Enabled PNOR signed image validation

Enable signature validation during version activation
based on the WANT_SIGNATURE_VERIFY flag.

Change-Id: If8f4357553be9ed2fbcf86b4dddec768532a043a
Signed-off-by: Jayanth Othayoth <ojayanth@in.ibm.com>
Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>

2 files changed, 36 insertions, 0 deletions

diff --git a/activation.cpp b/activation.cpp
index 350bf5ad1..ce20dcbd2 100755
--- a/activation.cpp
+++ b/activation.cpp
@@ -5,6 +5,14 @@
 #include "serialize.hpp"
 #include <phosphor-logging/log.hpp>
 
+#ifdef WANT_SIGNATURE_VERIFY
+#include <phosphor-logging/elog.hpp>
+#include <phosphor-logging/elog-errors.hpp>
+#include <xyz/openbmc_project/Common/error.hpp>
+#include "image_verify.hpp"
+#include "config.h"
+#endif
+
 namespace openpower
 {
 namespace software
@@ -17,6 +25,11 @@ namespace softwareServer = sdbusplus::xyz::openbmc_project::Software::server;
 
 using namespace phosphor::logging;
 
+#ifdef WANT_SIGNATURE_VERIFY
+using InternalFailure =
+    sdbusplus::xyz::openbmc_project::Common::Error::InternalFailure;
+#endif
+
 constexpr auto SYSTEMD_SERVICE = "org.freedesktop.systemd1";
 constexpr auto SYSTEMD_OBJ_PATH = "/org/freedesktop/systemd1";
 
@@ -105,6 +118,25 @@ auto Activation::activation(Activations value) -> Activations
 
         if (ubiVolumesCreated == false)
         {
+
+#ifdef WANT_SIGNATURE_VERIFY
+            using Signature = openpower::software::image::Signature;
+
+            fs::path imagePath(IMG_DIR);
+
+            Signature signature(imagePath / versionId, SIGNED_IMAGE_CONF_PATH);
+
+            // Validate the signed image.
+            if (!signature.verify())
+            {
+                log<level::ERR>("Error occurred during image validation");
+                report<InternalFailure>();
+
+                return softwareServer::Activation::activation(
+                    softwareServer::Activation::Activations::Failed);
+            }
+#endif
+
             Activation::startActivation();
             return softwareServer::Activation::activation(value);
         }
diff --git a/configure.ac b/configure.ac
index f9f8d37bd..fd8a17d68 100755
--- a/configure.ac
+++ b/configure.ac
@@ -72,6 +72,10 @@ AC_DEFINE(FILEPATH_IFACE, "xyz.openbmc_project.Common.FilePath",
 AC_DEFINE(BUSNAME_UPDATER, "org.open_power.Software.Host.Updater",
     [The item updater DBus busname to own.])
 
+AC_ARG_VAR(IMG_DIR, [Directory where downloaded or uploaded software images are placed and extracted])
+AS_IF([test "x$IMG_DIR" == "x"], [IMG_DIR="/tmp/images"])
+AC_DEFINE_UNQUOTED([IMG_DIR], ["$IMG_DIR"], [Directory where downloaded or uploaded software images are placed and extracted])
+
 AC_ARG_VAR(MANIFEST_FILE, [The path to the MANIFEST file])
 AS_IF([test "x$MANIFEST_FILE" == "x"], [MANIFEST_FILE="MANIFEST"])
 AC_DEFINE_UNQUOTED([MANIFEST_FILE], ["$MANIFEST_FILE"], [The path to the MANIFEST file])