneider Reviewed-by: Jan Luebbe --- meta-oe/classes/signing.bbclass | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/meta-oe/classes/signing.bbclass b/meta-oe/classes/signing.bbclass index 7bc3e7cb12..1f50e89d1e 100644 --- a/meta-oe/classes/signing.bbclass +++ b/meta-oe/classes/signing.bbclass @@ -54,7 +54,7 @@ SIGNING_PKCS11_URI ?= "" SIGNING_PKCS11_MODULE ?= "" -DEPENDS += "softhsm-native libp11-native opensc-native openssl-native" +DEPENDS += "softhsm-native libp11-native opensc-native openssl-native extract-cert-native" def signing_class_prepare(d): import os.path @@ -439,6 +439,30 @@ signing_get_module() { fi } +# signing_extract_cert_der +# +# Export a certificate attached to a role into a DER file. +# To be used with SoftHSM. +signing_extract_cert_der() { + local role="${1}" + local output="${2}" + + extract-cert "$(signing_get_uri $role)" "${output}" +} + +# signing_extract_cert_pem +# +# Export a certificate attached to a role into a PEM file. +# To be used with SoftHSM. +signing_extract_cert_pem() { + local role="${1}" + local output="${2}" + + extract-cert "$(signing_get_uri $role)" "${output}.tmp-der" + openssl x509 -inform der -in "${output}.tmp-der" -out "${output}" + rm "${output}.tmp-der" +} + python () { signing_class_prepare(d) } From patchwork Sat May 31 11:32:52 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Schneider X-Patchwork-Id: 63960 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D96AC5B543 for ; Sat, 31 May 2025 11:33:05 +0000 (UTC) Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.27]) by mx.groups.io with SMTP id smtpd.web11.4007.1748691180535602007 for ; Sat, 31 May 2025 04:33:00 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@leica-geosystems.com header.s=selector1 header.b=eEAtLdnk; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: leica-geosystems.com, ip: 52.101.72.27, mailfrom: johannes.schneider@leica-geosystems.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=r9eyADpmbxhtdtEDvhUA+uuYX1YyHAvqENwYJcxF6DeJ++qjeqT7APO3IiRQy8bgbyGqZBa3jKvcOZ21vq/9wD5WZkxNP/HH21PjS7qhtmKEiwGFlOhOkoT4DtnRgHLHj+Xvoy8m/wr26yNQsfWmF3itM8goSY8nxTrSNBAAXLHsU4kVK+z/FlLJ/DQT+6aqx77igYJCFjM0nGw7uvmNPCYeh6IcX/4bEpoxdbIn8nbYiF6ngIsgdL0zzBrVIxgexSGblE3dKJmQXP6Grq2mfmjbTOpUlbP1lRgphUiqIaTP5Gbj1yUFK1CV07BNuZnmDX8WJUnpapOJUkyRkJ628g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=fdglauII033HQlF27qvJ+oYsZd2HuM5PdzG5wKQ7Gjg=; b=OG/3S98wl42mBBmlmC4yXJrqO/m86GZpaORs74co1hveLQPmrrvbkmqU9nbTmr4RTQcoog2WYrnu01To2Zf38W94W/ACwRPPcH1Ua7GFv76CZtlk25e98Y2QFFDRTAx1VWEvX42fCFI5lEXf2zjpEhUndPu+T0azKp0Y1aBPTw9G5/FwnIOSWrf2nYsADSLpX1JMLrTjq/MqNxM6EBSsKVFonSTexWTyhK/MiBKj6r2ZlPZ+pEeDtsBsN9YIrzo5pbdvx0b9vFpcsiq9qaBMGNqVuwOC6GU4hgeWGKCouTZoFAPAFb57nQwqZTm3IB7Gbp0FpQtnNxmfMvuBGfARyQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 193.8.40.94) smtp.rcpttodomain=lists.openembedded.org smtp.mailfrom=leica-geosystems.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=leica-geosystems.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=leica-geosystems.