| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
- Adds support to specify --sw-flags in crtSignedContainer.sh
|
|
|
|
|
|
|
|
|
|
|
| |
This change is dependent on the related change to genPnorImages.pl in
Hostboot, and although it's changed upstream, there are still active
op-build machine configs that are locked to an older version. So it's
unclear when this change can be finalized. For now I'm going to punt
and allow the old cmdline options to still work, and continue to
support both the new and deprecated cmdline options.
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
|
|
|
|
| |
Make sure the value of any boolean configuration property is set to
an acceptable string (True), or an empty string (False). This is safer
and more robust.
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
|
|
|
|
| |
It makes sense to do this for environments outside of op-build. Under
op-build it's helpful to keep cache by default, so now will set it
explicitly under op-build.
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
|
|
|
|
|
|
| |
This adds support for PKCS11 as an alternate key management system in
place of signframework, and adds the configuation property SB_KMS and
a new command line option --kms to select between them. If unset the
default is "signframework". If set to "pkcs11" two additional
configuration properties, specifying the token name and the shared
library implementing the token, are recognized. These properties are
set by environment, or via the INI under a new section [pkcs11].
|
|
|
|
|
|
|
|
|
| |
This completes support for the the case where HW key signing is done
standalone in Local or Independent mode, and the signatures are imported
into Production mode. It also adds support for the opposite case, where
HW key siging is done in Production mode and artifacts are imported and
exported to FW key signing in Local mode. Refactors most of the
keyfinder/sigfinder code in crtSignedContainer.sh.
|
|
|
|
|
|
|
|
|
|
|
| |
Supports the case where HW key signing is done standalone in Local or
Independent mode, and the signatures are imported into Production mode.
The use of "signing project" names, used previously in Production only,
is now extended to Local or Independent mode. The HW key signer may set
a "hw_signing_project_basename". If set, the export will be prepared
for import to a Production mode process where the same project basename
is in use. On import, signtool will pick up the artifacts generated
by this basename.
|
|
|
|
| |
because SBKT and SBKTRAND are regenerated on each run
|
|
|
|
|
|
|
| |
because AIX doesn't like it. In this case, can get the same result by just
deleting the destination directory first.
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
|
|
|
|
| |
If no --out is provide we use a scratch file for output container. But
there is no reason to keep this; if the user wants a persistent file he
can specify --out.
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
|
|
|
|
| |
This adds config properties SB_VERIFY_TRANS and SB_PROJECT_INI_TRANS.
If set, these take precedence over their non-_TRANS counterparts for
the transistion 'to' container only (SBKTRAND).
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
|
|
| |
as to not interfere with the operation of help or usage.
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
|
|
|
|
| |
This patch removes the second dependency in crtSignedContainer.sh, in the
generation of the payload hash, in Production mode. Now the .md files
are generated by create-container instead.
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
|
|
|
|
| |
There is no 'xxd' command in AIX. This patch removes one of the two
dependencies in crtSignedContainer.sh: in the is_key_raw() function.
This is now done with a shell comparison instead.
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|\
| |
| | |
Add get_date_string() function to crtSignedContainer.sh
|
| |
| |
| |
| |
| |
| |
| | |
On some systems (AIX) the date command does not support the '-d' option
and there is no facility to convert numeric time to presentation format.
The new function uses Perl as a fallback in this case. Thanks to Matt
Vaught (mtvaught-ibm) for the suggestion.
|
|/
|
|
|
|
|
|
| |
In indpendent mode, there are cases where we want to look for signatures
elsewhere in the cache, if not found in the local cache, that were not
covered previously.
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
|
|
|
|
| |
Test for nonzero value is the default test operation in shell, so it's not
necessary to use -n explicitly in tests. Removing them makes the code a
bit more compact.
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
|
|
|
|
|
|
| |
In cases where input payload or output imagefile are not needed, we previously
required __none to be specified for these properties. But really they can be
omitted, and we can treat it as if __none were specified.
Also, fix a shellcheck warning from a previous commit.
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
|
|
|
|
| |
Add a simple check to crtSignedContainer.sh to make sure basic tools, openssl
commands, and other signtool and signframework executables are found in PATH,
before proceeding.
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
|
|
|
| |
Fix some warnings from shellcheck static analyzer tool, in crtSignedContainer.sh,
mostly regarding double-quoting
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@linux.vnet.ibm.com>
|
|
|
|
|
|
| |
Helpful for execution under op-build, where command line options are not exposed.
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
|
|
|
| |
On __getkey, the behavior should be to integrate a signature if found, but
skip the request if not found. Currently it skips both.
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|\
| |
| | |
Add --contrHdrOut option to crtSignedContainer.sh
|
| |
| |
| |
| | |
Adds option to dump the container header (first 4k) without the payload.
|
|\ \
| |/
|/| |
Make signproject base names configurable via env or INI
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This patch allows signframework project basenames to be settable via env
or INI. There are three new env properties: SF_HW_SIGNING_PROJECT_BASE,
SF_FW_SIGNING_PROJECT_BASE and SF_GETPUBKEY_PROJECT_BASE. In the INI, there
are three new properties under a new section [signproject]. The defaults
are the values that were previously hardcoded.
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
| |
| |
| |
| | |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|/
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|
|
|
|
| |
Signed-off-by: Dave Heller <hellerda@us.ibm.com>
|