mirror of
https://github.com/Telecominfraproject/OpenCellular.git
synced 2025-11-24 18:25:10 +00:00
068fc6f251
This allows signing using a .pem file using an external program.
It is assumed that the external program reads input from stdin, and outputs signed data on stdout. It takes one argument - the file name for the .pem private key reference. See external_rsa_signer.sh for an example external program.
Example usage:
vbutil_keyblock --pack 4096.keyblock \
--datapubkey 4096.vbpubk \
--signprivate_pem 4096.pem \
--pem_algorithm 8 \
--externalsigner "external_rsa_signer.sh"
I have tried to make the change such that it doesn't impact existing tools/interfaces (since these are used at various places). That said, I am aware of the places where we could just extend an old interface an avoid code duplication but thought I'd put that re-factoring in as a TODO for now. Let me know if you disagree and I can merge them (and changing the existing interface).
BUG=7576
TEST=Extended run_vbutil_tests.sh to test vbutil_keyblock packing using an external signer.
To test, make && make runtests (or just run tests/gen_test_keys.sh; tests/run_vbutils_tests.sh)
Review URL: http://codereview.chromium.org/4194003
Change-Id: I7cc52c8293c04ef9ba074794d046c9a4f19f6bdd
46 lines
1.7 KiB
C
46 lines
1.7 KiB
C
/* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
|
|
* Use of this source code is governed by a BSD-style license that can be
|
|
* found in the LICENSE file.
|
|
*
|
|
* Host-side functions for verified boot.
|
|
*/
|
|
|
|
#ifndef VBOOT_REFERENCE_HOST_KEYBLOCK_H_
|
|
#define VBOOT_REFERENCE_HOST_KEYBLOCK_H_
|
|
|
|
#include "host_key.h"
|
|
#include "vboot_struct.h"
|
|
|
|
|
|
/* Create a key block header containing [data_key] and [flags], signed
|
|
* by private key the file [signing_key_pem_file] and algorithm [algorithm]
|
|
* using the external signer program [external_signer] for all private key
|
|
* operations.
|
|
* Caller owns the returned pointer, and must free
|
|
* it with Free(). */
|
|
VbKeyBlockHeader* KeyBlockCreate_external(const VbPublicKey* data_key,
|
|
const char* signing_key_pem_file,
|
|
uint64_t algorithm,
|
|
uint64_t flags,
|
|
const char* external_signer);
|
|
|
|
/* Create a key block header containing [data_key] and [flags], signed
|
|
* by [signing_key]. Caller owns the returned pointer, and must free
|
|
* it with Free(). */
|
|
VbKeyBlockHeader* KeyBlockCreate(const VbPublicKey* data_key,
|
|
const VbPrivateKey* signing_key,
|
|
uint64_t flags);
|
|
|
|
|
|
/* Read a key block from a .keyblock file. Caller owns the returned
|
|
* pointer, and must free it with Free().
|
|
*
|
|
* Returns NULL if error. */
|
|
VbKeyBlockHeader* KeyBlockRead(const char* filename);
|
|
|
|
|
|
/* Write a key block to a file in .keyblock format. */
|
|
int KeyBlockWrite(const char* filename, const VbKeyBlockHeader* key_block);
|
|
|
|
#endif /* VBOOT_REFERENCE_HOST_KEYBLOCK_H_ */
|