Re: [PATCH v3 ima-evm-utils 0/7] Deprecate sign_hash and add provider support

From: Stefan Berger <stefanb@linux.ibm.com>
To: linux-integrity@vger.kernel.org
Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org
Subject: Re: [PATCH v3 ima-evm-utils 0/7] Deprecate sign_hash and add provider support
Date: Mon, 26 Feb 2024 13:28:46 -0500	[thread overview]
Message-ID: <be970db7-b895-4102-9b16-4c5db6914597@linux.ibm.com> (raw)
In-Reply-To: <20240226182101.25210-1-stefanb@linux.ibm.com>


On 2/26/24 13:20, Stefan Berger wrote:
> This series deprecates the sign_hash function and introduces
> imaevm_signhash that requires the necessary parameters to be passed rather
> than relying on the global imaevm_params variable. This way we can remove
> the usage of imaevm_params for the OpenSSL engine and the keyid.
> 
> Add support for an OpenSSL provider. The choice of engine versus provider
> is implemented using a struct imaevm_ossl_access that wraps the engine or
> provider parameters. It also provides a type field where the user can
> choose one or the other. imaevm_signhash takes this structure as an optional
> parameter to support engines and providers.
> 
> Also extend existing test cases with tests with a pkcs11 provider.
> 
> Regards,
>     Stefan
> 
> v3:
>   - Added patch checking for engine support in evmctl before trying to run
>     pkcs11 test (1/7)
>   - Updated README with new --provider option (5/7)
>   - Added 2 more skip's to pkcs11 test in case neither engine nor provider
>     are supported (6/7)
Correction:
  - Added 2 more skip's to pkcs11 test in case softhsm is not installed
    (6/7)