All of lore.kernel.org
 help / color / mirror / Atom feed
From: Alex Kiernan <alex.kiernan@gmail.com>
To: u-boot@lists.denx.de
Subject: [U-Boot] [PATCH 2/2] mkimage: fit_image: Add support for SOURCE_DATE_EPOCH in signatures
Date: Wed, 20 Jun 2018 20:10:52 +0000	[thread overview]
Message-ID: <20180620201052.15428-2-alex.kiernan@gmail.com> (raw)
In-Reply-To: <20180620201052.15428-1-alex.kiernan@gmail.com>

When generating timestamps in signatures, use imagetool_get_source_date()
so we can be overridden by SOURCE_DATE_EPOCH to generate reproducible
images.

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
---

 include/image.h    |  3 ++-
 tools/fit_image.c  |  3 ++-
 tools/image-host.c | 34 ++++++++++++++++++++--------------
 3 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/include/image.h b/include/image.h
index 420b8ff576..3bb7d29ef2 100644
--- a/include/image.h
+++ b/include/image.h
@@ -1009,6 +1009,7 @@ int fit_set_timestamp(void *fit, int noffset, time_t timestamp);
  * @comment:	Comment to add to signature nodes
  * @require_keys: Mark all keys as 'required'
  * @engine_id:	Engine to use for signing
+ * @cmdname:	Command name used when reporting errors
  *
  * Adds hash values for all component images in the FIT blob.
  * Hashes are calculated for all component images which have hash subnodes
@@ -1022,7 +1023,7 @@ int fit_set_timestamp(void *fit, int noffset, time_t timestamp);
  */
 int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
 			      const char *comment, int require_keys,
-			      const char *engine_id);
+			      const char *engine_id, const char *cmdname);
 
 int fit_image_verify_with_data(const void *fit, int image_noffset,
 			       const void *data, size_t size);
diff --git a/tools/fit_image.c b/tools/fit_image.c
index 6f09a66106..3c265357ae 100644
--- a/tools/fit_image.c
+++ b/tools/fit_image.c
@@ -60,7 +60,8 @@ static int fit_add_file_data(struct image_tool_params *params, size_t size_inc,
 		ret = fit_add_verification_data(params->keydir, dest_blob, ptr,
 						params->comment,
 						params->require_keys,
-						params->engine_id);
+						params->engine_id,
+						params->cmdname);
 	}
 
 	if (dest_blob) {
diff --git a/tools/image-host.c b/tools/image-host.c
index 8e43671714..faa5e23c79 100644
--- a/tools/image-host.c
+++ b/tools/image-host.c
@@ -106,7 +106,7 @@ static int fit_image_process_hash(void *fit, const char *image_name,
  */
 static int fit_image_write_sig(void *fit, int noffset, uint8_t *value,
 		int value_len, const char *comment, const char *region_prop,
-		int region_proplen)
+		int region_proplen, const char *cmdname)
 {
 	int string_size;
 	int ret;
@@ -128,8 +128,12 @@ static int fit_image_write_sig(void *fit, int noffset, uint8_t *value,
 	}
 	if (comment && !ret)
 		ret = fdt_setprop_string(fit, noffset, "comment", comment);
-	if (!ret)
-		ret = fit_set_timestamp(fit, noffset, time(NULL));
+	if (!ret) {
+		time_t timestamp = imagetool_get_source_date(cmdname,
+							     time(NULL));
+
+		ret = fit_set_timestamp(fit, noffset, timestamp);
+	}
 	if (region_prop && !ret) {
 		uint32_t strdata[2];
 
@@ -200,7 +204,8 @@ static int fit_image_setup_sig(struct image_sign_info *info,
 static int fit_image_process_sig(const char *keydir, void *keydest,
 		void *fit, const char *image_name,
 		int noffset, const void *data, size_t size,
-		const char *comment, int require_keys, const char *engine_id)
+		const char *comment, int require_keys, const char *engine_id,
+		const char *cmdname)
 {
 	struct image_sign_info info;
 	struct image_region region;
@@ -228,7 +233,7 @@ static int fit_image_process_sig(const char *keydir, void *keydest,
 	}
 
