* [PATCH] mkimage: use environment variable MKIMAGE_SIGN_PIN to set pin for OpenSSL Engine
@ 2021-07-23 20:17 Marc Kleine-Budde
2021-07-29 16:50 ` Tom Rini
2021-08-18 15:37 ` Alex G.
0 siblings, 2 replies; 3+ messages in thread
From: Marc Kleine-Budde @ 2021-07-23 20:17 UTC (permalink / raw)
To: U-Boot; +Cc: kernel, Marc Kleine-Budde
This patch adds the possibility to pass the PIN the OpenSSL Engine
used during signing via the environment variable MKIMAGE_SIGN_PIN.
This follows the approach used during kernel module
signing ("KBUILD_SIGN_PIN") or UBIFS image
signing ("MKIMAGE_SIGN_PIN").
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
doc/uImage.FIT/signature.txt | 4 ++--
lib/rsa/rsa-sign.c | 11 +++++++++++
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/doc/uImage.FIT/signature.txt b/doc/uImage.FIT/signature.txt
index 7cb1c15e5e15..61a72db3c74f 100644
--- a/doc/uImage.FIT/signature.txt
+++ b/doc/uImage.FIT/signature.txt
@@ -533,8 +533,8 @@ Generic engine key ids:
or
"<key-name-hint>"
-As mkimage does not at this time support prompting for passwords HSM may need
-key preloading wrapper to be used when invoking mkimage.
+In order to set the pin in the HSM, an environment variable "MKIMAGE_SIGN_PIN"
+can be specified.
The following examples use the Nitrokey Pro using pkcs11 engine. Instructions
for other devices may vary.
diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
index f4ed11e74a4a..49abec6c83fb 100644
--- a/lib/rsa/rsa-sign.c
+++ b/lib/rsa/rsa-sign.c
@@ -338,6 +338,7 @@ static int rsa_init(void)
static int rsa_engine_init(const char *engine_id, ENGINE **pe)
{
+ const char *key_pass;
ENGINE *e;
int ret;
@@ -362,10 +363,20 @@ static int rsa_engine_init(const char *engine_id, ENGINE **pe)
goto err_set_rsa;
}
+ key_pass = getenv("MKIMAGE_SIGN_PIN");
+ if (key_pass) {
+ if (!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0)) {
+ fprintf(stderr, "Couldn't set PIN\n");
+ ret = -1;
+ goto err_set_pin;
+ }
+ }
+
*pe = e;
return 0;
+err_set_pin:
err_set_rsa:
ENGINE_finish(e);
err_engine_init:
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] mkimage: use environment variable MKIMAGE_SIGN_PIN to set pin for OpenSSL Engine
2021-07-23 20:17 [PATCH] mkimage: use environment variable MKIMAGE_SIGN_PIN to set pin for OpenSSL Engine Marc Kleine-Budde
@ 2021-07-29 16:50 ` Tom Rini
2021-08-18 15:37 ` Alex G.
1 sibling, 0 replies; 3+ messages in thread
From: Tom Rini @ 2021-07-29 16:50 UTC (permalink / raw)
To: Marc Kleine-Budde; +Cc: U-Boot, kernel
[-- Attachment #1: Type: text/plain, Size: 454 bytes --]
On Fri, Jul 23, 2021 at 10:17:50PM +0200, Marc Kleine-Budde wrote:
> This patch adds the possibility to pass the PIN the OpenSSL Engine
> used during signing via the environment variable MKIMAGE_SIGN_PIN.
> This follows the approach used during kernel module
> signing ("KBUILD_SIGN_PIN") or UBIFS image
> signing ("MKIMAGE_SIGN_PIN").
>
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Applied to u-boot/master, thanks!
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] mkimage: use environment variable MKIMAGE_SIGN_PIN to set pin for OpenSSL Engine
2021-07-23 20:17 [PATCH] mkimage: use environment variable MKIMAGE_SIGN_PIN to set pin for OpenSSL Engine Marc Kleine-Budde
2021-07-29 16:50 ` Tom Rini
@ 2021-08-18 15:37 ` Alex G.
1 sibling, 0 replies; 3+ messages in thread
From: Alex G. @ 2021-08-18 15:37 UTC (permalink / raw)
To: u-boot
Hi Marc,
On 7/23/21 3:17 PM, Marc Kleine-Budde wrote:
> This patch adds the possibility to pass the PIN the OpenSSL Engine
> used during signing via the environment variable MKIMAGE_SIGN_PIN.
> This follows the approach used during kernel module
> signing ("KBUILD_SIGN_PIN") or UBIFS image
> signing ("MKIMAGE_SIGN_PIN").
I think the preferred approach would have been to add a flag to mkimage,
similar to "-N => openssl engine to use for signing". Environment
variables are rarely used to talk to tools, and not very intuitive. I
can only really think of NO_SDL=1 being used by u-boot.
Since this patch already made it, I hope you have the bandwidth to look
at converting this to a mkimage flag.
Alex
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
> ---
> doc/uImage.FIT/signature.txt | 4 ++--
> lib/rsa/rsa-sign.c | 11 +++++++++++
> 2 files changed, 13 insertions(+), 2 deletions(-)
>
> diff --git a/doc/uImage.FIT/signature.txt b/doc/uImage.FIT/signature.txt
> index 7cb1c15e5e15..61a72db3c74f 100644
> --- a/doc/uImage.FIT/signature.txt
> +++ b/doc/uImage.FIT/signature.txt
> @@ -533,8 +533,8 @@ Generic engine key ids:
> or
> "<key-name-hint>"
>
> -As mkimage does not at this time support prompting for passwords HSM may need
> -key preloading wrapper to be used when invoking mkimage.
> +In order to set the pin in the HSM, an environment variable "MKIMAGE_SIGN_PIN"
> +can be specified.
>
> The following examples use the Nitrokey Pro using pkcs11 engine. Instructions
> for other devices may vary.
> diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
> index f4ed11e74a4a..49abec6c83fb 100644
> --- a/lib/rsa/rsa-sign.c
> +++ b/lib/rsa/rsa-sign.c
> @@ -338,6 +338,7 @@ static int rsa_init(void)
>
> static int rsa_engine_init(const char *engine_id, ENGINE **pe)
> {
> + const char *key_pass;
> ENGINE *e;
> int ret;
>
> @@ -362,10 +363,20 @@ static int rsa_engine_init(const char *engine_id, ENGINE **pe)
> goto err_set_rsa;
> }
>
> + key_pass = getenv("MKIMAGE_SIGN_PIN");
> + if (key_pass) {
> + if (!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0)) {
> + fprintf(stderr, "Couldn't set PIN\n");
> + ret = -1;
> + goto err_set_pin;
> + }
> + }
> +
> *pe = e;
>
> return 0;
>
> +err_set_pin:
> err_set_rsa:
> ENGINE_finish(e);
> err_engine_init:
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-08-18 15:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-23 20:17 [PATCH] mkimage: use environment variable MKIMAGE_SIGN_PIN to set pin for OpenSSL Engine Marc Kleine-Budde
2021-07-29 16:50 ` Tom Rini
2021-08-18 15:37 ` Alex G.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.