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fdglauII033HQlF27qvJ+oYsZd2HuM5PdzG5wKQ7Gjg=; b=eEAtLdnk8ejYwyg4x5dvvQoUUCZUxEWiVb1dMtaEKSXf6Qr/+l+EbnFfcni+QDWG9QuD8WXH3v465+sr3luptEh1SFlwbvzpfr9xBxnn9kv7f8t9QrSLui5BeBCQ829rLVrvb/pmkGda0gLTKjnLh4f0drMeKa+sPYJg7WrBYbI= Received: from PR2PR09CA0002.eurprd09.prod.outlook.com (2603:10a6:101:16::14) by PA1PR06MB9131.eurprd06.prod.outlook.com (2603:10a6:102:464::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8769.29; Sat, 31 May 2025 11:32:56 +0000 Received: from AMS0EPF000001B5.eurprd05.prod.outlook.com (2603:10a6:101:16:cafe::e4) by PR2PR09CA0002.outlook.office365.com (2603:10a6:101:16::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8769.29 via Frontend Transport; Sat, 31 May 2025 11:32:56 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 193.8.40.94) smtp.mailfrom=leica-geosystems.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=leica-geosystems.com; Received-SPF: Pass (protection.outlook.com: domain of leica-geosystems.com designates 193.8.40.94 as permitted sender) receiver=protection.outlook.com; client-ip=193.8.40.94; helo=hexagon.com; pr=C Received: from hexagon.com (193.8.40.94) by AMS0EPF000001B5.mail.protection.outlook.com (10.167.16.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8792.29 via Frontend Transport; Sat, 31 May 2025 11:32:56 +0000 Received: from aherlnxbspsrv01.lgs-net.com ([10.60.34.116]) by hexagon.com with Microsoft SMTPSVC(10.0.17763.1697); Sat, 31 May 2025 13:32:53 +0200 From: Johannes Schneider To: openembedded-devel@lists.openembedded.org, raj.khem@gmail.com, jlu@pengutronix.de CC: bsp-development.geo@leica-geosystems.com, customers.leicageo@pengutronix.de, Johannes Schneider Subject: [meta-oe][PATCH v2 6/6] signing.bbclass: remove signing_import_cert_chain_from_pem Date: Sat, 31 May 2025 13:32:52 +0200 Message-ID: <20250531113252.3889951-7-johannes.schneider@leica-geosystems.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> References: <20250531113252.3889951-1-johannes.schneider@leica-geosystems.com> MIME-Version: 1.0 X-OriginalArrivalTime: 31 May 2025 11:32:53.0981 (UTC) FILETIME=[BFB6D0D0:01DBD21F] X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AMS0EPF000001B5:EE_|PA1PR06MB9131:EE_ X-MS-Office365-Filtering-Correlation-Id: 4710298e-816c-4334-57fa-08dda036e3eb X-SET-LOWER-SCL-SCANNER: YES X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|376014|36860700013|1800799024; X-Microsoft-Antispam-Message-Info: X2pxVenJY1ewVfZRJFA/a1DEbXQ6dEghA7Uh7fRM0UAsNeKcztI+uEbxNe1wl/NHDAa8eiedXMbJIL9HeSkyZuaQgZqPmq/sXSauUyzPnPOLHKG+An8lgKrr81eZJPnp4ngdd5n8JhfKZSbXf4wlGUyDSk24M+WKH7CYNCifR6kSzGgnCstd3P5KPLTdHjS3cj8GCAnoR0zexov8Haw6uJxX44xRF8bme6if4gjinBbA0AjlyD0UDZbbaxu+ayBomioVeP7aMm/emfmltBLZPLVSZwmRgMykLfqTthmB764POmA3A0Hji8po2HTCwFklVrC0cKOJj3XLcYF34IGU2gUDRgsuKYM0yPldcN4ej7FYeDw0AabIAnVy+TZrFbz/CrhwZ7M9h2jGgdK9O5gUzu/BlB+vZpu3kTZDXZ0mbBAe/DoJDJBsW/V8Ofx8tNeYTqmzjQuqCGdJJ9FePTCz2qxaK7ppemHMOvIBVKgtZVcWkAzMbbfTK9b8gJLYLxTXvfpnOizhpB5pfQKlmJXkzbSSRJIQ+9EWsEpTqhLm7FOlsMFYAmPBwYUAb08KZdsblbJq157aZAZC3DmqQ4pV0yQGYG/ULS8yWdccJaqN9eUuuNLRIZM0s4IQjDwCZ/kEXemZ8TAdad+e1oR895hZrgXh5IWvWtaHShZnpD+ynNQDWrNN4ozMma3/WDVOdfzK9rFxRz0hNTdAFfsIKDTFYiyZS8MZI7LKNZO11QuLwk1yFZ2OeGSEOizWgRSTrflzk+EXDS47l0i26F+RCCDNSnitlno+bcCJRfGVJYvfyVbUzljvlOYSfjzKlW5heSFxJ4Id+nZUS9AU2zzwLaKzTbz/nCfBad2yJNfoXpEdcjlL8/Aj4V5BGzW4Sbb8OCKvjtbGm9WqB6AeQmOiyJN5g+VMwQBiywet37OYG+ScQaEaVZb+E359k69o+ZfObOgL7BR6TrLBh2teAhdG