 	ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
-			NULL, 0);
+			NULL, 0, cmdname);
 	if (ret) {
 		if (ret == -FDT_ERR_NOSPACE)
 			return -ENOSPC;
@@ -295,7 +300,7 @@ static int fit_image_process_sig(const char *keydir, void *keydest,
  */
 int fit_image_add_verification_data(const char *keydir, void *keydest,
 		void *fit, int image_noffset, const char *comment,
-		int require_keys, const char *engine_id)
+		int require_keys, const char *engine_id, const char *cmdname)
 {
 	const char *image_name;
 	const void *data;
@@ -332,7 +337,7 @@ int fit_image_add_verification_data(const char *keydir, void *keydest,
 				strlen(FIT_SIG_NODENAME))) {
 			ret = fit_image_process_sig(keydir, keydest,
 				fit, image_name, noffset, data, size,
-				comment, require_keys, engine_id);
+				comment, require_keys, engine_id, cmdname);
 		}
 		if (ret)
 			return ret;
@@ -573,7 +578,7 @@ static int fit_config_get_data(void *fit, int conf_noffset, int noffset,
 static int fit_config_process_sig(const char *keydir, void *keydest,
 		void *fit, const char *conf_name, int conf_noffset,
 		int noffset, const char *comment, int require_keys,
-		const char *engine_id)
+		const char *engine_id, const char *cmdname)
 {
 	struct image_sign_info info;
 	const char *node_name;
@@ -608,7 +613,7 @@ static int fit_config_process_sig(const char *keydir, void *keydest,
 	}
 
 	ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
-				region_prop, region_proplen);
+				region_prop, region_proplen, cmdname);
 	if (ret) {
 		if (ret == -FDT_ERR_NOSPACE)
 			return -ENOSPC;
@@ -637,7 +642,7 @@ static int fit_config_process_sig(const char *keydir, void *keydest,
 
 static int fit_config_add_verification_data(const char *keydir, void *keydest,
 		void *fit, int conf_noffset, const char *comment,
-		int require_keys, const char *engine_id)
+		int require_keys, const char *engine_id, const char *cmdname)
 {
 	const char *conf_name;
 	int noffset;
@@ -656,7 +661,7 @@ static int fit_config_add_verification_data(const char *keydir, void *keydest,
 			     strlen(FIT_SIG_NODENAME))) {
 			ret = fit_config_process_sig(keydir, keydest,
 				fit, conf_name, conf_noffset, noffset, comment,
-				require_keys, engine_id);
+				require_keys, engine_id, cmdname);
 		}
 		if (ret)
 			return ret;
@@ -667,7 +672,7 @@ static int fit_config_add_verification_data(const char *keydir, void *keydest,
 
 int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
 			      const char *comment, int require_keys,
-			      const char *engine_id)
+			      const char *engine_id, const char *cmdname)
 {
 	int images_noffset, confs_noffset;
 	int noffset;
@@ -690,7 +695,8 @@ int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
 		 * i.e. component image node.
 		 */
 		ret = fit_image_add_verification_data(keydir, keydest,
-				fit, noffset, comment, require_keys, engine_id);
+				fit, noffset, comment, require_keys, engine_id,
+				cmdname);
 		if (ret)
 			return ret;
 	}
@@ -714,7 +720,7 @@ int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
 		ret = fit_config_add_verification_data(keydir, keydest,
 						       fit, noffset, comment,
 						       require_keys,
-						       engine_id);
+						       engine_id, cmdname);
 		if (ret)
 			return ret;
 	}
-- 
2.17.1

  reply	other threads:[~2018-06-20 20:10 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-06-20 20:10 [U-Boot] [PATCH 1/2] mkimage: Refactor imagetool_get_source_date to take command name Alex Kiernan
2018-06-20 20:10 ` Alex Kiernan [this message]
2018-06-21 19:45   ` [U-Boot] [PATCH 2/2] mkimage: fit_image: Add support for SOURCE_DATE_EPOCH in signatures Simon Glass
2018-07-11 12:43   ` [U-Boot] [U-Boot, " Tom Rini
2018-06-21 19:45 ` [U-Boot] [PATCH 1/2] mkimage: Refactor imagetool_get_source_date to take command name Simon Glass
2018-07-11 12:43 ` [U-Boot] [U-Boot, " Tom Rini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180620201052.15428-2-alex.kiernan@gmail.com \
    --to=alex.kiernan@gmail.com \
    --cc=u-boot@lists.denx.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.