8X+IOxth2UaLIQvJBNRWcoob+pLOPfg/aXq0ksjHwOYPIoq6GO5h5TZeoBU5P815rH8HxXbhbKJ5ABNE1nXFRBgVXzVIjdQ1dydi8e70ZMb8/BsRPjpfDxCufmoo5JnMV5j62iN1GmIYBAH1Efa/T2n6Uywwl6DEOpTntYy7SCHDJroD0lBHatAQtnu6IKVEfmMgX7NLT63PAe+uyanpEsq8vhgo925/S8TlA3QCJouBJDyrMSdTMAggm289UKjLeIncDHWhbe0DfZ2KMZZhwZM7KaIgf5tyAPTGv3L6FYu9iPT+hRuJJj5aSCcxZv/OMS1L8ZDyVqg+LN9+Da5VGlDRsO8xfJAaNjMFzO0ExG8bmvXJqmb/pKSqFAzUYPtkO8ZrmbRwYAkQ5VW6tIGNcnZ48YJnuNrMS6oaek8v6PiWUFicf0alLwtn8pAPje8NUoHwcGXD8tc1Cm4R7yl+FXrIwov5XyD6A8Y7UBCdPwDML4QrI002VZYQMoDmEf7uJBeLnWN0rJ9lbtz9NbkuV8VZjjbIGbEiPJ4FZqHBztqUUOy2 X-Forefront-Antispam-Report: CIP:193.8.40.94;CTRY:CH;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:hexagon.com;PTR:ahersrvdom50.leica-geosystems.com;CAT:NONE;SFS:(13230040)(82310400026)(376014)(36860700013)(1800799024);DIR:OUT;SFP:1101; X-OriginatorOrg: leica-geosystems.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2025 11:32:56.8667 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 4710298e-816c-4334-57fa-08dda036e3eb X-MS-Exchange-CrossTenant-Id: 1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=1b16ab3e-b8f6-4fe3-9f3e-2db7fe549f6a;Ip=[193.8.40.94];Helo=[hexagon.com] X-MS-Exchange-CrossTenant-AuthSource: AMS0EPF000001B5.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1PR06MB9131 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 31 May 2025 11:33:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/117686 With the now available set|get|has_ca functions to establish a CA link between roles during their import, the signing_import_cert_chain_from_pem can now be removed. As it had the shortcoming of dynamically creating roles, which are harder to handle then the manually/specifically setup CA roles. This effectively reverts: a825b853634 signing.bbclass: add certificate ca-chain handling Signed-off-by: Johannes Schneider Reviewed-by: Jan Luebbe --- meta-oe/classes/signing.bbclass | 29 ----------------------------- 1 file changed, 29 deletions(-) diff --git a/meta-oe/classes/signing.bbclass b/meta-oe/classes/signing.bbclass index 1f50e89d1e..c9759e9198 100644 --- a/meta-oe/classes/signing.bbclass +++ b/meta-oe/classes/signing.bbclass @@ -217,35 +217,6 @@ signing_get_root_cert() { echo "${cert_name}" } -# signing_import_cert_chain_from_pem -# -# Import a certificate *chain* from a PEM file to a role. -# (e.g. multiple ones concatenated in one file) -# -# Due to limitations in the toolchain: -# signing class -> softhsm -> 'extract-cert' -# the input certificate is split into a sequentially numbered list of roles, -# starting at _1 -# -# (The limitations are the conversion step from x509 to a plain .der, and -# extract-cert expecting a x509 and then producing only plain .der again) -signing_import_cert_chain_from_pem() { - local role="${1}" - local pem="${2}" - local i=1 - - cat "${pem}" | \ - while openssl x509 -inform pem -outform der -out ${B}/temp_${i}.der; do - signing_import_define_role "${role}_${i}" - signing_pkcs11_tool --type cert \ - --write-object ${B}/temp_${i}.der \ - --label "${role}_${i}" - rm ${B}/temp_${i}.der - echo "imported ${pem} under role: ${role}_${i}" - i=$(awk "BEGIN {print $i+1}") - done -} - # signing_import_cert_from_pem # # Import a certificate from PEM file to a cert_name.